FGSM as described by Goodfellow et al takes the sign of the gradient of a model w.r.t. the input. And then performs gradient descent (or ascent, depending on your objective).

However why not use directly the gradient and take the sign of the gradient to create an adversarial example?

From experiments I run myself it seemed to converge faster and generate better examples. But I am not sure how well it generalizes. Any ideas on what is the benefit of taking the sign?


1 Answer 1


FGSM was originally designed to analyse the sensitivity of neural networks to small changes at input. It was not designed to generate adversarial examples.

By taking the sign of the gradient for each pixel the authors could modify the entire image with uniform magnitude, but in specific gradient directions. Then they could observe how much modification was required to change an image's class.

A good adversarial attack is the L2 attack from Carlini & Wagner. It uses the entire gradient from pre softmax logits to modify the original input, with additional distance constraints.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.