Cross Validated is a question and answer site for people interested in statistics, machine learning, data analysis, data mining, and data visualization. It only takes a minute to sign up.
Sign up to join this community
FGSM as described by Goodfellow et al takes the sign of the gradient of a model w.r.t. the input. And then performs gradient descent (or ascent, depending on your objective).
However why not use directly the gradient and take the sign of the gradient to create an adversarial example?
From experiments I run myself it seemed to converge faster and generate better examples. But I am not sure how well it generalizes. Any ideas on what is the benefit of taking the sign?
FGSM was originally designed to analyse the sensitivity of neural networks to small changes at input. It was not designed to generate adversarial examples.
By taking the sign of the gradient for each pixel the authors could modify the entire image with uniform magnitude, but in specific gradient directions. Then they could observe how much modification was required to change an image's class.
A good adversarial attack is the L2 attack from Carlini & Wagner. It uses the entire gradient from pre softmax logits to modify the original input, with additional distance constraints.
