0
$\begingroup$

The authors of the paper "Explaining and harnessing adversarial examples" (ICLR'15) give the following rationale for taking the sign of the gradient of the loss with respect to its inputs in Section 4 of the paper:

We can linearize the cost function around the current value of $\theta$, obtaining an optimal max-norm constrained perturbation

I am trying to understand what they mean by this. Do they mean that they find a linear approximation with a first-term Taylor expansion? I do not see how that leads them to take the sign in the FGSM attack formulation.

$\endgroup$
0

0