PART 6 · MODULE 3PGD and beyond
Advanced Attack Methods
Sophisticated adversarial techniques
Loading module...
Sophisticated adversarial techniques
FGSM is fast but crude. Researchers have developed increasingly sophisticated attack methods that find smaller, more imperceptible perturbations while achieving higher success rates. Understanding these helps defenders prepare for real-world threats.
Think of it as a spectrum of precision. FGSMis a sledgehammer — fast but obvious. PGDis a chisel — more refined. C&Wis a surgeon's scalpel — nearly undetectable.
Takes FGSM and repeats it many times with small steps. After each step, it clips the perturbation to stay within a budget. Like walking carefully toward a cliff edge instead of leaping.
Uses mathematical optimization to find the absolute smallest change needed to fool the model. It solves a minimization problem: what is the tiniest perturbation that flips the prediction?
One of the earliest methods. Uses a classic optimization algorithm to search for adversarial examples. Slower than FGSM but finds more subtle perturbations.
Attack Effectiveness: Perturbation Size vs Fooling Rate
The attacker has full access to the model — its architecture, weights, and gradients. Like having the answer key to an exam. All the attacks above assume white-box access, which makes them powerful but requires insider knowledge.
The attacker can only send inputs and observe outputs. Like trying to crack a safe by listening to the clicks. Harder, but still possible — attackers can estimate gradients by querying the model many times.
Here is what makes adversarial attacks truly dangerous: an adversarial example crafted for one model often fools completely different models too. Attack a ResNet, and the same image might fool a VGG, an Inception, or even a model you have never seen.
This means an attacker does not need access to your specific model. They can build their own, craft attacks on it, and those attacks will likely work on yours. Black-box attacks become practical through transferability.
More sophisticated attacks need smaller, more imperceptible changes to fool AI. As defenses improve, attackers develop subtler methods. The arms race between attack and defense is a defining challenge of AI security.
For hands-on practice, check out the AI Security course on GitHub.