Title: Adversarial methods

Q: White box
A: White box attacks need access to the model's parameters

Q: FGSM
A: Fast Gradient Sign Method is a white box adversarial method where we move in the direction of increasing cost
\[
x_{\mathrm{adv}}=x+\epsilon \cdot \operatorname{sign}\left(\nabla_x J(\theta, x, y)\right)
\]
where
- \(x_{\text {adv }}\) : Adversarial image.
- \(x\) : Original input image.
- \(y\) : Original input label.
- \(\epsilon\) : Multiplier to ensure the perturbations are small.
- \(\theta\) : Model parameters.
- \(J\) : Loss.
In targeted attacks, we replace \(y\) with the desired target and flip the sign to minimise the cost.

Q: PGD
A: Projected Gradient Descent is the same as FGSM except in addition to the multiplier of the gradient sign we also clamp/project inside a ball in L2.

Q: Adversarial training
A: For some hyperparameter \(\lambda\), model \(f\), static adversarial attacker \(g_\text{adv}\) we minimise the loss
\[
\operatorname{Loss}(f, \mathcal{D})=\underset{x, y \sim D}{\mathbb{E}}\left[\operatorname{CrossEntropy}(f(x), y)+\lambda \cdot \operatorname{CrossEntropy}\left(f\left(g_{\text {adv }}(x)\right), y\right)\right]
\]