## 5 Results
### Adversarial Example Attacks
#### 5.2.2 Adversarial Examples-Types of Attack  
**White-Box Attacks:** Most white-box attacks are commonly achieved through gradient descent to increase the loss function of the target model. The algorithmic generation of adversarial examples is possible. Moreover, [PERSON] et al. [65] developed a software library for the easy generation of adversarial examples and other libraries are now available. An early gradient descent approach was proposed by [PERSON] et al. [17] using a box-constrained limited memory L-BFGS. Given an original image, this method finds a different image that is classified differently, whilst remaining similar to the original image. Gradient descent is used by many different algorithms; however, algorithms have been designed to be optimized for different distance metrics. There are numerous gradient descent algorithms that produce adversarial examples; they can differ in their optimization and computational complexity. We note the relative computational complexity of common adversarial example algorithms in Table 6 (adapted from [27]). High success rates correlate with high computational complexity. We expect this correlation to be more pronounced for functionality-preserving attacks. FGSM [63] was improved by [PERSON] et al. [103], who refined the fast gradient sign by taking multiple smaller steps. This iterative granular approach improves on FGSM by limiting the difference between the original and adversarial inputs. This often results in adversarial inputs with a predictably smaller \(L_{\infty}\) metric. However, FGSM modifies all parameters. This is problematic for features that must remain unchanged or for discrete features such as application programming interface (API) calls. JSMA differs from FGSM in that it optimises to minimize the total number of modified features (\(L_{0}\) metric). In this greedy algorithm, individual features are chosen with the aim of step-wise increasing the target classification in each iteration. The gradient is used to generate a saliency map, modelling each feature's impact towards the resulting classification. Large values significantly increase the likelihood of classification as the target class. Thus, the most important feature is modified at each stage. This process continues until the input is successfully classified as the target class, or a threshold number of pixels is reached. This algorithm results in adversarial inputs with fewer modified features. The Deepfool algorithm [62] similarly uses gradient descent but optimises for the root-mean-square, also known as Euclidean distance (\(L_{2}\)). This technique simplifies the task of shifting an input over a decision boundary by assuming a linear hyper-plane separates each class. The optimal solution is derived through analysis and subsequently an adversarial example is constructed; however, neural network decision boundaries are not truly linear. Therefore, subsequent repetitions may be required until a true adversarial image is found. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Method** & **Computational Complexity** & **Success Rate** \\ \hline L-BFGS & High & High \\ FGSM & Low & Low \\ JSMA & High & High \\ DeepFool & Low & Low \\ One-pixel & Low & Low \\ CW Attack & High & High \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Computational complexity of common adversarial example algorithms. The optimizations for different distance metrics are types of constraint: maximum change to any feature (\(L_{\infty}\)); minimal root-mean-square (\(L_{2}\)); minimal number of altered features (\(L_{0}\)). Constrained adversarial examples are important for functionality-preserving attacks. Additional constraints for specific domains are likely required, and this remains an open avenue for further research. Most gradient descent algorithms were originally presented in the visual domain and used on images and pixel values. The pixel values of images are often presented as continuous values (0-255).