# Review of Artificial Intelligence Adversarial Attack and Defense Technologies
## 3 Adversarial Attacks
### Testing Stage Adversarial Attacks
#### 3.2.1 White-Box Attacks  
In white-box attacks, the adversaries know the structure and parameters of the target model, although it is difficult to achieve in practice, once the adversaries access to the target model, it will pose a great threat to a machine learning model, as an adversary can construct adversarial samples by analyzing the structure of the target model to carry out attacks. [PERSON] et al. [14] introduced an adversarial crafting framework, which can be divided into two steps, i.e., direction sensitivity estimation and perturbation selection--as is shown in Figure 4.  
Suppose \(X\) is an input sample, \(f\) is a trained DNN classification model, the objective of the adversary is to generate an adversarial sample \(X^{{}^{\prime}}=\delta X+X\) by adding a perturbation \(\delta X\) with \(X\), so that \(f(X^{{}^{\prime}})=Y^{{}^{\prime}}\) where \(Y^{{}^{\prime}}\
eq f(X)\) is the target output that depends on the adversary's objective. This framework includes two steps:  
* **Direction Sensitivity Estimation. ** The adversary evaluates the sensitivity of the change to each input feature by identifying directions in the data manifold around sample \(X\) in which the model \(f\) is most sensitive and likely to result in a class change. * **Perturbation Selection. ** The adversary then exploits the knowledge of sensitive information to select a perturbation \(\delta X\) in order to obtain an adversarial perturbation which is most efficient. Note that both two steps replace \(X\) by \(\delta X+X\) at the beginning of each new iteration until the disturbed sample is satisfied with the adversarial goal. The total perturbation used to generate an adversarial sample from an original sample needs to be as small as possible, which is the key to ensure that the adversarial sample is not recognized by human eyes. Suppose the norm \(\left\|\cdot\right\|\) is used to describe the differences between points in the DNN input field, the adversarial samples in model \(f\) can be formalized as a solution to the following optimization problem:  
\[X_{*}=X+\operatorname*{arg\,min}_{\delta X}\left\{\left\|\delta X\right\|:f \left(X+\delta X\right)\
eq f\left(X\right)\right\} \tag{3}\]  
It is difficult to find closed solutions since most DNN models make Formula (3) nonlinear and non-convex. Now, we discuss the methods used in the two steps above in detail. **Direction Sensitivity Estimation**  
Direction sensitivity estimation aims to find the dimensions of \(X\) that produce expected adversarial performance with minimal disturbance, which can be generally achieved by changing the input components of \(X\) and evaluating the sensitivity of the trained DNN model \(f\) to these changes. Some current techniques of direction sensitivity estimation are described below. * **L-BFGS. ** [PERSON] et al. [6] firstly introduced the term adversarial sample and formalized the minimization problem, as shown in Formula (3) to search for an adversarial sample. Since this problem is complex, they turned to solve a simplified problem, that is, to find the minimum loss function additions, so that the neural network could make a false classification, which transformed the problem into a convex optimization process. Although this method has good performance, it is expensive to calculate the adversarial samples. Figure 4: Adversarial crafting framework. This is an adversarial sample generative process for image classification using the Deep Neural Network (DNN), which can be generalized for any supervised learning algorithm (Image Credit: [PERSON] et al. [14]). * **Fast Gradient Sign Method (FGSM). ** [PERSON] et al. [15] proposed a Fast Gradient Sign method, which calculates the gradient of the cost function relative to the neural network input.