# Review of Artificial Intelligence Adversarial Attack and Defense Technologies
## 3 Adversarial Attacks
### Testing Stage Adversarial Attacks
#### 3.2.1 White-Box Attacks
Adversarial samples are produced by the following formula: \[X^{{}^{\prime}}=X+\epsilon*sign\left(\
abla_{X}I\left(X,y_{true}\right)\right)\] (4) Here, \(J\) is the cost function of model \(f\), \(\
abla_{x}\) indicates the gradient of the model with respect to a normal sample \(X\) with correct label \(y_{true}\), \(\epsilon\) denotes the hyper-parameter which controls the amplitude of the disturbance. Although this is an approximate solution based on linear hypothesis, it also enables the target model to achieve 89.4% misclassification on the MNIST dataset. * **One-Step Target Class Method**[16]. This method, a variant of FGSM, maximizes the probability \(\text{P}(y_{target}|X)\) of some specific target class \(y_{target}\), which is unlikely to be a true class for a given sample. For a model with cross-entropy loss, the adversarial samples could be made following Formula (5) in the one-step target class method: \[X^{{}^{\prime}}=X-\epsilon*sign\left(\
abla_{X}J\left(X,y_{target}\right)\right)\] (5)
* **Basic Iterative Method (BIM)**[16]. This is a straightforward extension of FGSM to apply FGSM multiple times with small step size: \[X^{{}^{\prime}}_{0}=X,\ X^{{}^{\prime}}_{n+1}=Clip_{X,\epsilon}\left\{X^{{}^{ \prime}}_{n}+\alpha*sign\left(\
abla_{X}J\left(X^{{}^{\prime}}_{n},y_{true} \right)\right)\right\}\] (6) Here, the \(\alpha\) denotes step length, and \(Clip_{X,\epsilon}\left\{A\right\}\) is the element-wise clipping of \(X\). This method generally does not rely on the approximation of the model and produces additional harmful adversarial samples when this algorithm runs for more iterations. The articles [61; 26] have conducted research on this basis and produced good results. * **Iterative Least-Likely Class Method (ILCM)**[16]. By using the class with the smallest recognition probability (target class) to replace the class variable in the disturbance, and get adversarial examples which are misclassified in more than 99% of the cases: \[X^{{}^{\prime}}_{0}=X,\ X^{{}^{\prime}}_{n+1}=Clip_{X,\epsilon}\left\{X^{{}^{ \prime}}_{n}-\alpha*sign\left(\
abla_{X}J\left(X^{{}^{\prime}}_{n},y_{true} \right)\right)\right\}\] (7)
* **Jacobian Based Saliency Map (JSMA). ** [PERSON] et al. [17] proposed a method to find the sensitivity direction by using the Jacobian matrix of the model. This method directly provides the gradient of the output component relative to each input component, and the obtained knowledge is used in the complex saliency map method to produce the adversarial samples. This method limits the \(l_{0}\) norm of the perturbations, which means only a few pixels of the image need to be modified. This method is especially useful for source/target misclassification attacks. * **One Pixel Attack. ** [PERSON] et al. [18] proposed an extreme attack method, which can be achieved by changing an only one-pixel value in the image. They used the differential evolution algorithm to iteratively modify each pixel to generate a sub-image and compared it with the parent image to retain the sub-image with the best attack effect according to the selection criteria to realize the adversarial attacks. * **DeepFool. ** [PERSON] et al. [19] proposed to compute a minimal norm adversarial perturbation for a given image in an iterative manner, in order to find the decision boundary closest to the normal sample \(X\) and find the minimal adversarial samples across the boundary. They solved the problem of choosing the parameter \(\epsilon\) under FGSM [15] and carried out the attack against the general nonlinear decision functions by using multiple linear approximations. They demonstrated that the perturbations they generate are smaller than FGSM and have a similar deception rate. * **HOUDINI. ** [PERSON] et al. [20] proposed a method called HOUDINI, which deceives gradient-based machine learning algorithms. It realized the adversarial attack by generating adversarial sample specific to the task loss function, i.e., using the gradient information of the differentiable loss function of the network to generate disturbance.