# A Holistic Review of Machine Learning Adversarial Attacks in IoT Networks
## 4 Adversarial Attack Generation Methods for IoT Networks
### Causative Attack Methods
#### 4.2.3 Generative Adversarial Networks  
Generative Adversarial Networks (GANs) are a category of ML frameworks that have been used to generate adversarial attacks. Initially proposed by [PERSON] et al. [64], GAN is composed of two deep networks: the generator (G) and the discriminator (D), that compete with one another within the context of a zero-sum game. Designed as a Conventional Neural Network (CNN) with two subnetworks, the generator's goal is to generate synthetic data instances that closely resemble those in the training set by initializing its inputs with random noise. On the other hand, the discriminator's goal is to distinguish between synthetic samples produced by [PERSON] and the original training dataset. A backward propagation is used to enhance the accuracy of G. G receives feedback from D through its loss and tries to minimize this loss while producing adversarial samples. The process concludes when D is unable to differentiate between samples from the training set and those produced by G.  
Formally, \(G\) is trained to optimize for the probability of \(D\) committing wrong classification, and the value function \(V(G,D)\) is defined by [PERSON] et al. in [14], by following Expression (18):  
\[\underset{G}{min}\underset{D}{max}V(D,G)=\mathbb{E}_{x\sim p_{data}(x)}logD(x) +\mathbb{E}_{z\sim p_{z}(z)}log(1-D(G(z))) \tag{18}\]  
where \(p_{g}(x)\) is the generator's distribution over data \(x\), \(p_{z}(z)\) is a prior on input noise variables. \(D(x)\) corresponds to the probability that \(x\) comes from the original dataset rather than from the generated distribution \(p_{g}\). \(G(z,\,\theta_{g})\) is a differentiable representation embodied by a multilayer perceptron parameterized by \(\theta_{g}\). The objective is to train \(D\) to maximize the probability of correctly labeling the training samples, while simultaneously training \(G\) to minimize it.  
Since its introduction in 2014 by [PERSON] et al. [64], GAN has spawned numerous variants and extensions. These variants address various challenges and limitations associated with the original GAN formulation. For instance, [PERSON] et al. [65] proposed Deep Convolutional GANs (DCGANs) to produce high-quality images compared to fully connected networks, and [PERSON] et al. [66] introduced a Conditional GAN (C-GAN) framework that can produce images conditioned on class labels. [PERSON] et al. [67] proposed Wasserstein GAN (WGAN) with a new loss function leveraging on the Wasserstein distance to better estimate the difference between the real and synthetic sample distributions. Since 2014, more than 500 papers presenting different variants of GANs have been published in the literature and can be all found in [68].  
Although GAN methods excel at generating realistic samples different from once used in training this can help to evaluate the ML systems against adversarial attacks as well as help in data augmentation in scenarios where the available training dataset is limited. However, training GANs are typically characterized by high computational demands and can exhibit considerable instability.