## 3 The Rise of Adversarial Machine Learning (AML)
### Understanding Adversarial Examples
#### 3.1.3 Adversarial Examples Crafting Methods
For each iteration, the following formula is used where \(Clip_{\mathcal{X},e}(*)\) denotes [\(X\)\(-\)\(e\), \(X+\epsilon\)] [28]:  
\[X_{0}^{adv}=X,X_{N+1}^{adv}=Clip_{\mathcal{X},e}\{X_{N}^{adv}+\alpha sign( \
abla_{\mathcal{X}}J(X_{N}^{adv},\mathcal{Y}_{true}))\} \tag{3}\]  
Moreover, IGSM has two distinct types of adversarial goals: (1) minimizing the confidence of the original prediction and its belongingness to the original class, or (2) maximizing the confidence of the prediction and its belongingness to the class with the lowest probability instead of the correct class [28; 35]. * **Iterative Least-Likely Class Method (ILCM). ** This method has been proposed by [PERSON] et al. [37] for crafting adversarial examples by perturbing the target class and replacing it with the least-likely probability class for the dataset disturbance. It leads to a degradation in the classifier performance with significant errors such as misclassifying a dog as a car. The ILCM differs from FGSM and L-BFGS by identifying the exact wrong class for the adversarial examples. Moreover, it is suitable to be used when handling datasets with a considerable number of distinct classes such as ImageNet. In such a scenario, perturbations can be added according to the following formula [28]: \[X_{0}^{adv}=X,X_{N+1}^{adv}=Clip_{\mathcal{X},e}\{X_{N}^{adv}+\alpha sign( \
abla_{\mathcal{X}}J(X_{N}^{adv},\mathcal{Y}_{LL}))\}\] (4) where the least-likely probability class is represented by \(\mathcal{Y}_{LL}\). There is another option where the least-likely class is replaced with a random class as the target class which is thereby called an iteration random class method [28; 35]. * **Jacobian Based Saliency Map (JSMA). ** This method has been proposed by [PERSON] et al. [38] for crafting adversarial examples using the model's Jacobian matrix. It works by using the gradients of relative output and input components to construct a saliency map and build the gradients based on the impact of each pixel. The L0 distance norm is utilized where a limited number of the image pixels are modified, and they represent the most important pixels based on the saliency map. Therefore, gradients are significantly important in perturbing the pixel and making the prediction of the image towards the target classes. It can be performed as follows [28]: 1. Firstly: Calculate the forward derivative \(\
abla F(X)\) according to the following formula: \[\
abla F(X)=\frac{\partial F(x)}{\partial X}=\left[\frac{\partial F_{j}(x)}{ \partial X_{i}}\right]_{i\in 1\ldots Mj\in 1\ldots N}\] (5) 2. Secondly: Construct the saliency map S based on the calculated forward derivative. 3. Thirdly: Select the pixel with the highest importance using the saliency map in an iterative manner until either classifying the output as the target class or maximum perturbation is achieved. It is worth noting that JSMA is used for targeting misclassification attacks with several strengths such as a high success rate, and a high transfer rate, however, it is its main disadvantage related to its high computational cost [28; 35]. Perturbation Selection. In this step, the knowledge of sensitivity is used by the adversary to select the most suitable perturbation for exploiting the model. This includes two methods as below:  
Perturb all the input dimensions. Some researchers investigated the manipulation of all input dimensions where direct sensitivity estimation methods are used. In the [26] experiment, FGSM is utilized to evaluate the gradient sign direction for each input dimension and thereby minimizes the Euclidean distance between the original inputs and the related adversarial samples. However, applying such a method can be detected easily since the number of perturbations is large. Perturb the selected input dimension. Some researchers investigated the perturbation of a selected number of input dimensions with the use of the saliency map [38]. This method contributes to limiting the number of perturbations effectively but at the price of higher computation cost.