# Exploring Synergy of Denoising and Distillation: Novel Method for Efficient Adversarial Defense
## 2 Related Works
### Adversarial Attack
#### 2.1.1 Exploring Adversarial Attack  
Adversarial attacks pose a significant challenge to the security of AI models by exploiting algorithmic vulnerabilities to inversely manipulate model decisions [17]. An essential aspect of assessing the robustness of a machine learning model involves evaluating its defensive capability against adversarial attacks, which is typically measured by a decrease in the accuracy rate. Adversarial attacks aim to cause misclassifications by creating malicious data that disrupt the decision boundary of a trained model, as illustrated in Figure 1. This disruption is achieved by generating an optimal output that confuses the model within the norm constraints. From a security perspective, adversarial attacks can compromise the confidentiality and integrity of an AI model by effectively violating two of its three foundational security elements. Initial research on adversarial attacks primarily focused on identifying the vulnerabilities of deep-learning models. [PERSON] et al. [23] first proposed that even minor changes in the input can significantly affect a model's predictions. [PERSON] et al. [20] introduced the concept of an adversarial example in 2015. These examples refer to the malicious datasets created by combining benign data with perturbations that an attacker can obtain by understanding the gradient of the target model. These adversarial examples are then used as inputs for the target model, resulting in inaccurate predictions. [PERSON] et al. [20] proposed an effective attack method known as the fast gradient sign method (FGSM), which has since become a baseline attack method in adversarial attack-related research. Building on the FGSM, [PERSON] et al. [24] introduced an iterative FGSM by adding perturbations over multiple stages.  
Among the adversarial attacks that improved upon the FGSM, projected gradient descent (PGD) was suggested by [PERSON] et al. [25]. The PGD calculates the gradient over multiple stages and generates adversarial examples within the allowable range of changes. Through multiple stages, it progressively refines adversarial examples, thereby enabling powerful attacks. [PERSON] et al. [26] proposed a C&W attack capable of creating potent adversarial examples by adjusting the input data to minimize the loss function. Furthermore, real-world applications of adversarial attacks have been investigated. For instance, [PERSON] et al. [27] proposed a method for attacking human face recognition systems, and [PERSON] et al. [28] suggested a method for applying adversarial examples to three-dimensional objects for real-world recognition. Notably, [PERSON] et al. [28] used 3D printing techniques to transform adversarial examples into physical objects, demonstrating the potential for severe attacks under various real-world conditions, including different angles and illuminations. Consequently, adversarial attacks represent a significant threat to practical applications of AI. Furthermore, ongoing research has applied lethal adversarial attacks to black-box environments, which were previously critical only in white-box settings. Therefore, threats to AI commercialization are escalating [29, 30, 31].  
Among these, we employed FGSM, which is the most widely used and fundamental approach in adversarial attacks, to validate our defense model. Therefore, we aim to provide an in-depth analysis of FGSM attack techniques.