## 5 Attacks
### White-Box Attacks against Neural Networks
In particular, it focuses on solving the following optimization problem:  
\[\min_{\delta}||\phi_{k}(x+\delta)-\phi_{k}(\hat{x})||\] (12) subject to \[||\delta||<\epsilon,\]  
where \(\hat{x}\) is the target sample, \(\phi_{k}\) is the mapping from \(x\) to its internal representation at the \(k\)-th layer and \(\epsilon\) is as previously the maximum perturbation size. This problem can also be solved with the help of the L-BFGS algorithm for each \(k\) with the loss function \(J\) being equal to \(||\phi_{k}(x+\delta)-\phi_{k}(\tilde{x})||\). In [142], an algorithm to compute adversarial examples based on an iterative linearization of the classifier is proposed. The algorithm generates minimal perturbations that are sufficient to change classification labels. Specifically, at each iteration, classifier \(f\) is linearized around the current point \(x_{i}\) and the minimal perturbation of the linearized classifier is computed as  
\[ \begin{split}&\arg\min_{\delta_{i}}||\delta_{i}||\\ &\text{subject to }f(x_{i})+\
abla f(x_{i})\delta_{i}=0\end{split}  \tag{13}\]  
Once the perturbation \(\delta_{i}\) at iteration i of the algorithm has been computed, \(x_{i+1}\) is updated as \(x_{i}+\delta_{i}\). The algorithm stops when \(x_{i+1}\) changes the label \(f(x)\) returned by the classifier for sample \(x\). A non-targeted attack which attempts to perform gradient descent to decrease the probability \(f(x)_{y}\) of the original class \(y=f(x)\) is proposed in [143]. Assuming that the number of classes is \(K\), the descent step size \(\alpha\) is determined as follows. When \(f(\tilde{x})_{y}\) is larger than \(1/K\), which is the case if \(f(\tilde{x})=y\), then \(\alpha=f(\tilde{x})_{y}-1/K\). Once \(f(\tilde{x})_{y}\) approaches or falls below \(1/K\), \(\alpha=\eta||x||||\
abla f(x)_{y}||\), where the hyperparameter \(\eta\) defines the level of aggressiveness with which the gradient descent tries to minimise the probability of class \(y\). Study [20] crafts adversarial samples via Jacobian-based saliency map attack (JSMA) algorithm. The approach proposed constructs an adversarial saliency map by evaluating forward derivatives of the network. The purpose of this map is to identify the set of input features which the adversary has to perturb in order to achieve its goal. If the adversary wants to perturb a sample \(x\) in such way that it is assigned to a target class \(\hat{y}\
eq y\), the probability of the target class \(\hat{y}\) returned by \(f\), i.e., \(f(x)_{\hat{y}}\), should be increased. At the same time, the probabilities \(f(x)_{k}\) of all other classes \(k\
eq\hat{y}\) must be decreased. The misclassification goal is achieved when \(\hat{y}=\arg\max_{k}f(x)_{k}\). This can be accomplished by the adversary via increasing features of an input sample \(x\) using the following saliency map \(S(x,\hat{y})\):  
\[S(x,\hat{y})= \begin{cases}0\text{ if }\frac{\hat{y}(x)_{\hat{y}}}{\alpha_{i}}<0 \text{ or }\sum_{k\
eq\hat{y}}\frac{\hat{y}(x)_{k}}{\alpha_{i}}>0\\ \frac{\hat{y}(x)_{\hat{y}}}{\alpha_{i}}\left|\sum_{k\
eq\hat{y}}\frac{\hat{y}( x)_{k}}{\alpha_{i}}\right|\text{ otherwise,}\end{cases}  \tag{14}\]  
where \(i\) is the input feature. Alternatively, the adversary may try to decrease some of the input features to achieve the misclassification required. In [144], a set of white-box attacks against neural networks is proposed. The Carlini and Wagner (C&W) attack approach is similar to [19].