## 2 Background Research
### Adversarial Attacks  
Adversarial attacks are attacks performed on machine learning algorithms to cause models to make mistakes during tasks such as classification. The attacks are usually performed by adding a small perturbation or noise to input examples, making them adversarial examples. [PERSON] et al. (2014) [2] coined the term \"Adversarial Examples\" and proposed one of the first adversarial attacks; subsequently, various studies have tried to unveil the root cause of this phenomenon. The most conclusive research in explaining adversarial examples was carried out by [PERSON] et al. (2015) [1]. The authors attributed the ability of adversarial examples to fool models to neural networks not learning the \"true underlying concepts that determine the correct output label\". In other words, the networks do not understand the actual training data sample, instead drawing a false mathematical perception to identify the class of the sample as long as there is no artificial noise that can affect that system. The authors compare this phenomenon to a \"Potemkinvillage\", i.e., a false construct that does not accurately represent reality. According to their research, the linear nature of neural networks is what allows for a small amount of noise (adversarial perturbation) to affect the output of the model. In other words, while machine learning models draw a mathematical relation between their received inputs and the outputs from the training data, the representation they create does not represent what human beings perceive. Given a clean Labrador picture (Figure 1a) and one that has been adversarially perturbed (Figure 1b,c), we as human beings see and perceive all three pictures as a Labrador-breed dog. However, a state-of-the-art machine learning model specializing in classifying dog breeds mistakenly classifies the adversarial images (Figure 1b,c) as Saluki and Weimaraner dog breeds, dogs that have significantly different appearances compared to the original image. These results show that our current machine learning models are not able to understand the world as humans do. Both [PERSON] et al. (2014) [2] and [PERSON] et al. (2015) [1] proposed adversarial attacks based on the gradient of a given model, respectively, Limited-Memory BFGS (L-BFGS) and the Fast Gradient Sign Method (FGSM). After L-BFGS and FGSM, various types of attacks have used different algorithms to generate adversarial perturbation. Examples include, among many others, Jacobian-based Saliency Map Attack (JSMA) by [PERSON] et al. (2015) [22], Carlini and Wagner Attack (C&W) by [PERSON] et al. (2017) [33], Basic Iterative Method by [PERSON] et al. (2017) [21], and Projected Gradient Descent (PGD) by [PERSON] et al. (2018) [9]. The methods listed above are classified as gradient-based methods, in which perturbations are generated by utilizing the gradient such that the generated noise is large enough to change the resulting label of the model while at the same time being small enough to make no noticeable changes to the data sample. For familiarity, the section below briefly summarizes the adversarial attacks used in this paper:  
* Fast Gradient Sign Method (FGSM) [1]: FGSM is an adversarial attack generation algorithm that is performed by calculating the gradient with respect to each image pixel and adjusting it to maximize the loss value. * Projected Gradient Descent (PGD) [9]: This attack is an update of FGS; while FGSM takes only one step to calculate the generated noise, PGD improves the attack efficacy through a multi-step process. * Simultaneous Perturbation Stochastic Approximation (SPSA) [34;35]: SPSA uses random approximations with finite difference estimates in cases where an analytic gradient can be used. * Momentum Iterative Method (MIM) [36]: this attack uses momentum-based algorithms to \"boost\" adversarial attacks, i.e., improve the generated adversarial examples by adding momentum to the process and avoiding local maxima that are not sufficient during each iteration.