## 5 Attacks
### White-Box Attacks against Neural Networks
It is based on solving the following optimization problem:  
\[\min_{w}||\delta(w)||+cF(x+\delta(w)) \tag{15}\]  
where \(w\) is a new variable such that once \(\delta\) has been expressed in the form of a function of this new variable \(w\), perturbed sample \(x+\delta\) is always feasible, and \(F\) can be one of the following functions:\[F(x) =-J(x)+1 \tag{16}\] \[F(x) =(\max_{k\
eq\hat{y}}(f(x)_{k}-f(x)_{\hat{y}}))^{+}\] \[F(x) =\log(1+\exp\max_{k\
eq\hat{y}}(f(x)_{k}-f(x)_{\hat{y}}))-\log 2\] \[F(x) =(0.5-f(x)_{\hat{y}})^{+}\] \[F(x) =-\log(2f(x)_{\hat{y}}-2)\] \[F(x) =(\max_{k\
eq\hat{y}}(z(x)_{k}-z(x)_{\hat{y}}))^{+}\] \[F(x) =\log(1+\exp\max_{k\
eq\hat{y}}(z(x)_{k}-z(x)_{\hat{y}}))-\log 2\]  
where \(J\) is the loss function of the network \(f\) given the correct classification and \(z\) is the logit, i.e., the unnormalized raw probability prediction of the model for each class. Constant \(c\) can be found via binary search. Study [145] employs the approach similar to [144] by utilising the following loss function:  
\[F(x)=\max\{\max_{k\
eq\hat{y}}(z(x))_{k}-(z(x))_{\hat{y}},-K\}, \tag{17}\]  
where \(K\) is a hyperparameter which guarantees a constant gap between \(\max_{k\
eq\hat{y}}(z(x))_{k}\) and \((z(x))_{\hat{y}}\). The optimization problem is also modified by adding a regularisation parameter \(\beta\):  
\[\min_{\delta}g(x)+\beta|\delta|_{1}\] (18) subject to \[F(x) =-J(x)+1 \tag{16}\]0 is feasible,  
where \(g(x)=||\delta||^{2}+cF(x+\delta)\). To craft an adversarial perturbation an element-wise projected shrinkage thresholding function is defined as follows:  
\[(S_{\beta}(z))_{i}= \begin{cases}\min\{z_{i}-\beta,1\}\text{ if }z_{i}-x_{i}\\ x_{i}\text{ if }|z_{i}-x_{i}|\leq\beta\\ \max\{z_{i}+\beta,0\}\text{ if }z_{i}-x_{i}<-\beta\end{cases}  \tag{19}\]  
Study [146] applies a recurrent neural network (RNN) with a two-step training process to generate adversarial examples targeting a keyword spotting (KWS) system. In particular, the framework proposed utilises long-short term memory (LSTM) neural network [50]. It is assumed that an adversary has perfect knowledge of the training dataset and the target model. First, for each input sample \(x\) from the dataset, the adversary generates an adversarial example \(\tilde{x}\) using the BIM algorithm [138]. Each resulting perturbation \(\delta(x)=\tilde{x}-x\) is used to pre-train the LSTM model \(g_{\theta}\) with weights \(\theta\) by minimising the following loss function:  
\[L_{1}(\theta)=\sum_{x}||g_{\theta}(x)-\delta(x)|| \tag{20}\]  
Once the network has been pre-trained, it is directly optimised against the KWS network by minimising the following loss function:  
\[L_{2}(\theta)=\sum_{x}||g_{\theta}(x)||+ \tag{21}\] \[+c(\max_{k\
eq\hat{y}}z(x+g_{\theta}(x))_{k}-z(x+g_{\theta}(x))_{ \hat{y}}+R)^{+},\]  
where \(z\) is the logit score returned by the KWS, \(c>0\) is a regularisation parameter and \(R\geq 0\) is a constant which controls the confidence score of the target label \(\hat{y}\). In [147], an algorithm for crafting universal input-agnostic adversarial perturbations is proposed. The algorithm seeks a universal perturbation \(\delta\), such that \(||\delta||\leq\epsilon\), while fooling at least percentage \(\alpha\) of data points in \(X=\{x_{1},\ldots,x_{m}\}\), i.e.,:  
\[\frac{1}{m}\sum_{i=1}^{m}\mathbb{I}\{f(x_{i}+\delta)\
eq f(x_{i})\}\geq\alpha \tag{22}\]  
The algorithm proposed gradually builds the universal perturbation by iterating over the data points in \(X\). At each such iteration, the minimal perturbation \(\Delta\delta_{i}\) that sends the current perturbed point \(x_{i}+\delta\) to the classifier's decision boundary is computed and aggregated into a universal perturbation \(\delta\). If \(\delta\) does not fool data point \(x_{i}\), the algorithm seeks for an extra perturbation \(\Delta\delta_{i}\) with minimal norm that allows to fool data point \(x_{i}\) by solving the following optimization problem:  
\[