# Attacking Robot Vision Models Efficiently Based on Improved Fast Gradient Sign Method
## 3 Our Technique
### Fast Gradient Sign Method Based on Adaptive Learning Rate  
The fast gradient sign method (FGSM) is able to generate adversarial examples efficiently based on the gradient ascend approach. However, as shown in Equation (2), a fixed learning rate \(\varepsilon\) is used to compute the perturbation, which may lead to slow conver  
Figure 1: The overall framework of our method. gence or even failure to converge. Additionally, a fixed learning rate may fail to adapt to different samples, which may result in insufficient updates for some samples to reach optimal solutions. Above all, the missing of the optimal solution may introduce a large perturbation to adversarial examples and decrease the attack success rate. Although some improved variant methods such as I_FGSM and MI_FGSM have been proposed, they also employ a fixed step size \(\alpha\) as shown in Equations (3) and (5). In order to further improve the performance of the gradient-based adversarial attack methods, we propose the RMS-FGSM, which utilizes the adaptive learning rate calculation method RMSProp. Let \(f(x;W,b)=y\) be a neural network model, such as the Alexnet for image classification tasks. \(W\) and \(b\) are the weight matrix and offset vector, respectively. When feeding with an image sample \(x\), the model will output prediction result \(y\). In the training process of neural networks, we always construct a loss function of the network \(L(f(x;W,b),y)\) and reduce the training of neural networks to an optimization problem as follows:  
\[\underset{W,b}{\operatorname{argmin}}(L(f(x;W,b),y)) \tag{6}\]  
In order to resolve the optimization problem, a frequently used approach is the gradient descent, which calculates the optimal \(W\) and \(b\) along the direction of the gradients \(\
abla_{W}L(f(x;W,b),y)\) and \(\
abla_{b}L(f(x;W,b),y)\), respectively. During this process, a labeled training dataset \(D=\{(x,y)\mid x\)_is an input image sample, \(y\) is the corresponding classification label_} will be used. Different from the above training process, the white-box adversarial attack methods assume that the neural network model \(f(x;W,b)\) is pre-trained. Therefore, the weight matrix \(W\) and offset vector \(b\) are both available. The purpose of the adversarial attack is to generate difference-inducing input samples. Formally, given an image sample \(x\) with a label \(y\), an adversarial attack aims to generate an adversarial example \(x^{*}\) by adding an imperceptible perturbation to \(x\), such that \(f(x;W,b)\
eq y\). This problem can be addressed by maximizing the loss between label \(y\) and the prediction \(f(x;W,b)\). Formally, we have the following optimization problem (we neglect \(W\) and \(b\) because they are available):  
\[\underset{x}{\operatorname{argmax}}(L(f(x),y)) \tag{7}\]  
In this study, we address the problem with the gradient ascent algorithm. Different from the FGSM and its variants, the RMS-FGSM calculates the adversarial examples based on an adaptive learning rate given by RMSProp. RMSProp is a variant of the gradient descent algorithm used to adjust model parameters. The most distinctive feature of RMSProp is that it can adaptively adjust the learning rate of different parameters by combining the first-order and second-order moments. By utilizing the smooth nature of the square root function, it can avoid the problems of drastic changes and unstable behavior in the parameter space. The RMS-FGSM computes adversarial examples in an iterative manner as follows:  
\[g_{t}=\
abla_{x}L(f(x_{t}^{*}),y) \tag{8}\]  
\[r_{t}=\rho\cdot r_{t-1}+(1-\rho)g_{t}^{2} \tag{9}\]  
\[\tau=\frac{\phi}{\sqrt{r_{t}+\sigma}} \tag{10}\]  
\[x_{t+1}^{*}=clip\{x_{t}^{*}+\tau\cdot sign(g_{t})\} \tag{11}\]  
where \(g_{t}\) is the gradient of loss function \(L(f(x_{t}^{*}),y)\) w.r.t \(x\) at the \(t\)-th iteration. \(x_{t}^{*}\) denotes the adversarial example achieved at the t-th iteration. Specifically, \(x_{0}^{*}=x,f(x)=y\).