# Attacking Robot Vision Models Efficiently Based on Improved Fast Gradient Sign Method
## 3 Our Technique
### Adversarial Attack Based on MNIST  
We first perform a white-box attack on the LeNet network using different methods, including the FGSM, BIM, MI-FGSM, NI-FGSM, and RMS-FGSM algorithms, to demonstrate the effectiveness of our method. Table 1 presents the results of experiment 1 on the MNIST dataset. In addition, we also calculate and plot the prediction accuracy of LeNet with the FGSM and RMS-FGSM methods under different epsilon values in Figure 2, which represents the proportion of test samples that predicted correctly over all test samples. As we can see from Table 1, as the EPS increases, the \(l_{2}\) of the adversarial examples with the FGSM also increases. The EPS is actually the perturbation factor of Equation (2) in the FGSM. At the same time, the \(l_{2}\) values in the BIM, MI-FGSM, and NI-FGSM methods are slowly increasing, while the \(l_{2}\) in the RMS-FGSM has been maintained at around 0.8. From the images, the perturbation of the adversarial examples in the FGSM can be easily recognized by humans, but the perturbations in the BIM, MI-FGSM, NI-FGSM, and RMS-FGSM methods are small. Furthermore, we also calculate the average attack success rate (Avg asr) and average perturbation value (Avg per) in these methods. The results show that the FGSM, BIM, MI-FGSM, and NI-FGSM methods obtain average attack success rates of 72.6%, 84.5%, 86.4%, and 89.6%, respectively, and the average attack success rate of the RMS-FGSM reaches 91.6%, which is the highest of these methods. The average perturbation value of the RMS-FGSM is 0.705, which is also the lowest among the methods. \begin{table}
\begin{tabular}{l c c c c c c c c c c c c c c c c c} \hline \hline
**LPS** & **Inppt** & **La** & \multicolumn{2}{c}{**ICSM**} & \multicolumn{2}{c}{**BM**} & \multicolumn{2}{c}{**M-FGSM**} & \multicolumn{2}{c}{**N-FGSM**} & \multicolumn{2}{c}{**RMS-ICSM**} \\ \cline{2-13}  & **Inppt** & **La** & **Av** & **Av** & \(\mathbf{l}_{b}\) & **Av** & \(\mathbf{M}\) & \(\mathbf{l}_{b}\) & **Av** & \(\mathbf{M}\) & \(\mathbf{l}_{b}\) & **Av** & \(\mathbf{M}\) & \(\mathbf{l}_{b}\) & **Av** & \(\mathbf{M}\) & \(\mathbf{l}_{b}\) \\ \hline
0 & **0** & **1** & **1** & **1** & 0 & **1** & 0 & **1** & 1 & 0 & **1** & 0 & **1** & 0 & **1** & 1 & 0 \\ \hline
0.05 & **0** & **2** & **2** & **2** & 1,374 & **0** & 5 & 0.876 & **0** & 7 & 0.884 & **0** & 4 & 0.816 & **0** & 8 & 0.745 \\ \hline
0.1 & **0** & **3** & **0** & **8** & 2,753 & **0** & 8 & 0.982 & **0** & 9 & 0.975 & **0** & 7 & 0.828 & **0** & 7 & 0.776 \\ \hline
0.15 & **0** & **4** & **0** & **9** & 4,081 & **0** & 9 & 1.078 & **0** & 9 & 0.978 & **0** & 6 & 0.854 & **0** & 5 & 0.972 \\ \hline
0.2 & **0** & **5** & **2** & 2 & 5,527 & **0** & 8 & 1,146 & **0** & 6 & 1.042 & **0** & 9 & 0.873 & **0** & 8 & 0.884 \\ \hline
0.25 & **0** & **6** & **0** & 0 & 6,678 & **0** & 0 & 1.177 & **0** & 4 & 1.078 & **0** & 8 & 0.883 & **0** & 9 & 0.881 \\ \hline
0.3 & **0** & **0** & 7 & **0** & 2 & 8,169 & **0** & 5 & 1,216 & **0** & 8 & 1.106 & **0** & 3 & 0.907 & **0** & 2 & 0.886 \\ \hline
0.35 & **0** & **0** & **0** & **0** & **0** & 6 & 1,223 & **0** & 5 & 1,149 & **0** & 9 & 0.915 & **0** & 6 & 0.813 \\ \hline
0.4 & **0** & **0** & **0** & 2 & 10,690 & **0** & 1 & 1,273 & **0** & 4 & 1.178 & **0** & 2 & 0.902 & **0** & 5 & 0.899 \\ \hline \hline \multicolumn{13}{c}{**Av.out**} & \multicolumn{2}{c}{**7.2/6.5**} & \multicolumn{2}{c}{**84.5/5**} & \multicolumn{2}{c}{**86.6/5**} & \multicolumn{2}{c}{**89.6/5**} & \multicolumn{2}{c}{99.6/5**} & \multicolumn{2}{c}{91.6/5**} \\ \hline \hline \multicolumn{13}{c}{**Av.in.per**} & \multicolumn{2}{c}{5.0/5} & \multicolumn{2}{c}{0.997} & \multicolumn{2}{c}{0.952} & \multicolumn{2}{c}{0.775} & \multicolumn{2}{c}{0.705} \\ \hline \multicolumn{13}{c}{\({}^{1}\)La. the true label of the original image; **Av.-** the generated adversarial example image; **Av.-** the prediction label given using the model.} \\ \end{tabular}
\end{table} 
Table 1: The experimental results of experiment 1 based on MNIST and LeNet \({}^{1}\).