In this paper, we analyze the efficacy of the fast gradient sign method (FGSM) and the CarliniWagner's L2 (CW-L2) attack. We prove that, within a specific regime, the untargeted FGSM can fool any convolutional neural nets (CNN) with ReLU activation; the targeted FGSM can mislead any CNN with ReLU activation to classify any given image into any prescribed class. For a particular two-layer neural nets, a linear layer followed by the softmax output activation, we show that the CW-L2 attack increases the ratio of the classification probability between the target and the ground truth classes. Moreover, we provide numerical results to verify our theoretical results.
Closer to our work, REF proves that in a specific two-layer neural network -a linear layer followed by a softmax output-the ratio of the classification probability can be increased using the fast gradient sign method and Carlini-Wagners L 2 attack.
Mathematical Analysis of Adversarial Attacks
ArXiv
ArXiv
Mathematics Computer Science