Adversarial Attacks on Vision Models
Tiny crafted pixel changes, invisible to people, flip a classifier to any target class the attacker chooses.
Why Does This Exist?
A stop sign with stickers nobody notices reads as a speed limit to the model. That is not a blurry camera or a hard example: it is an input optimized against the model itself. Evasion attacks study gradients or query responses and craft the smallest change that flips the prediction, often to an attacker-chosen class. The companion for the phenomenon is adversarial examples in vision, and the defense map is adversarial defenses under robustness and security.
Threat model first, always: attacker goal of targeted or untargeted flip, knowledge from full gradients down to label-only queries, and a budget such as 0.03 per pixel that keeps the change invisible. Without those three stated, attack numbers mean nothing.
Think of It Like This
Glasses that fool one bouncer only
Special glasses with a faint pattern let a person past one venue's face check while every human sees an ordinary face. The pattern is tuned to that bouncer's checklist, useless at the next door with different training. Perturbations are tuned to one model's boundaries the same way. The analogy stops at transfer: some crafted patterns pass several models, while the glasses rarely fool a second bouncer.
How It Actually Works
Residual only: the ladder and what each rung assumes. FGSM takes one gradient step to the budget edge and flips fast and cheaply. PGD iterates small steps with re-projection and finds far stronger flips at higher query cost. C and W optimizes the smallest change that flips, trading compute for subtlety. Patch attacks concentrate the budget into one visible sticker that works anywhere placed. Physical-world attacks survive printing, lighting, and camera angles to work outside the file.
The numbers that order them
On the demo classifier at budget 0.03: FGSM flips 87 of 100, PGD flips 96, C and W flips 94 with a mean change of 0.011 instead of the full budget. A 4 percent patch sticker flips 78 wherever placed. Defenses must therefore beat PGD, not FGSM, and every defense claim names the attack it survived plus its clean-accuracy and training-time price.
Watch Out For
Reporting FGSM robustness as robustness
FGSM is the weakest gradient attack, and models that resist it fall to PGD the same afternoon. The symptom is a defense badge that evaporates under iteration. Evaluate against PGD and C and W at stated budgets, and report clean accuracy beside every robust number.
The Quick Version
- Evasion crafts minimal changes to flip predictions, targeted or untargeted.
- Every claim states goal, knowledge, and budget, or it is not a claim.
- FGSM is one step, PGD iterates, C and W minimizes, patches localize, physical survives cameras.
- At budget 0.03 the ladder reads 87, 96, 94 flips with different costs.
- Defenses answer PGD-level attacks with clean accuracy priced in.