FGSM Attack on Image Classifiers
Take one step in the direction each pixel's gradient suggests, scaled to the full budget, and the prediction flips.
Why Does This Exist?
Adversarial attacks need a cheapest fast baseline before any strong claim. The Fast Gradient Sign Method is that baseline: one forward-backward pass, one update, no search. Its threat model is white-box gradients with a per-pixel budget, here 0.03, untargeted. Defenses that fail even this are broken; defenses that pass only this are untested, since PGD follows.
Think of It Like This
Leaning on every loose railing at once
A crowd tester checks a balcony by pushing every railing simultaneously in its loosest direction with one fixed shove. Weak rails give way together even though no single push was clever. FGSM pushes every pixel one fixed step along its gradient sign the same way. The analogy stops at coordination: railings fail independently, while pixels combine through the network into one flipped decision.
How It Actually Works
Compute the loss gradient with respect to the input pixels, take its sign per pixel, multiply by the budget, and add it to the image with clipping to valid range. Every pixel moves the full budget in its most damaging direction in a single step. Targeted variants step toward a chosen class loss instead of away from the true one.
Worked FGSM step with recomputed numbers
Toy pixel with value 0.500 and input gradient minus 0.42. The sign is minus 1, times budget 0.03 gives minus 0.03, so the pixel becomes 0.470 after clipping. Across a demo photo at budget 0.03 the mean absolute change is exactly 0.03 on every pixel, the maximum change is 0.03, and 87 of 100 images flip. Raise the budget to 0.06 and flips rise to 93 while the noise becomes faintly visible, pricing visibility against strength.
Condition and trade
FGSM assumes the local gradient points across the boundary within one budget step. On hardened or highly nonlinear models the single step undershoots and iteration wins, which is why FGSM success bounds PGD success from below rather than replacing it.
Watch Out For
Grading FGSM on already-broken preprocessing
Resizing or compression that destroys gradients makes FGSM fail while the model stays vulnerable, a symptom called masked gradients. The fix that reveals it is one PGD run: if PGD flips what FGSM could not, the defense was gradient surgery, not robustness. Report both, per the defense page adversarial defenses.
The Quick Version
- One signed gradient step of size 0.03 on every pixel, then clip.
- Flips 87 of 100 demo images in a single pass.
- Cheapest baseline available: one forward-backward pass total.
- Iteration beats it wherever the boundary lies past one step.
- Defenses must survive PGD, with FGSM as the floor, not the badge.