Paper breakdown

Adversarial Examples (FGSM)

The 2014 paper by Goodfellow et al. that exposed a terrifying flaw in neural networks: adding invisible, mathematically calculated noise to an image causes the model to confidently misclassify it.

Paper: Explaining and Harnessing Adversarial Examples

Authors: Ian J. Goodfellow, Jonathon Shlens, Christian Szegedy · 2014

Read the paper

By calculating the gradient of the loss function with respect to the input pixels, FGSM adds a tiny layer of noise that completely flips the network's prediction.

The Problem

As deep neural networks achieved superhuman performance on image classification, researchers discovered a strange vulnerability. They were brittle. In a prior paper, Szegedy et al. showed that you could slightly alter an image in a way imperceptible to the human eye, and cause a state-of-the-art classifier to fail completely. The prevailing theory was that neural networks were highly non-linear and complex, creating strange "pockets" of errors in their multidimensional space.

The Idea

Ian Goodfellow (creator of GANs) proved the opposite: adversarial examples exist not because networks are too complex, but because they are too linear. Neural networks rely on massive dot products (weights multiplied by inputs). If you add a tiny amount of noise to the input, that noise is multiplied by the weights. Across thousands of dimensions, these tiny changes accumulate, drastically shifting the final output. He introduced the Fast Gradient Sign Method (FGSM) to quickly calculate the exact noise needed to fool any model.

How It Works

FGSM calculates adversarial noise in a single step:

Take an image (e.g., a Panda) and pass it through the network.
Calculate the gradient of the loss function, but instead of updating the weights (like during training), take the gradient with respect to the input pixels.
This gradient tells you exactly which direction to change each pixel to maximize the model's error.
Take the sign of that gradient (+1 or -1), multiply it by a tiny epsilon value ( $\epsilon$ ), and add it to the original image.

The resulting image looks exactly like a Panda to humans, but the network will classify it as a Gibbon with 99% confidence.

Why It Mattered

This paper birthed the field of Adversarial Machine Learning. It proved that deploying AI in high-stakes environments (like self-driving cars or security cameras) was incredibly dangerous, as bad actors could print adversarial stickers to make a stop sign look like a speed limit sign to an AI.

What Came After

An arms race ensued. Researchers developed "Adversarial Training" (training the model on the adversarial examples to make it robust). However, attackers continually invented stronger attacks (like PGD or Carlini-Wagner). The fundamental vulnerability of continuous neural networks to adversarial attacks remains an unsolved problem in AI safety today.