Evasion Attacks Intermediate

Evasion attacks craft adversarial inputs at inference time to cause misclassification. This lesson covers the most important evasion attacks in detail: FGSM, PGD, C&W, and DeepFool. For each attack, you will learn the mathematical formulation, implementation in Python, and practical considerations for effective use.

Fast Gradient Sign Method (FGSM)

FGSM (Goodfellow et al., 2014) is the simplest and fastest white-box attack. It computes a single-step perturbation by taking the sign of the gradient of the loss with respect to the input:

x_adv = x + epsilon * sign(gradient_x(J(theta, x, y)))

Where epsilon controls the perturbation magnitude, J is the loss function, theta represents the model parameters, and y is the true label.

import torch
import torch.nn.functional as F

def fgsm_attack(model, images, labels, epsilon):
    """Generate adversarial examples using FGSM."""
    images.requires_grad = True

    # Forward pass
    outputs = model(images)
    loss = F.cross_entropy(outputs, labels)

    # Backward pass to get gradients
    model.zero_grad()
    loss.backward()

    # Create perturbation
    perturbation = epsilon * images.grad.data.sign()

    # Generate adversarial image
    adv_images = images + perturbation
    adv_images = torch.clamp(adv_images, 0, 1)  # Keep in valid range

    return adv_images

Projected Gradient Descent (PGD)

PGD (Madry et al., 2017) is the iterative version of FGSM. It takes multiple smaller steps and projects back onto the epsilon-ball after each step, making it significantly more powerful:

def pgd_attack(model, images, labels, epsilon, alpha, num_steps):
    """Generate adversarial examples using PGD."""
    adv_images = images.clone().detach()

    # Random start within epsilon ball
    adv_images = adv_images + torch.empty_like(adv_images).uniform_(
        -epsilon, epsilon
    )
    adv_images = torch.clamp(adv_images, 0, 1)

    for _ in range(num_steps):
        adv_images.requires_grad = True
        outputs = model(adv_images)
        loss = F.cross_entropy(outputs, labels)

        model.zero_grad()
        loss.backward()

        # Take step in gradient direction
        adv_images = adv_images.detach() + alpha * adv_images.grad.sign()

        # Project back onto epsilon ball
        delta = torch.clamp(adv_images - images, -epsilon, epsilon)
        adv_images = torch.clamp(images + delta, 0, 1).detach()

    return adv_images

Carlini & Wagner (C&W) Attack

The C&W attack (2017) formulates adversarial example generation as an optimization problem that minimizes the perturbation size while ensuring misclassification. It is one of the strongest attacks and has broken many proposed defenses:

• Optimizes in a transformed space to ensure valid pixel values
• Uses a carefully designed objective function with a confidence parameter
• Supports L0, L2, and L-infinity perturbation norms
• More computationally expensive than FGSM or PGD but finds smaller perturbations

Black-Box Attacks

When gradient access is unavailable, alternative strategies include:

Attack Comparison