Adversarial Examples

Adversarial Examples are inputs crafted with imperceptible perturbations that reliably fool machine learning models into confident incorrect predictions — revealing that neural networks classify based on brittle, high-frequency statistical patterns rather than human-meaningful semantic features, posing fundamental security and safety challenges for AI deployed in adversarial environments.

What Are Adversarial Examples?

• Definition: An adversarial example x_adv = x + δ where the perturbation δ is small (imperceptible to humans, bounded by δ _p ≤ ε) yet causes the model to predict the wrong class with high confidence: f(x) = "panda" but f(x_adv) = "gibbon" with 99.9% confidence.
• Discovery: Szegedy et al. (2014) first described adversarial examples; Goodfellow et al. (2015) introduced FGSM and the linearity hypothesis explaining why they exist.
• The Panda-Gibbon Example: Goodfellow et al. showed that adding humanly imperceptible noise ( δ ∞ = 0.007, equivalent to 1-2 pixel values) to a panda image caused GoogLeNet to classify it as a gibbon with 99.3% confidence — the image looks identical to humans.
• Transferability: Adversarial examples crafted against one model often fool other models trained on the same data — including models with different architectures — enabling black-box attacks.

Why Adversarial Examples Matter

• Autonomous Vehicles: Researchers demonstrated that adding carefully designed stickers to stop signs causes them to be classified as "Speed Limit 45" — a physical-world adversarial attack with catastrophic potential.
• Medical AI: Adversarial perturbations added to chest X-rays cause diagnosis models to miss pneumonia or classify benign findings as malignant — imperceptible to radiologists but systematically manipulating AI systems.
• Biometric Authentication: Eyeglasses with printed adversarial patterns fool face recognition systems, enabling impersonation attacks without requiring physical access to enrolled images.
• Malware Detection: Adversarial perturbations to malware binaries fool neural network classifiers into labeling them as benign — while preserving malware functionality.
• Fundamental Security Concern: Any ML system deployed in an environment where adversaries can influence inputs faces adversarial example risks — the threat model applies to virtually all real-world deployments.

Attack Types

White-Box Attacks (full model access):

FGSM (Fast Gradient Sign Method):
δ = ε × sign(∇_x L(f(x), y))
Single gradient step in direction that maximizes loss. Fast but weak.

PGD (Projected Gradient Descent — Madry et al.):
x_t+1 = Π_{ε-ball}(x_t + α × sign(∇_x L(f(x_t), y)))
Iterative FGSM with projection back to ε-ball. Stronger and considered gold standard attack.

C&W Attack (Carlini & Wagner):
Minimizes perturbation magnitude while finding misclassification.
Formulates as optimization: min δ _2 s.t. f(x+δ) ≠ y.
Most powerful white-box attack; designed to break defensive distillation.

Black-Box Attacks (only query access):

Transfer attacks: Craft adversarial examples on surrogate model; transfer to target.
Query-based: Estimate gradients through model queries (SPSA, Square Attack).
Score-based vs. Decision-based: Whether attack has access to confidence scores or only top-1 class.

Targeted vs. Untargeted:
- Untargeted: Force any misclassification.
- Targeted: Force specific misclassification (dog → cat).

Why Neural Networks Are Vulnerable

The Linearity Hypothesis (Goodfellow et al.): High-dimensional linear functions (which deep networks approximate locally) are inherently sensitive to adversarial perturbations. A small change ε in each of D dimensions accumulates to εD total effect — large for high-dimensional inputs.

Feature Statistics vs. Semantics: Neural networks classify based on statistical patterns (texture, frequency content) that humans ignore — models trained with ERM learn the most predictive features, not the most robust ones.

Ilyas et al. (2019): Adversarial features are actually predictive of class labels — they are not bugs in the model but features of the data distribution that are non-robust but genuinely informative.

Common Perturbation Norms

Adversarial examples are the security vulnerability that reveals neural networks as sophisticated pattern-matchers rather than genuine understanders — their existence forces AI researchers to confront the gap between human perception and model decision-making, driving an ongoing arms race between attack methods and defenses that remains one of the most active areas in trustworthy machine learning.