One gradient step, the whole budget, straight at the model's weakness. For a linear model the loss gradient in input space is proportional to the weights, so FGSM's step is x' = x + ε·sign(w) — and by Hölder's inequality that is the exact optimum of the ε-bounded attack: it raises the logit by precisely ε·‖w‖₁, and no other perturbation inside the ε box can do more. Down the center the clean input goes in, the one signed step is taken, the flipped decision comes out. The blue team builds and proves it; the red team tries to break it.
source Goodfellow, Shlens & Szegedy, Explaining and Harnessing Adversarial Examples (2014/2015) — arxiv.org/abs/1412.6572. Rendered, not quoted.
No training, no mystery: a fixed logistic model with hand-set weights, so every attack quantity has a closed form we can assert to 1e-9.
w = [2, −3, 1, −1] b = 0 clean input x = [1, 1, 0, 0], true label 0 (negative).
logit z = w·x + b = −1 → correctly classified (z < 0). ‖w‖₁ = 7, ‖w‖₂ = √15.
Two ground truths the witness re-derives live: the L∞ optimum shifts the logit by ε·‖w‖₁; the minimal L₂ attack has norm |z|/‖w‖₂ = 1/√15 ≈ 0.2582 and lands exactly on the boundary z = 0.
the-backprop computes ∂Loss/∂w to improve the model. FGSM computes ∂Loss/∂x and moves the input the other way — the same gradient turned against the thing it was trained to read.
It is the-adversarial-example made fast and analytic: no search, one signed step. That cheapness is why it is the attack every defense is first tested on — and why "robust to FGSM" is table stakes, not a finish line. Each sphere is the next one's premise.
The blue team's live check: recompute the current step's ‖δ‖∞ and logit gain and confirm them against the closed forms — ‖δ‖∞ = ε and gain = ε·‖w‖₁. If red swaps the signed step for the raw gradient, this badge is where it shows.
Two things enter the attack: the clean input x = [1, 1, 0, 0] sitting at logit −1 (safely on the negative side), and a perturbation budget ε — the largest change allowed in any single coordinate (the L∞ ball).
The attacker may add any δ with |δᵢ| ≤ ε to every coordinate at once. The question the panel answers: which δ inside that box moves the logit the most — and does it cross the boundary?
| i | wᵢ | sign(wᵢ) | δᵢ |
|---|
Every number is computed from w and ε on the spot — the logit shift is exactly ε·‖w‖₁, never looked up.
What the machine produces, proven: FGSM's δ = ε·sign(w) is the L∞-optimal attack — of all δ with ‖δ‖∞ ≤ ε, it maximizes w·δ, at exactly ε·‖w‖₁ (Hölder's inequality, tight). It stays inside the ε ball, and the smallest ε that flips this point is |z|/‖w‖₁ = 1/7 ≈ 0.1429. The minimal L₂ attack is a different vector of norm 1/√15.
The blue team's witness (left) re-derives these live; the red team (right) tries to make them wrong.
It needs the true gradient. Against models with masked or obfuscated gradients it underperforms while the model is not actually robust — a false sense of security. And an L∞ ball is a proxy for "imperceptible," not a definition of it. FGSM is not the attack; it is the cheapest true one, and the floor every defense must clear.
"FGSM finds the worst-case adversarial example." Cut. It finds the optimal single first-order L∞ step. For a non-linear model, iterating (PGD) inside the same ε box finds strictly stronger examples — computed against here.
"Adversarial examples come from too little data / overfitting." Cut. The paper argues the opposite: they arise because models are too linear in high dimensions — the linear view predicts and generates them.
"Just make the network bigger and it's robust." Kept, corrected. Capacity alone does not help; adversarial training (fitting on FGSM/PGD examples) buys real but still partial robustness.
The red team's move: swap the signed step ε·sign(w) for the raw gradient ε·w. It looks like "more gradient," but ‖ε·w‖∞ = ε·3 > ε — the budget is blown and the step is no longer L∞-optimal. The blue team's witness (window 7) is watching.
Replace sign(w) with w and the perturbation leaves the ε box — the witness recomputes ‖δ‖∞, sees it exceed ε, and turns red. Nothing is faked; the attack is real and it is caught.