Foundations — Adversarial examples and robustness

This page is a standalone glossary-from-zero for its parent note, Adversarial examples and robustness. That parent note shows how to craft those tiny nudges (the FGSM and PGD attacks), why neural networks fall for them, and how adversarial training defends against them — but it assumes you already read symbols like $\mathbf{x}$, $\mathbf{\delta }$, ${\nabla }_{\mathbf{x}}\mathcal{L}$ and $\Vert \cdot {\Vert }_{\infty }$ fluently. Here we build every one of those symbols one at a time, from absolutely nothing. Each entry gives you three things: plain words → the picture → why the topic needs it.

1. The input $\mathbf{x}$ — a picture is a list of numbers

The very first symbol is $\mathbf{x}$ (bold x).

The picture. Imagine a tiny grey-scale image that is only 2 pixels wide and 2 pixels tall. Each pixel is a brightness number between 0 (black) and 1 (white). Four pixels means four numbers. We can lay them in a row:

$\mathbf{x}=(x_1,x_2,x_3,x_4)$

Each $x_i$ (small x with a label $i$) is one pixel. The label $i$ just says "which pixel" — pixel number 1, 2, 3, or 4.

Why the topic needs it. The whole attack is "change the picture a little". You cannot say "a little" until the picture is numbers you can add to. Turning an image into a list of numbers is what lets us do arithmetic on it.

2. The label $y$ and the model $f$ — the fence-drawer

The picture. Think of a giant sheet of paper. Every possible picture is a dot somewhere on that sheet. The model $f$ has drawn a curvy line (a decision boundary) across the sheet — the place where the top two probabilities are tied. Dots on one side get called "cat"; dots on the other side get called "dog".

Why the topic needs it. An attack succeeds exactly when the discrete label flips: $f(\mathbf{x})\ne f({\mathbf{x}}^{\prime })$. To even state that, you need a name for the model ($f$) and a name for the answer ($y$). The whole game is: how close is a "cat" dot to the nearest fence? See figure s02 — the red dot is one tiny hop from the boundary.

The building of $f$ itself is a separate story — see Neural network training.

3. The perturbation $\mathbf{\delta }$ and the nudged input ${\mathbf{x}}^{\prime }$

We add it pixel-by-pixel to get the adversarial input ${\mathbf{x}}^{\prime }$ (read "x-prime", meaning "a modified x"):

${\mathbf{x}}^{\prime }=\mathbf{x}+\mathbf{\delta }⟺x_i^{\prime }=x_i+{\delta }_i\text{ for every pixel }i$

The picture. On the sheet of paper from figure s02, $\mathbf{\delta }$ is a little arrow starting at the original dot $\mathbf{x}$ and ending at the new dot ${\mathbf{x}}^{\prime }$. Its length is how big the change is; its direction is which way we shoved the picture.

Why the topic needs it. The attacker's only freedom is choosing $\mathbf{\delta }$ — the direction and size of the arrow. Everything after this ("FGSM", "PGD") is just clever ways to pick the arrow.

4. Measuring "small": norms $\Vert \cdot {\Vert }_p$ and the budget $ϵ$

We keep saying the nudge is "small". A number-machine needs an exact rule for how small. That rule is a norm.

The parent note bounds perturbations with three different size-measures:

Let me unpack each symbol:

• ${\max }_i$ means "look across all pixels $i$ and keep the largest".
• $|{\delta }_i|$ is absolute value — the size ignoring sign, so $|-0.03|=0.03$. A pixel darkened by 0.03 is just as "changed" as one brightened by 0.03.
• ${\sum }_i$ (capital Greek sigma) means "add up over all pixels".
• $\#\{\dots \}$ means "count how many things fit the description".

Why $L_{\infty }$ (the "max" one) dominates. A pixel value lives in $[0,1]$. If we promise $\Vert \mathbf{\delta }{\Vert }_{\infty }\le ϵ$ with $ϵ=8/255\approx 0.031$, then no single pixel moves by more than about 3% of its full range. That is below what a human eye notices — yet thousands of such tiny moves add up to fool the model (proved in Section 8). The $L_{\infty }$ norm is the direct promise "each pixel barely moves".

5. The loss $\mathcal{L}$ — how wrong the model is

The three things inside the parentheses are the loss's ingredients:

• $\theta$ (Greek "theta") — the parameters: all the internal dials of the model, fixed during an attack.
• $\mathbf{x}$ — the input (we can change this).
• $y$ — the true label.

The picture. Picture a landscape of hills and valleys drawn above the input space. The height at each point is the loss. The model is happy (low loss) in the valleys and unhappy (high loss) on the peaks. A "cat" picture sits in a valley.

Why the topic needs it. The attacker's goal, stated in one line, is: increase the loss. Push the picture uphill until it tumbles over a fence into the wrong-answer region. To climb, you need to know which way is up — that is the next symbol.

6. The gradient ${\nabla }_{\mathbf{x}}\mathcal{L}$ — the compass pointing uphill

This is the single most important symbol in the whole topic. Take it slowly.

The little subscript $\mathbf{x}$ means "differentiate with respect to the input", not the parameters. Each component is a partial derivative:

${\nabla }_{\mathbf{x}}\mathcal{L}=\left(\frac{\partial \mathcal{L}}{\partial x_1},\frac{\partial \mathcal{L}}{\partial x_2},\dots ,\frac{\partial \mathcal{L}}{\partial x_d}\right)$

What is $\frac{\partial \mathcal{L}}{\partial x_i}$? Read it "the slope of the loss as you slide pixel $i$". If it is $+5$, brightening pixel $i$ a hair raises loss (good for the attacker). If it is $-5$, brightening it lowers loss, so the attacker should darken it instead. The sign tells you which way to push; the size tells you how much it matters. This slope exists only because the loss is built on the continuous probabilities of Section 2, not the discrete label.

Why this tool and not another? We want the direction that increases loss fastest. Out of all possible directions, the gradient is by definition the steepest-uphill one — that is the whole point of a gradient. No other single object answers "which way is up?" so directly. (The same gradient, used downhill to make the model better, is the engine of Gradient descent optimization and Neural network training. The attack simply runs it uphill.)

The picture. Back on the loss landscape (figure s04), stand at the "cat" valley and imagine which way the ground rises most steeply. That arrow, laid flat onto the input axes, is ${\nabla }_{\mathbf{x}}\mathcal{L}$.

7. The sign function — keeping only direction

The parent note's headline attack uses $\text{sign}({\nabla }_{\mathbf{x}}\mathcal{L})$.

Applied to the whole gradient, $\text{sign}({\nabla }_{\mathbf{x}}\mathcal{L})$ turns each pixel's slope into just $+1$, $0$, or $-1$: "push this pixel up", "leave it", or "push it down".

Why the topic needs it. Under the $L_{\infty }$ budget, every pixel is allowed to move by the same maximum $ϵ$. So the smartest move is to push every pixel the full $ϵ$ in whatever direction helps — up if its slope is positive, down if negative. That is exactly $ϵ\cdot \text{sign}({\nabla }_{\mathbf{x}}\mathcal{L})$. The sign function is how the budget shape ($L_{\infty }$, a cube) turns "steepest uphill" into "shove every pixel to its corner".

8. The dot product ${\mathbf{\delta }}^T{\nabla }_{\mathbf{x}}\mathcal{L}$ — how much a nudge helps

What it means in words. It answers: "if I take the nudge $\mathbf{\delta }$, how much does the loss change (to first approximation)?" Each pixel contributes its own move ${\delta }_i$ times how much that pixel matters $\frac{\partial \mathcal{L}}{\partial x_i}$. Add them all up.

Why the topic needs it — and the high-dimensional punchline. Suppose the attacker aligns $\mathbf{\delta }$ perfectly with the sign of the gradient, giving each of $d$ pixels a change of size $ϵ$. Then every term in the sum is a positive $ϵ\cdot |\text{slope}|$. With $d=150,528$ tiny helpful pushes, the sum can grow enormous even though each pixel barely moved. This is the parent note's core "why are neural networks vulnerable" argument, and now every symbol in it is yours.

How the foundations feed the topic

The map below is read top to bottom: an arrow "A → B" means "you need A before B makes sense." Walk it in words to see the whole page as one chain. We start at the top with the raw input as numbers; that lets us do two things at once — let the model $f$ draw fences, and add a perturbation $\mathbf{\delta }$ to the picture. The perturbation needs a size rule, so it feeds into norms and the budget $ϵ$. Meanwhile the model's fences give us a loss (how wrong we are), whose steepest-uphill direction is the gradient; stripping the gradient down to pure direction gives sign. The budget and the sign together power the FGSM/PGD attacks, while the gradient fed through the dot product explains why high dimensions hurt. Both streams meet at the topic's goal: adversarial robustness.

Equipment checklist

Cover the right side and see if you can produce it.