Points of two classes sit near a learned decision boundary (the dashed line). An attack nudges each point toward the boundary and across it by a bounded amount ε, in the direction that most increases the model's loss — a small, calculated push rather than random noise. The right pane plots robust accuracy against ε analytically so you can see the whole attack-strength curve at once, with a marker at the current setting.
FGSM (1 step): x' = x + eps * sign(grad_x Loss(x))
PGD (N steps): x_{k+1} = clip_eps(x_k + alpha * sign(grad_x Loss(x_k)))
Adversarial training: retrain on (x', y) pairs -> widens the margin, shrinks the attackable region
- Perturbation budget ε — the maximum allowed nudge per point; larger ε flips more points across the boundary.
- Attack steps — 1 step approximates FGSM, more steps approximates iterative PGD, a stronger attack for the same ε.
- Defense — adversarial training moves the boundary's effective margin outward, so the same ε flips fewer points.
This is why safety-critical vision/NLP models are attack-tested before deployment: a visually imperceptible pixel change (small ε) can silently flip a classifier's decision unless the model was specifically hardened against it.