Universal Adversarial Perturbation Explorer (2D)

Attack Budget

Perturbation budget ε 0.90

Accumulation speed 6/s

Class cluster spread 0.55

Click any point on the canvas to inspect its own individual FGSM gradient-sign attack (yellow arrow), independent of the shared vector v.

Live Readout

Fooling rate (v)

0.0%

‖v‖ / ε

0.00 / 0.90

Samples visited (dataset passes)

0 / 120 (pass 0)

Selected point — own FGSM attack

click a point

Legend

How it works

The classifier is a real logistic regression model trained by gradient descent on 2D features: p(x) = σ(w·x + b), predicted class ĉ(x) = 1 if p(x) ≥ 0.5 else 0. Training minimises average cross-entropy loss over 200 full-batch gradient-descent steps every time you regenerate the data — the decision boundary you see is genuinely fitted, not hand-placed.

Individual FGSM attack. For one point x with true label y, the loss gradient with respect to the input (not the weights) is

∂Loss/∂x = (p(x) − y) · w
x_adv = x + ε · sign(∂Loss/∂x)

Click a point to compute this exactly for that sample and see whether the resulting x_adv crosses the boundary at the current ε.

Universal perturbation. This models Moosavi-Dezfooli et al. (2017): a single shared vector v, built once, that misclassifies many inputs when added to any of them. The algorithm scans the (shuffled) dataset; for each point not yet fooled by v it computes the exact minimum-norm push that ties the decision score to zero,

r(x) = −[(w·(x+v) + b) / ‖w‖²] · w · 1.02

adds it to v, then projects v back onto the ε-ball: v ← v · min(1, ε / ‖v‖). Because there is only one linear boundary here, a single shared v can only push the boundary one way — it helps one class flip toward the other, never both directions at once, so the fooling rate genuinely plateaus well below 100% even at large ε. That ceiling is a real, measured consequence of the linear geometry, not a scripted cap.

points classified relative to x + v; click a point for its own FGSM attack