The terrain is a 2D "feature space" cross-entropy loss landscape for a 3-class classifier (Panda / Gibbon / Sloth). Height and color show each region's predicted class and confidence; the red marker is the input point being attacked, starting inside the Panda region.
FGSM (one step): x' = x + ε · sign(∇ₓ J(θ, x, y))
PGD (iterative): x_(t+1) = Clip_(x₀,ε){ x_t + α · sign(∇ₓ J(θ, x_t, y)) }, α ≈ 2.5ε / steps
Targeted variant: x' = x − ε · sign(∇ₓ J(θ, x, y_target)) (descend loss toward the target class)
- FGSM vs PGD — FGSM takes one full ε-sized jump along the gradient sign; PGD takes several smaller α-sized steps, re-projecting onto the ε-ball (an L∞ square here) each time — it explores the loss surface and finds a stronger perturbation for the same budget.
- Untargeted vs Targeted — untargeted attacks just maximize the loss on the true label (any wrong class counts); targeted attacks minimize the loss on a chosen wrong label, steering the point toward one specific decision region.
- Adversarially trained model — trained on perturbed examples, so its loss surface is smoother near class boundaries (larger sigma below); the same ε that flips the standard model often isn't enough to cross the wider margin.
- ε (epsilon) — the attacker's perturbation budget, enforced as an L∞ box around the clean input; real-world attacks keep this small so the change stays imperceptible to a human.
Both formulas require only sign(∇ₓJ) — the direction of steepest loss increase — which is exactly why adversarial examples transfer between models: many networks share similar gradient directions near the same input (Goodfellow et al., 2014; Madry et al., 2018).