Turn local derivatives into feasible test candidates

Approximate the loss near the clean input by its first-order expansion. Under an infinity-norm constraint, each coordinate can move independently by at most epsilon. Choosing the sign of each gradient component maximizes the linearized increase, with any value in the allowed interval equally good for a zero component. Under a Euclidean constraint, the best nonzero-gradient direction is the normalized gradient. The two rules solve different constrained problems even when they share a numeric epsilon.

Untargeted testing typically increases a loss against the true label. A targeted attack instead tries to induce a specified target, often by decreasing the target-label loss or increasing a target margin. Record the sign convention explicitly; accidentally minimizing the true-label loss can make an attack appear ineffective because it improves the original classification. Use logits and numerically stable losses, and inspect whether gradients are finite and connected to the actual input tensor.

A classifier wrapper may resize, normalize, reorder channels, or aggregate outputs. The gradient should describe that same computation whenever exact differentiation is available. If normalization is performed outside the wrapper, explicitly transform both derivatives and perturbation constraints rather than mixing raw and normalized spaces. Keep model evaluation mode fixed so dropout or batch statistics do not accidentally change the defended classifier between clean and candidate evaluations.

Clip or project the generated candidate into the legal domain, then recompute the actual displacement from the original input. A step near a box boundary can have a smaller norm and a different linearized loss increase than the nominal sign vector. Save both proposed and realized perturbation summaries. A visually plausible sample is insufficient evidence of feasibility: check every relevant constraint numerically, including encoding round trips if the service accepts bytes rather than arbitrary real tensors.

The linearized objective can increase while the predicted class stays correct. A decision boundary depends on competing outputs, not just the numeric value of one surrogate loss. Conversely, a model can be misclassified with only a modest loss change. Check the declared success predicate on the final candidate and retain the actual outputs. Avoid reporting loss thresholds as attack success unless the application’s failure definition is itself a threshold on that exact score.

Run stronger iterative and diversified evaluations after the one-step sanity check. Large curvature, saturation, and piecewise operations can make the initial gradient a poor guide over the whole allowed ball. A one-step attack also has no mechanism for comparing multiple local directions after crossing a nonlinear region. When its results look unexpectedly strong or weak, inspect the wrapper and gradients before inventing an explanation about model robustness. The method is a useful probe, while the evidence remains limited to the feasible candidates actually tested.