targeted or untargeted

[ephi...@yahoo.com]

For FGSM, how would the resulting adversarial examples be different if I changed the attack from untargeted to targeted? I'm not sure I understand how a targeted attack works. Please advise. Thanks. AT

[Ian Goodfellow]

Suppose you have a photo of a cat.

An untargeted attack has the goal of changing the photo to no longer be labeled as a cat. The attack succeeds if it can change the output of the model to 'dog', 'car', etc.

A targeted attack has the goal of causing the model to output a specific target class. Suppose the target is 'car'. If the attack causes the photo of the cat to be labeled 'dog', it is not considered a success for the attacker. It is only a success if the output class becomes 'car'.

FGSM does only one gradient step, so it is usually not flexible / powerful enough to succeed as a targeted attack.

On Tue, Dec 18, 2018 at 11:47 AM 'ephi...@yahoo.com' via cleverhans dev <cleverh...@googlegroups.com> wrote:

For FGSM, how would the resulting adversarial examples be different if I changed the attack from untargeted to targeted? I'm not sure I understand how a targeted attack works. Please advise. Thanks. AT

--
You received this message because you are subscribed to the Google Groups "cleverhans dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cleverhans-de...@googlegroups.com.
To post to this group, send email to cleverh...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/cleverhans-dev/d0de7dfa-47aa-4fbc-9f8d-ac9158c34b8b%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[ephi...@yahoo.com]

Thank you for your rapid response and expert help. AT

On Tuesday, December 18, 2018 at 3:13:57 PM UTC-5, Ian Goodfellow wrote:

Suppose you have a photo of a cat.

An untargeted attack has the goal of changing the photo to no longer be labeled as a cat. The attack succeeds if it can change the output of the model to 'dog', 'car', etc.

A targeted attack has the goal of causing the model to output a specific target class. Suppose the target is 'car'. If the attack causes the photo of the cat to be labeled 'dog', it is not considered a success for the attacker. It is only a success if the output class becomes 'car'.

FGSM does only one gradient step, so it is usually not flexible / powerful enough to succeed as a targeted attack.

On Tue, Dec 18, 2018 at 11:47 AM 'ephi...@yahoo.com' via cleverhans dev <cleverhans-dev@googlegroups.com> wrote:

For FGSM, how would the resulting adversarial examples be different if I changed the attack from untargeted to targeted? I'm not sure I understand how a targeted attack works. Please advise. Thanks. AT

--
You received this message because you are subscribed to the Google Groups "cleverhans dev" group.

To unsubscribe from this group and stop receiving emails from it, send an email to cleverhans-dev+unsubscribe@googlegroups.com.
To post to this group, send email to cleverhans-dev@googlegroups.com.