FGSM (Fast Gradient Sign Method) is the simplest and fastest adversarial attack — a single-step attack that perturbs the input in the direction of the sign of the loss gradient: $x_{adv} = x + epsilon cdot ext{sign}(\nabla_x L(f_ heta(x), y))$.

FGSM Details

• One Step: Only requires a single forward and backward pass — extremely fast.
• $L_infty$: FGSM naturally produces $L_infty$-bounded perturbations (each feature changes by exactly $pmepsilon$).
• Untargeted: Maximizes the loss for the true class — pushes away from the correct prediction.
• Targeted: $x_{adv} = x - epsilon cdot ext{sign}(\nabla_x L(f_ heta(x), y_{target}))$ — minimizes loss for the target class.

Why It Matters

• Foundational: Introduced by Goodfellow et al. (2015) — the paper that launched adversarial ML research.
• Fast AT: FGSM enables fast adversarial training (single-step AT instead of multi-step PGD).
• Baseline: Every adversarial defense must at minimum resist FGSM — it's the weakest meaningful attack.

FGSM is the one-shot adversarial attack — the simplest, fastest method that moves the input in the worst-case gradient direction.