Adversarial Example

Change an image by an amount no person can see, and a classifier that was right becomes confidently wrong. The perturbation is not noise and not a corner case — it can be computed for almost any input in a fraction of a second, and it often transfers to models trained separately on different data.

The transferability is the part that matters operationally: an attacker who cannot see your weights can attack a substitute model and expect a usable fraction of the attacks to carry over. The uncomfortable explanation is that these perturbations follow features that are genuinely predictive and genuinely imperceptible — the model is not hallucinating, it is using signal a person cannot see and would not have chosen.

Find δ minimising ‖δ‖ subject to f(x + δ) ≠ f(x), usually relaxed to maximising the loss inside a ball ‖δ‖ sub _p  ≤ ε. Linearity is enough to explain it: with a gradient g, a step of ε·sign(g) moves the logit by ε·‖g‖ sub ₁ , which grows with input dimension — so high-dimensional inputs are attackable at a per-pixel budget that stays invisible.