<p>I got the answers from <em>Cleverhans</em> developers on <a href="https://github.com/tensorflow/cleverhans/issues/589" rel="nofollow noreferrer">github</a>, I quote their answer here:</p>

<p><strong>Chapter 1:</strong></p>

<p>FGSM (like any attack) is not guaranteed to find an adversarial image that is misclassified by the model because it makes approximations when solving the optimization problem that defines an adversarial example. </p>

<p>The attack can fail to find adversarial images for various reasons, one common reason is gradient masking. You can read about it in this <a href="http://www.cleverhans.io/security/privacy/ml/2017/02/15/why-attacking-machine-learning-is-easier-than-defending-it.html" rel="nofollow noreferrer">blog pos</a>t and in this <a href="https://arxiv.org/abs/1602.02697" rel="nofollow noreferrer">paper</a> as well as this <a href="https://arxiv.org/abs/1802.00420" rel="nofollow noreferrer">paper</a>.</p>

<p>The <em>eps</em> step is important because it is the magnitude of the perturbation. The attack first computes the direction in which to perturb the image (using gradients of the model) and then takes a step of size <em>eps</em> in that direction. Hence, <em>eps</em> corresponds roughly to what intuitively one would think of the "power" of the attack.</p>

<p>You can find a multi-step variant of FGSM in <code>BasicIterativeMethod</code></p>

<p><strong>Chapter 2:</strong> </p>

<p><em>y</em> is used to specify labels in the case of an untargeted attack (any wrong class is considered as success for the adversary) whereas <em>y_target</em> is used to specify a target class in the targeted attack case (the adversary is successful only if the model makes a particular misclassification in a chosen class). </p>

<p>It is often the case that targeted attacks require more perturbation (i.e., higher <em>eps</em> values in the FGSM case) than untargeted attacks.</p>
Doubts with cleverhans FastGradientMethod (FGM), adversarial image generation
<p>I have a keras model (CNN with final softmax) that is an RGB image classifier. Output of the model are 5 possible categories for input images (one-hot encoded).
I'm trying to generate adversarial images for my keras model with the <em>Cleverhans</em> (<a href="https://github.com/tensorflow/cleverhans" rel="nofollow noreferrer">tensorflow library</a>).</p>

<p>A simplified version of my code which generates one adversarial image is the following:</p>

<pre><code># model is the CNN keras model
wrap = KerasModelWrapper(model)
fgsm = FastGradientMethod(wrap, sess=session)
fgsm_params = {'eps': 16. / 256,
               'clip_min': 0.,
               'clip_max': 1.
               }
x = tf.placeholder(tf.float32, shape=(None, img_rows, img_cols,
                                      nchannels))
adv_x = fgsm.generate(x, **fgsm_params)
# original image is a tensor containing only one RGB image, shape=(1,48,48,3) 
adv_image = adv_x.eval(session=session, feed_dict={x: original_image})
</code></pre>

<p><strong>Chapter 1, eps</strong></p>

<p>From my understanding, <em>'eps'</em> FGM param is the input variation step (minimum change for one image value/pixel).</p>

<p>I have observed that the final outcome is highly affected by <em>eps</em>, sometimes I need high <em>eps</em> in order to obtain an effective adversarial image, an image which effectively changes the category label in respect to the original image. </p>

<p>With low <em>eps</em> sometimes FGM fails to obtain a working adversarial image i.e., having an image O, with label l<sub>O</sub> FGM fails to produce adversarial image O' with l<sub>O'</sub>!= l<sub>O</sub>, e.g., for l<sub>O</sub> = [0,0,1,0,0] we still obtain l<sub>O'</sub> = [0,0,1,0,0], failing to generate an adversarial image with a different label.</p>

<p>Questions (I'm sorry the problem requires a set of questions):</p>

<ul>
<li>Does FGM always find out a working adversarial image? i.e., Is it normal that FGM fails?</li>
<li>Is there a way to obtain an estimated quality of the generated adversarial image (without predicting with model)?</li>
<li>Why is the value of eps step so important?</li>
<li>Most important: <strong>Is there a way to tell FGM to try harder searching for the adversarial image(e.g, more steps)?</strong></li>
</ul>

<p><strong>Chapter 2, y,y_target</strong></p>

<p>I have also experimented <em>y</em> and <em>y_target</em> params. 
Can you also explain me what are the params <code>'y'</code>, <code>'y_target'</code>? </p>

<p>I thought <code>'y_target'</code> tells that we want to generate an adversarial image that targets a specific category. 
For example I thought that <code>y_target = [[0,1,0,0,0]]</code> in <code>feed_dict</code> should force to generate an adversarial image which is classified with the 2th class from the model.</p>

<ul>
<li>Am I right? ..or </li>
<li>do I miss something?</li>
</ul>

<p>P.s: my problem is that setting y_target fails to produce adversarial images.</p>

<p>please give me few tips.. ;-)
Regards</p>