# Mathematical Analysis of Adversarial Attacks

arXiv: https://arxiv.org/abs/1811.06492 · HTML: https://mlsanity.com/paper/1811.06492/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Nov 2018.

## Built on by (most cited first, 3 of 3)

- [Sound and Complete Verification of Polynomial Networks](https://mlsanity.com/paper/2209.07235/) (2022)
- [Topological safeguard for evasion attack interpreting the neural networks' behavior](https://mlsanity.com/paper/2402.07480/) (2024)
- [Understanding Deep Learning defenses Against Adversarial Examples Through Visualizations for Dynamic Risk Assessment](https://mlsanity.com/paper/2402.07496/) (2024)

## Abstract (arXiv)

In this paper, we analyze efficacy of the fast gradient sign method (FGSM) and the Carlini-Wagner's L2 (CW-L2) attack. We prove that, within a certain regime, the untargeted FGSM can fool any convolutional neural nets (CNNs) with ReLU activation; the targeted FGSM can mislead any CNNs with ReLU activation to classify any given image into any prescribed class. For a special two-layer neural network: a linear layer followed by the softmax output activation, we show that the CW-L2 attack increases the ratio of the classification probability between the target and ground truth classes. Moreover, we provide numerical results to verify all our theoretical results.