3.1.1. Adversarial Example

Suppose x is a clean sample, y^true is the corresponding real label. For a trained DNN F₁, it can correctly classify samples x as labels y^true. By adding a small perturbation δ to the original sample, the adversarial examples x + δ can make the DNN F₁ misclassified. The generation of the small perturbation is generally obtained by maximizing the loss function J(x, y^true, θ), where θ represents the network structure parameters, and the loss function generally selects the cross entropy loss function.