1. For the Fast Gradient Sign Method (FGSM), experiment with different step sizes (0.05, 0.1, 0.15, 0.2, 0.25, 0.3, 0.35, 0.4) and observe the generated adversarial images and the models accuracy. Identify the step size with the best trade-off, i.e., the one that generates the least visible perturbations while achieving the lowest accuracy, and briefly explain the reason behind this choice. 2. For the Projected Gradient Descent (PGD) attack, change the number of iterations to 5, 10, 20, or 40, the step size to 0.002, 0.004, or 0.008, and the epsilon (eps) to 0.1, 0.2, or 0.4. Determine the combination of parameters that provides the best trade-off, i.e., the one that generates the least visible perturbations while achieving the lowest accuracy, and briefly explain the reason behind this choice. 3. Using the best parameter combination found in step 2, construct a black-box PGD attack and compare its performance to the FGSM attack. Submit a report with screenshots of the generated adversarial images, along with their respective parameters and the models accuracy for each attack. Link to Google Colaboratory: https://colab.research.google.com/drive/13PKVnauQUHbXJfWVQ_tULb93mefFBnd2#scrollTo=dEDCHrQcjlQ5&line=1&uniqifier=1
