What is an "adversarial attack" I'm reading this really interesting article CycleGAN, a Master of Steganography and I understand everything up until this paragraph:


  we may view the CycleGAN
  training procedure as continually mounting an adversarial attack on
  G
  , by optimizing a generator
  F
  to generate adversarial maps that force
  G
  to produce a desired image. Since we have demonstrated
  that it is possible to generate these adversarial maps using gradient descent, it is nearly certain that the
  training procedure is also causing
  F
  to generate these adversarial maps. As
  G
  is also being optimized,
  however,
  G
  may actually be seen as cooperating in this attack by learning to become increasingly
  susceptible to attacks. We observe that the magnitude of the difference
  y
  ∗
  −
  y
  0
  necessary to generate
  a convincing adversarial example by Equation 3 decreases as the CycleGAN model trains, indicating
  cooperation of
  G
  to support adversarial maps


How is the CycleGAN training procedure an adversarial attack? I don't really understand the quoted explanation.
"Adversarial examples are inputs to machine learning models that an attacker has intentionally designed to cause the model to make a mistake; they’re like optical illusions for machines.".


Source: "Attacking Machine Learning with Adversarial Examples"

You create an input and test against the output, tuning the input to maximize the error. There are different criteria for tuning the input, sometimes you might want the shortest possible input to create the largest error, often you would want very similar input to cause the greatest error.

Example: I take a \$1 bill and write a few more zeros after the one; you accept it as a \$1000 bill.