PGD attacks

Lens adapted to this topic: How PGD works and why it is widely used

The mainstream machine-learning account treats PGD as a principled first-order attack for approximately solving the inner maximization in robust optimization. It is valuable because it searches within an explicit threat model, can be randomized and iterated, and supports both adversarial evaluation and training. Its conclusions are conditional on the selected norm, radius, loss, constraints, and attack budget rather than being universal measures of model safety.

• PGD approximates the inner maximization problem in robust optimization by repeatedly taking gradient-based steps and enforcing the threat-model constraints.
• The attack can use random initialization, a step size, an iteration count, a norm, and optional input clipping; these parameters define the tested threat model.
• PGD and related first-order methods are used to identify vulnerabilities and to train models with improved resistance to broad classes of attacks.
• PGD can generate realistic-looking adversarial inputs that fool image classifiers, and related optimization approaches apply to other modalities such as speech.

Lens adapted to this topic: Where standard PGD may overstate robustness

A serious dissenting technical perspective argues that “PGD robustness” is not a single settled quantity. Standard implementations can be weakened by an unsuitable objective, an inaccurate projection, insufficient iterations, or failure to enforce the exact intersection of the threat region and valid input domain. Studies therefore propose alternating objectives, adaptive or exact projections, constrained optimization, and specialized variants, sometimes finding materially stronger attacks against models that appeared robust under earlier procedures.

• There is no universally superior PGD objective; poorly chosen objectives can lead to robustness overestimation, while alternating objectives improved attack performance in reported experiments.
• For sparse ℓ1 attacks, ignoring the intersection between the norm ball and the valid image domain can make established PGD attacks suboptimal and overestimate robustness.
• Constrained Gradient Descent argues that directly encoding both successful targeting and the distance constraint can outperform projection-based or clipped approaches in reported CIFAR-10 and ImageNet experiments.
• Specialized projected-gradient methods can evade adversarial-example detectors when the attack must satisfy both misclassification and non-detection objectives.
• For LLMs, PGD over a continuous relaxation of prompts is presented as a substantially faster alternative to discrete optimization while achieving comparable reported attack results.