Rethinking PGD Attack: Is Sign Function Necessary?

This work rigorously analyzes how the perturbation update method affects the adversarial quality and further empirically shows why raw gradient is not favored in the current PGD algorithm. Moreover, we propose a new raw gradient-based algorithm that outperforms vanilla PGD across various scenarios without introducing any extra computational cost.

In this study, our first objective is to theoretically characterize the effect of update mechanisms on adversarial samples at each step. We observe that a stronger attack in the previous step, or a larger perturbation change, leads to a greater attack improvement in the subsequent step. Furthermore, our empirical observations reveal that in the later update steps, vanilla PGD, which employs the sign function, exhibits a larger change in perturbation compared to raw gradient-based PGD. Such a larger change facilitates more pixels approaching the $\epsilon$ boundary, indicating a stronger attack update based on the theoretical results. This explains the preference for using the signed gradient in PGD.

Next, we point out that the failure of the raw gradient in PGD is not only due to the insufficient update on its own, but also attributed to the clipping design. In PGD, all perturbations are clipped within the $\epsilon$ ball per step. This design results in the loss of significant magnitude information for the raw gradient update, particularly when most pixels approach the $\epsilon$ boundary. Instead, we introduce a new hidden variable of non-clipped perturbation for updating. In this way, the $L_{\infty}$ norm-based adversarial attack, a constrained optimization problem, is transformed into an unconstrained optimization problem, where the proposed hidden variable is allowed to surpass the $\epsilon$ boundary. Extensive experiments further demonstrate that our proposed method significantly improves the performance of raw update-based PGD and even outperforms vanilla PGD, without incurring additional computational overhead.

In this part, we characterize the influence of the update procedure on the adversarial gain $g(x+\delta_{c}^{t+1})-g(x+\delta_{c}^{t})$ at each step $t$. Inspired by existing works (Du et al., 2019; Arora et al., 2019), we consider a model function with one ReLU (Nair and Hinton, 2010) hidden layer, defined as follows:

where $h(x)=\max(0,x)$ denotes the element-wisely ReLU function, $x\in\mathbb{R}^{n\times 1}$ denotes the input, $w_{1}\in\mathbb{R}^{m\times 1}$ and $w_{2}\in\mathbb{R}^{m\times n}$ denote output weight and first-layer vector weight respectively. Assuming the Mean Square Error (MSE) loss, the loss function $g(x+\delta_{c})$ is defined as follows:

where $y^{\ast}(x)$ denotes the real label value for input $x$.

The theorem demonstrates that the adversarial gain in step $t$ depends on two factors: (i) The magnitude of perturbation change, $\delta_{c}^{t+1}-\delta_{c}^{t}$. If the update algorithm results in a large perturbation change, the adversarial gain will be increased. (ii) The previous adversarial loss $g(x+\delta_{c}^{t})$, and the updated loss $g(x+\delta_{c}^{t+1})$. It is important to note that the adversarial loss is non-negative, and we expect the updated $g(x+\delta_{c}^{t+1})$ to be greater than the previous $g(x+\delta_{c}^{t})$. Therefore, the step gain $g(x+\delta_{c}^{t+1})-g(x+\delta_{c}^{t})$ is highly influenced by the previous loss $g(x+\delta_{c}^{t})$. As a result, a larger previous adversarial loss $g(x+\delta_{c}^{t})$ implies a better step gain. In summary, if our update algorithm induces a significant perturbation change $\delta_{c}^{t+1}-\delta_{c}^{t}$ and starts with a substantial initial adversarial loss $g(x+\delta_{c}^{t})$, it will lead to a larger adversarial gain $g(x+\delta_{c}^{t+1})-g(x+\delta_{c}^{t})$.

We next conduct a further study to analyze how the update process shapes adversarial samples in practice. Specifically, we target the robust PGD model ¹¹1The robust model used can be found at https://github.com/ndb796/Pytorch-Adversarial-Training-CIFAR with CIFAR10 $\epsilon=8/255$ $L_{\infty}$ setting. on the CIFAR10 testing dataset within the $\epsilon=8/255$ ball. The perturbation distribution at each step for three update algorithms (PGD, PGD with raw update, proposed RGD) is illustrated in Figure 1. The results reveal that, within the limited 7 steps, the majority of pixels (86.9%) converge to the boundary in the PGD update, whereas its corresponding raw update shows a lower boundary ratio (59.1%) with a considerable number of pixels remaining stuck at the zero initial point. More detailed information regarding the boundary ratio and robust accuracy can be found in Table 1. It reveals that PGD achieves a lower robust accuracy ($43.19\%$) compared to its raw update version ($44.54\%$). Considering the theoretical results presented in Theorem 1, which indicate that larger perturbation changes lead to better performance gains, we can conclude that the success of PGD, in contrast to PGD with naive raw update, can be attributed to its "sign" ability, which facilitates more pixel changes and convergence to the boundary.

Furthermore, it is worth noting that RGD outperforms PGD in terms of attack performance, despite having fewer boundary pixels (70.6% v.s. 86.9%). This can be attributed to the fact that the real adversarial distribution in RGD exhibits better attack performance, as indicated by the higher values of $g(x+\delta_{c}^{t})$, resulting in larger adversarial gains at each step, as demonstrated in Table 1. Consequently, RGD is able to learn a better adversarial distribution even without a significant perturbation change. It is important to highlight that PGD (raw), despite its use of raw updates, does not effectively preserve most of the magnitude information due to the clip operation. As a result, it performs significantly worse than RGD.

To ensure a fair comparison, we carefully fine-tuned the step size $\alpha$ for all three algorithms, using grid search. Following the principle of minimal robust accuracy, we set a zero initial point for both PGD (raw) and RGD, while utilizing a random initial point for PGD. Note that the choice of initial point does not influence the final boundary ratio while detailed initial comparison is available in Appendix B.

We compare PGD with sign/raw updates and proposed RGD using a 7-step attack. The datasets include CIFAR-10, CIFAR-100, and ImageNet, and we attack their respective testing or validation sets. The models attacked are sourced from RobustBench (Croce et al., 2021). The adversarial attack settings follows the approach of Ding et al. (2019), and the results are presented in Table 2.

Our results demonstrate that introduced non-clipped perturbation significantly improves the raw update method, resulting in a substantial performance boost from PGD (raw) to RGD. Furthermore, RGD outperforms PGD across various datasets, model architectures, and adversarial sizes, highlighting the superiority of RGD. It is worth noting that RGD is particularly advantageous in scenarios with larger $\epsilon$ values (e.g., $\epsilon=16/255$). This is likely because larger adversarial size allows RGD to exhibit a more effective adversarial distribution. Conversely, if a smaller $\epsilon$-ball is used, most RGD perturbation pixels will be clipped into the $\epsilon$ boundary in the final step.

For adversarial training, we conduct experiments with different architectures and steps on CIFAR10 to compare PGD and RGD. We specifically train models including ResNet, WideResNet, and a Convolutional Neural Network, using both 5-step and 10-step attack strategies. Each model comprises 6 blocks. The robustness of these models is assessed using a 10-step Projected Gradient Descent (PGD) attack, with all experiments conducted within an $\epsilon=8/255$ constraint. Both clean and robust accuracy results are presented in Table 3.

From the table, it can be observed that RGD significantly improves all robust accuracy across different architectures and steps. Specifically, for the setting of WideResNet step=10, RGD improves both clean and robust accuracy. For the other settings of CNN step=5, RGD sacrifices a little clean accuracy of $3\%$ but significantly improves the robust accuracy of $16\%$ than PGD. All these experimental results further validate the superiority of RGD over PGD, especially with setting of step=5.

In this section, we examine and compare the transferability of RGD with PGD (sign/raw). We begin by generating adversarial data through a 10-step attack on the clean ResNet50 model (He et al., 2016). These adversarial samples are then transferred to attack clean (Simonyan and Zisserman, 2015; Huang et al., 2017; Szegedy et al., 2015) and robust (Croce et al., 2021) target models. The ImageNet validation set and CIFAR-10 testing set are used as the data for the attacks, following the settings in Zhao et al. (2022). The detailed results of the attack success rates for the source and target models can be found in Table 4.

The findings demonstrate that RGD consistently achieves the highest target success rates, while maintaining similar source success rates compared to PGD. It consistently improves the success rate by at least 5% when attacking most clean models and by around 3% for robust models with larger boundary ($\epsilon=16/255$). Furthermore, PGD (raw) outperforms signed PGD when attacking robust models, indicating that raw updates enhance the transferability to robust models. Our proposed RGD method further improves both robust and clean transferability compared to PGD (raw).

In this section, we conduct a comprehensive comparison under different levels of adversarial perturbation. Specifically, we consider three different values of $\epsilon$ ($\epsilon=4/255,8/255,16/255$) for generating adversarial examples, and evaluate the robust accuracy of PGD with sign or raw gradient updates, as well as RGD, when attacking the robust ResNet18 model using the same settings as in Section 4.2. We perform a grid search to determine the step sizes for each algorithm, and the results are presented in Figure 2, where a lower robust accuracy indicates a stronger attack.

Our result reveals the following observations: In the context of small $\epsilon$ ($\epsilon=4/255$), all algorithms converge to a similar performance point, suggesting comparable attack effectiveness. However, for larger size ($\epsilon=16/255$), PGD with raw gradient update performs relatively poorly, while RGD outperforms the other algorithms with noticeable improvements. Therefore, when a larger perturbation is allowed, RGD is the preferred choice for achieving stronger attack performance.

Furthermore, the raw update-based algorithms, namely PGD (raw) and RGD, exhibit a lower robust accuracy in the early steps. It is important to mention that we utilize zero initial for PGD (raw) and RGD, while a stronger uniform random initialization for PGD. This suggests that the raw update enables the generation of high-quality adversarial examples in the early steps.

In this section, we compare the performance of PGD with sign/raw updates and RGD at different update steps. Specifically, we evaluate the algorithms at steps 5, 10 and 20. The experimental setup follows Section 4.2 where step sizes are carefully fine-tuned. We fix the adversarial size $\epsilon$ at $16/255$, and the results are presented in Figure 3.

Our findings reveal that in the early stages, RGD achieves a lower robust accuracy compared to PGD, which can be attributed to its generation of stronger adversarial examples through a genuine adversarial distribution. However, as the number of training steps increases, the performance gap between RGD and PGD diminishes. This can be explained by the stable perturbation change introduced by the sign function in PGD, allowing it to achieve comparable performance to RGD in the later steps. In summary, RGD is a preferable choice for scenarios requiring a few-step update.

Additionally, it is evident that PGD with raw update remains in a suboptimal performance region and shows limited improvement in the later steps. This observation further highlights the advantage of the non-clipping design in RGD, which facilitates the generation of stronger adversarial examples.