Stop Walking in Circles! Bailing Out Early in Projected Gradient Descent

2025-03-25

AI Summary

PGD-based adversarial attacks, while highly robust, require thousands of iterations, incurring prohibitive computational overhead that severely hinders large-scale robustness evaluation. To address this, we propose a geometry-guided cycle-detection early-stopping mechanism for ℓ∞-PGD. Our method is the first to leverage periodic geometric patterns in the input-space trajectory of PGD iterations to reliably detect convergence—yielding robustness estimates identical to standard PGD without any approximation. Crucially, it preserves the original optimization objective and perturbation constraints, introducing no additional error or degradation in attack strength. Empirically, it reduces per-sample attack time by multiple-fold. Experiments demonstrate its efficacy in enabling previously infeasible large-scale robustness benchmarking under realistic computational constraints, establishing a new paradigm for high-accuracy, high-efficiency adversarial evaluation.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Web Mining and Content Analysis: Robustness and generalizability of Web mining methods

Abstract

Projected Gradient Descent (PGD) under the $L_infty$ ball has become one of the defacto methods used in adversarial robustness evaluation for computer vision (CV) due to its reliability and efficacy, making a strong and easy-to-implement iterative baseline. However, PGD is computationally demanding to apply, especially when using thousands of iterations is the current best-practice recommendation to generate an adversarial example for a single image. In this work, we introduce a simple novel method for early termination of PGD based on cycle detection by exploiting the geometry of how PGD is implemented in practice and show that it can produce large speedup factors while providing the emph{exact} same estimate of model robustness as standard PGD. This method substantially speeds up PGD without sacrificing any attack strength, enabling evaluations of robustness that were previously computationally intractable.

Problem

• Speeds up Projected Gradient Descent (PGD) for adversarial robustness evaluation
• Reduces computational demand without sacrificing attack strength
• Enables previously intractable robustness evaluations via early termination

Innovation

• Early termination of PGD via cycle detection
• Exploits PGD geometry for speedup
• Maintains exact robustness as standard PGD