Abstract
Projected Gradient Descent (PGD) under the $L_\infty$ ball has become one of the defacto methods used in adversarial robustness evaluation for computer vision (CV) due to its reliability and efficacy, making a strong and easy-to-implement iterative baseline. However, PGD is computationally demanding to apply, especially when using thousands of iterations is the current best-practice recommendation to generate an adversarial example for a single image. In this work, we introduce a simple novel method for early termination of PGD based on cycle detection by exploiting the geometry of how PGD is implemented in practice and show that it can produce large speedup factors while providing the \emph{exact} same estimate of model robustness as standard PGD. This method substantially speeds up PGD without sacrificing any attack strength, enabling evaluations of robustness that were previously computationally intractable.
Abstract (translated)
基于$L_\infty$球的投影梯度下降（Projected Gradient Descent，PGD）方法由于其可靠性和有效性，在计算机视觉（CV）领域的对抗鲁棒性评估中已经成为了一种事实上的标准方法。然而，这种方法在计算上非常耗费资源，尤其是在当前最佳实践建议使用数千次迭代来为单张图像生成一个对抗样本时更是如此。在这项工作中，我们提出了一种简单的新方法，通过利用实际实现PGD的几何特性来进行循环检测以提前终止PGD，并展示了该方法能够在不牺牲模型鲁棒性评估准确性的前提下产生显著的速度提升。具体来说，它能够提供与标准PGD完全相同的模型鲁棒性估计结果，但速度却快得多。这种方法极大地加快了PGD的执行速度，同时没有削弱攻击力度，使得之前由于计算资源限制而无法进行的对抗鲁棒性评估成为可能。
URL
https://arxiv.org/abs/2503.19347
