pgd attack

PGD (Projected Gradient Descent) is the standard strong adversarial attack — an iterative first-order attack that takes multiple gradient ascent steps to maximize the loss within the $\epsilon$-ball, projecting back onto the constraint set after each step.

PGD Algorithm

• Random Start: Initialize perturbation randomly within the $\epsilon$-ball: $x_0 = x + U(-\epsilon, \epsilon)$.
• Gradient Step: $x_{t+1} = x_t + \alpha \cdot \text{sign}(\nabla_x L(f_\theta(x_t), y))$ (for $L_\infty$).
• Projection: $x_{t+1} = Pi_\epsilon(x_{t+1})$ — project back onto the $\epsilon$-ball around the original input.
• Iterations: Typically 7-20 steps with step size $\alpha = \epsilon / 4$ or $2\epsilon / \text{steps}$.

Why It Matters

• Gold Standard: PGD is the standard attack for both evaluating and training adversarial robustness.
• Madry et al. (2018): Showed that PGD is a universal first-order adversary — if you defend against PGD, you resist all first-order attacks.
• Training: PGD-AT (adversarial training with PGD) remains the most reliable defense.

PGD is the workhorse of adversarial ML — the standard iterative attack used in both evaluating robustness and training robust models.