PGD Attack on Image Classifiers
Repeat small signed steps with re-projection into the budget, so the attack climbs past every local defense FGSM cannot reach.
Why Does This Exist?
FGSM spends the whole budget in one step and stops, so any boundary past that step survives. Projected Gradient Descent iterates: step a little, project back into the budget box, repeat. Its threat model matches FGSM, white-box gradients at budget 0.03, but its strength sets the standard that defenses must meet. The overview is adversarial attacks.
Think of It Like This
Feeling uphill in the dark with a leash
A hiker who can only feel the slope underfoot takes short steps uphill while a leash keeps them within 0.03 miles of camp. One long jump in the first slope direction may miss the summit; twenty short felt steps with the leash reeled in each time arrive. Step size is stride, projection is the leash. The analogy stops at dimension: trails are one-dimensional while pixel space offers millions of uphill directions at once.
How It Actually Works
Start from the clean image plus small random noise inside the budget. Repeat twenty times: step 0.008 along the signed gradient, then clip every pixel back into the budget box around the original. Random restarts from different noise find different flips, and the strongest restart counts. Targeted variants descend the chosen-class loss instead.
Worked PGD run with recomputed numbers
Same toy pixel starting 0.500 with gradient minus 0.42 and step 0.008: step one lands 0.492, step two 0.484, step three 0.476, then clipping holds the 0.470 floor since 0.500 minus 0.03 is the wall. The pixel reaches in three steps what FGSM did in one, and the remaining seventeen steps coordinate thousands of pixels jointly. Demo result at 20 steps: 96 of 100 flip against 87 for FGSM inside the identical budget, with mean change 0.024 below the 0.03 ceiling because projection binds only some pixels.
Condition and cost
PGD assumes repeated gradient access, twenty passes here, which rules out single-query settings where transfer or query attacks apply instead. Cost scales with steps times restarts, so evaluations fix both before comparing defenses.
Watch Out For
Running three steps and calling it PGD
Few-step PGD with no restarts matches FGSM numbers while wearing the stronger name, and weak defenses pass. The symptom is robust accuracy that collapses when steps rise to twenty with two restarts. Fix the evaluation at twenty steps minimum with restarts stated, and report the curve over steps.
The Quick Version
- Twenty steps of 0.008 with projection back into the 0.03 budget box.
- Flips 96 of 100 where FGSM flips 87, same budget, more queries.
- Random restarts find distinct flips; report the strongest.
- Cost is gradient passes, so fix steps and restarts before comparing.
- Every defense claim answers PGD first, per the defenses page.