Stop Walking in Circles! Bailing Out Early in Projected Gradient Descent
Not on the map. Why?
Abstract (arXiv)
Projected Gradient Descent (PGD) under the L_∞ ball has become one of the defacto methods used in adversarial robustness evaluation for computer vision (CV) due to its reliability and efficacy, making a strong and easy-to-implement iterative baseline. However, PGD is computationally demanding to apply, especially when using thousands of iterations is the current best-practice recommendation to generate an adversarial example for a single image. In this work, we introduce a simple novel method for early termination of PGD based on cycle detection by exploiting the geometry of how PGD is implemented in practice and show that it can produce large speedup factors while providing the exact same estimate of model robustness as standard PGD. This method substantially speeds up PGD without sacrificing any attack strength, enabling evaluations of robustness that were previously computationally intractable.
Key facts. Cited by 2 papers in the map (data through 13 Oct 2026). Builds on 30 of its 43 references that are in the map. First posted on arXiv 25 Mar 2025.
Builds on
30 of 43 references.
References · 30
- 2014Explaining and Harnessing Adversarial Examplescited by 7,336
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,379
- 2013Intriguing properties of neural networkscited by 5,137
- 2015Domain-Adversarial Training of Neural Networkscited by 3,030
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,992
- 2016Adversarial examples in the physical worldcited by 1,767
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,445
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,336
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,265
- 2020RobustBench: a standardized adversarial robustness benchmarkcited by 658
- 2019On Evaluating Adversarial Robustnesscited by 447
- 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
18 more
- 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 208
- 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 203
- 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
- 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
- 2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79
- 2020Opportunities and Challenges in Deep Learning Adversarial Robustness: A Surveycited by 71
- 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
- 2022A Light Recipe to Train Robust Vision Transformerscited by 64
- 2021Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraintscited by 50
- 2022A General Framework for Auditing Differentially Private Machine Learningcited by 25
- 2018Non-Negative Networks Against Adversarial Attackscited by 20
- 2023Improving the Accuracy-Robustness Trade-Off of Classifiers via Adaptive Smoothingcited by 18
- 2024MixedNUTS: Training-Free Accuracy-Robustness Balance via Nonlinearly Mixed Classifierscited by 16
- 2019Robust Design of Deep Neural Networks against Adversarial Attacks based on Lyapunov Theorycited by 13
- 2020FADER: Fast Adversarial Example Rejectioncited by 9
- 2021Adversarial Transfer Attacks With Unknown Data and Class Overlapcited by 8
- 2022Improving Out-of-Distribution Detection via Epistemic Uncertainty Adversarial Trainingcited by 4
- 2023Improving Fast Minimum-Norm Attacks with Hyperparameter Optimizationcited by 4
Built on by
Citing papers per year: 2025: 1; 2026: 1.
2 papers.