[Paper Review] Fast Gradient Non-sign Methods

Yaya Cheng, Jingkuan Song+4 more|arXiv (Cornell University)|Oct 25, 2021

Adversarial Robustness in Machine Learning37 references4 citations

TL;DR

This paper proposes Fast Gradient Non-sign Methods (FGNM), a generalizable replacement for the sign operation in gradient-based adversarial attacks that reduces directional bias by correcting the discrepancy between true gradients and perturbations via Taylor expansion-based refinement. FGNM achieves state-of-the-art performance with negligible computational overhead, improving untargeted black-box attack success rates by up to 27.5% and targeted attacks on defense models by 15.1% on average.

ABSTRACT

Adversarial attacks make their success in DNNs, and among them, gradient-based algorithms become one of the mainstreams. Based on the linearity hypothesis, under $\ell_\infty$ constraint, $sign$ operation applied to the gradients is a good choice for generating perturbations. However, side-effects from such operation exist since it leads to the bias of direction between real gradients and perturbations. In other words, current methods contain a gap between real gradients and actual noises, which leads to biased and inefficient attacks. Therefore in this paper, based on the Taylor expansion, the bias is analyzed theoretically, and the correction of $sign$, i.e., Fast Gradient Non-sign Method (FGNM), is further proposed. Notably, FGNM is a general routine that seamlessly replaces the conventional $sign$ operation in gradient-based attacks with negligible extra computational cost. Extensive experiments demonstrate the effectiveness of our methods. Specifically, for untargeted black-box attacks, ours outperform them by 27.5% at most and 9.5% on average. For targeted attacks against defense models, it is 15.1% and 12.7%. Our anonymous code is publicly available at https://github.com/yaya-cheng/FGNM

Motivation & Objective

• To address the directional bias introduced by the sign operation in gradient-based adversarial attacks under ℓ∞ constraints.
• To theoretically analyze the gap between real gradients and perturbations caused by the sign operation using Taylor expansion.
• To propose a general, plug-and-play method—Fast Gradient Non-sign Method (FGNM)—that corrects this bias without increasing computational cost.
• To empirically validate FGNM's superiority across untargeted and targeted attacks, including against defended models.
• To demonstrate that refined perturbation direction leads to more efficient and effective adversarial examples.

Proposed method

• The method derives a corrected perturbation direction using Taylor expansion to model the deviation introduced by the sign function.
• FGNM replaces the standard sign operation with a refined direction that preserves the magnitude of sign but aligns more closely with the true gradient direction.
• The correction is applied via a two-step process: first, align the perturbation direction with the true gradient; second, clip to maintain ℓ∞ norm constraint.
• The approach is designed as a seamless drop-in replacement for existing gradient-based attacks, requiring minimal code changes.
• Two variants are introduced: FGNM N (fixed scale) and FGNM K (adaptive scale), balancing magnitude and direction accuracy.
• The method maintains computational efficiency by avoiding additional forward passes or complex optimization.

Experimental results

Research questions

• RQ1 How does the sign operation introduce directional bias in gradient-based adversarial attacks under ℓ∞ constraints?
• RQ2 To what extent does the gap between true gradients and sign-based perturbations degrade attack performance?
• RQ3 Can a Taylor expansion-based correction reduce this directional bias while maintaining computational efficiency?
• RQ4 Does replacing the sign function with a refined direction improve attack success rates across both untargeted and targeted settings?
• RQ5 How does FGNM perform against defended models compared to state-of-the-art attack methods?

Key findings

• FGNM N reduces the ℓ2-norm of adversarial noise by 2.1% on average compared to I-FGSM and 11.2% compared to MI-FGSM, indicating more efficient perturbations.
• The cosine similarity between perturbations and true gradients increases by 0.4 on average for FGNM N over I-FGSM, confirming reduced directional bias.
• For untargeted black-box attacks, FGNM improves success rates by up to 27.5% and by 9.5% on average compared to state-of-the-art methods.
• For targeted attacks against defense models, FGNM achieves improvements of 15.1% in maximum and 12.7% in average success rate.
• The clipped ratio of perturbations in MI-FGNM N is only 15% at iteration 10, significantly lower than MI-FGSM, indicating less distortion from clipping and better direction preservation.
• Visualizations confirm that FGNM N produces adversarial examples nearly indistinguishable from originals, while FGNM K slightly increases noise levels without degrading imperceptibility.