pgd attack

**PGD** (Projected Gradient Descent) is the **standard strong adversarial attack** — an iterative first-order attack that takes multiple gradient ascent steps to maximize the loss within the $epsilon$-ball, projecting back onto the constraint set after each step. **PGD Algorithm** - **Random Start**: Initialize perturbation randomly within the $epsilon$-ball: $x_0 = x + U(-epsilon, epsilon)$. - **Gradient Step**: $x_{t+1} = x_t + alpha cdot ext{sign}( abla_x L(f_ heta(x_t), y))$ (for $L_infty$). - **Projection**: $x_{t+1} = Pi_epsilon(x_{t+1})$ — project back onto the $epsilon$-ball around the original input. - **Iterations**: Typically 7-20 steps with step size $alpha = epsilon / 4$ or $2epsilon / ext{steps}$. **Why It Matters** - **Gold Standard**: PGD is the standard attack for both evaluating and training adversarial robustness. - **Madry et al. (2018)**: Showed that PGD is a universal first-order adversary — if you defend against PGD, you resist all first-order attacks. - **Training**: PGD-AT (adversarial training with PGD) remains the most reliable defense. **PGD** is **the workhorse of adversarial ML** — the standard iterative attack used in both evaluating robustness and training robust models.