PGD (Projected Gradient Descent) is the standard strong adversarial attack — an iterative first-order attack that takes multiple gradient ascent steps to maximize the loss within the $epsilon$-ball, projecting back onto the constraint set after each step.

PGD Algorithm

• Random Start: Initialize perturbation randomly within the $epsilon$-ball: $x_0 = x + U(-epsilon, epsilon)$.
• Gradient Step: $x_{t+1} = x_t + alpha cdot ext{sign}(\nabla_x L(f_ heta(x_t), y))$ (for $L_infty$).
• Projection: $x_{t+1} = Pi_epsilon(x_{t+1})$ — project back onto the $epsilon$-ball around the original input.
• Iterations: Typically 7-20 steps with step size $alpha = epsilon / 4$ or $2epsilon / ext{steps}$.

Why It Matters

• Gold Standard: PGD is the standard attack for both evaluating and training adversarial robustness.
• Madry et al. (2018): Showed that PGD is a universal first-order adversary — if you defend against PGD, you resist all first-order attacks.
• Training: PGD-AT (adversarial training with PGD) remains the most reliable defense.

PGD is the workhorse of adversarial ML — the standard iterative attack used in both evaluating robustness and training robust models.