Hostname: page-component-6766d58669-bkrcr Total loading time: 0 Render date: 2026-05-19T21:09:13.353Z Has data issue: false hasContentIssue false

Adversarial flows: A gradient flow characterization of adversarial attacks

Published online by Cambridge University Press:  12 September 2025

Lukas Weigand
Affiliation:
Helmholtz Imaging, Deutsches Elektronen-Synchrotron DESY, Notkestr. 85, 22607 Hamburg, Germany
Tim Roith*
Affiliation:
Helmholtz Imaging, Deutsches Elektronen-Synchrotron DESY, Notkestr. 85, 22607 Hamburg, Germany
Martin Burger
Affiliation:
Helmholtz Imaging, Deutsches Elektronen-Synchrotron DESY, Notkestr. 85, 22607 Hamburg, Germany Department of Mathematics, Bundesstr. 55, University of Hamburg, 20146 Hamburg, Germany
*
Corresponding author: Tim Roith; Email: tim.roith@desy.de
Rights & Permissions [Opens in a new window]

Abstract

A popular method to perform adversarial attacks on neural networks is the so-called fast gradient sign method and its iterative variant. In this paper, we interpret this method as an explicit Euler discretization of a differential inclusion, where we also show convergence of the discretization to the associated gradient flow. To do so, we consider the concept of $p$-curves of maximal slope in the case $p=\infty$. We prove existence of $\infty$-curves of maximum slope and derive an alternative characterization via differential inclusions. Furthermore, we also consider Wasserstein gradient flows for potential energies, where we show that curves in the Wasserstein space can be characterized by a representing measure on the space of curves in the underlying Banach space, which fulfil the differential inclusion. The application of our theory to the finite-dimensional setting is twofold: On the one hand, we show that a whole class of normalized gradient descent methods (in particular, signed gradient descent) converge, up to subsequences, to the flow when sending the step size to zero. On the other hand, in the distributional setting, we show that the inner optimization task of adversarial training objective can be characterized via $\infty$-curves of maximum slope on an appropriate optimal transport space.

Information

Type
Papers
Creative Commons
Creative Common License - CCCreative Common License - BY
This is an Open Access article, distributed under the terms of the Creative Commons Attribution licence (https://creativecommons.org/licenses/by/4.0/), which permits unrestricted re-use, distribution and reproduction, provided the original article is properly cited.
Copyright
© The Author(s), 2025. Published by Cambridge University Press
Figure 0

Figure 1. Behavior of (IFGSM) (top) and the minimizing movement scheme (MinMove) (bottom), for a binary classifier – parametrized as a neural network – on ${\mathbb{R}}^2$, a budget of $\varepsilon =0.2$ and $\tau \in \{0.2, 0.1, 0.02, 0.001\}$. The white box indicates the maximal distance to the initial value, and the pink boxes indicate the step size $\tau$ of the scheme. Details on this experiment can be found in Appendix H.

Figure 1

Figure 2. Visualization of the ball inclusion used for the proof of (2.6).

Figure 2

Figure 3. Visualization of one (IFGSM) step, employing different norm constraints and underlying norms. The beige line marks the boundary of $B_\varepsilon ^p({x}^0)$, the pink line the boundary of $B_\tau ^q({x})$ and the intersection $\overline {B_\varepsilon ^p}({x}^0) \cap \overline {B_\tau ^q}({x})$ is hatched. For the case $p=q=\infty$ minimizing a linear function on the intersection (blue arrow) is equivalent to first minimizing on $\overline {B_\tau ^\infty }({x})$ (pink arrow) and then projecting back to the intersection (green arrow). This is not true for $p=2$. Therefore, we need to choose the appropriate projection in Lemma 5.4.

Figure 3

Figure H1. Visualization of the dataset and trained classifiers used in the experiments.

Figure 4

Figure H2. The network architecture used in the examples.

Figure 5

Figure H3. The same experiment as in Figure 1, but using a net employing the GeLU activation function.

Figure 6

Figure H4. Difference between IFGSM and the minimizing movement scheme.