# PGD-Imp: Rethinking and Unleashing Potential of Classic PGD with Dual Strategies for Imperceptible Adversarial Attacks

**Authors:** Jin Li, Zitong Yu, Ziqiang He, Z. Jane Wang, Xiangui Kang  
**arXiv:** [2412.11168](https://arxiv.org/abs/2412.11168)  
**Date:** 2024-12-15  
**Summary page:** https://www.summarizepaper.com/en/paper/2412.11168v1/

## Key points

- Surge in research interest towards imperceptible adversarial attacks
- Existing approaches often involve complex external modules or additional loss terms
- Recent study challenges the necessity of elaborate designs
- Authors propose novel perspective on imperceptible attacks using Projected Gradient Descent (PGD)
- Introduce Dynamic Step Size strategy for minimal attack cost towards decision boundary
- Implement Adaptive Early Stop strategy to reduce excessive strength of perturbations
- PGD-Imp attack demonstrates significant advancements in imperceptible adversarial attacks
- Achieves remarkable results in untargeted attacks against ResNet-50 model
- Shows superior performance with reduced running time compared to existing methods

## Summary

In the realm of imperceptible adversarial attacks, there has been a surge in research interest towards developing methods that can effectively deceive machine learning models without being easily detected by human observers. Existing approaches often involve complex external modules or incorporate additional loss terms beyond simple $l_p$-norm to achieve imperceptibility. However, a recent study challenges the necessity of such elaborate designs. In this paper titled "PGD-Imp: Rethinking and Unleashing Potential of Classic PGD with Dual Strategies for Imperceptible Adversarial Attacks," authors Jin Li, Zitong Yu, Ziqiang He, Z. Jane Wang, and Xiangui Kang propose a novel perspective on imperceptible attacks. The authors introduce two straightforward yet powerful strategies to enhance the potential of Projected Gradient Descent (PGD), a widely used classical attack method, for achieving imperceptibility from an optimization standpoint. The first strategy involves the implementation of Dynamic Step Size, which aims to identify an optimal solution with minimal attack cost towards the decision boundary of the targeted model. By dynamically adjusting the step size during the optimization process, this approach enhances efficiency and effectiveness in generating imperceptible adversarial perturbations. The second strategy proposed by the authors is Adaptive Early Stop, which focuses on reducing the excessive strength of adversarial perturbations to minimize their impact on input data. By strategically halting the optimization process when reaching a certain threshold level of perturbation strength, this strategy helps generate more subtle and less noticeable adversarial examples. Through these innovative strategies collectively known as PGD-Imperceptible (PGD-Imp) attack, significant advancements are demonstrated in imperceptible adversarial attacks for both untargeted and targeted scenarios. Specifically, when conducting untargeted attacks against the ResNet-50 model, PGD-Imp achieves remarkable results including 100% (+0.3%) Attack Success Rate (ASR), 0.89 (-1.76) $l_2$ distance from original inputs, and 52.93 (+9.2) Peak Signal-to-Noise Ratio (PSNR). Moreover, compared to existing methods, PGD-Imp showcases superior performance with a reduced running time of 57 seconds (compared to -371 seconds). Overall, this study not only redefines our understanding of imperceptible attacks but also presents practical and efficient strategies that leverage classic techniques like PGD to achieve state-of-the-art results in deceiving machine learning models while maintaining visual indistinguishability to human observers.