Neural networks have demonstrated success in various domains, yet their performance can be significantly degraded by even a small input perturbation. Consequently, the construction of such perturbations, known as adversarial attacks, has gained significant attention, many of which fall within "white-box" scenarios where we have full access to the neural network. Existing attack algorithms, such as the projected gradient descent (PGD), commonly take the sign function on the raw gradient before updating adversarial inputs, thereby neglecting gradient magnitude information. In this paper, we present a theoretical analysis of how such sign-based update algorithm influences step-wise attack performance, as well as its caveat. We also interpret why previous attempts of directly using raw gradients failed. Based on that, we further propose a new raw gradient descent (RGD) algorithm that eliminates the use of sign. Specifically, we convert the constrained optimization problem into an unconstrained one, by introducing a new hidden variable of non-clipped perturbation that can move beyond the constraint. The effectiveness of the proposed RGD algorithm has been demonstrated extensively in experiments, outperforming PGD and other competitors in various settings, without incurring any additional computational overhead. The codes is available in https://github.com/JunjieYang97/RGD.

翻译：神经网络在各个领域取得了成功，然而即使微小的输入扰动也可能显著降低其性能。因此，构造此类扰动（即对抗攻击）受到了广泛关注，其中许多属于“白盒”场景，即我们可以完全访问神经网络。现有攻击算法（如投影梯度下降法，PGD）通常在对原始梯度进行符号化处理后更新对抗输入，从而忽略了梯度幅度信息。本文对基于符号的更新算法如何影响逐步骤攻击性能进行了理论分析，并指出了其局限性。我们还解释了为何先前直接使用原始梯度的尝试会失败。基于此，我们进一步提出了一种新的原始梯度下降法（RGD），消除了符号函数的应用。具体而言，我们通过引入一个未裁剪的、可超越约束的隐变量，将约束优化问题转化为无约束优化问题。大量实验证明，所提出的RGD算法在各种设置下均优于PGD及其他同类算法，且未增加任何额外计算开销。代码已开源：https://github.com/JunjieYang97/RGD。