Title: Robust and Faster Zeroth-Order Minimax Optimization: Complexity and Applications
Venue: NeurIPS 2024
Accepted: yes
Keywords: zeroth-order algorithms

minimax problems

robustness

complexity

regression
Abstract: Many zeroth-order (ZO) optimization algorithms have been developed to solve nonconvex minimax problems in machine learning and computer vision areas. However, existing ZO minimax algorithms have high complexity and rely on some strict restrictive conditions for ZO estimations. To address these issues, we design a new unified ZO gradient descent extragradient ascent (ZO-GDEGA) algorithm, which reduces the overall complexity to $\mathcal{O}(d\epsilon^{-6})$ to find an $\epsilon$-stationary point of the function $\psi$ for nonconvex-concave (NC-C) problems, where $d$ is the variable dimension. To the best of our knowledge, ZO-GDEGA is the first ZO algorithm with complexity guarantees to solve stochastic NC-C problems. Moreover, ZO-GDEGA requires weaker conditions on the ZO estimations and achieves more robust theoretical results. As a by-product, ZO-GDEGA has advantages on the condition number for the NC-strongly concave case. Experimentally, ZO-GDEGA can generate more effective poisoning attack data with an average accuracy reduction of 5\%. The improved AUC performance also verifies the robustness of gradient estimations.

1

Abstract

Many zeroth-order (ZO) optimization algorithms have been developed to solve nonconvex minimax problems in machine learning and computer vision areas. However, existing ZO minimax algorithms have high complexity and rely on some strict restrictive conditions for ZO estimations. To address these issues, we design a new unified ZO gradient descent extragradient ascent (ZO-GDEGA) algorithm, which reduces the overall complexity to O ( dϵ -6 ) to find an ϵ -stationary point of the function ψ for nonconvex-concave (NC-C) problems, where d is the variable dimension. To the best of our knowledge, ZO-GDEGA is the first ZO algorithm with complexity guarantees to solve stochastic NC-C problems. Moreover, ZO-GDEGA requires weaker conditions on the ZO estimations and achieves more robust theoretical results. As a by-product, ZO-GDEGA has advantages on the condition number for the NC-strongly concave case. Experimentally, ZO-GDEGA can generate more effective poisoning attack data with an average accuracy reduction of 5%. The improved AUC performance also verifies the robustness of gradient estimations.

1 Introduction

We mainly consider a general regularized minimax problem:

where f : R d x × d y → R is nonconvex in x , concave in y and ℓ -smooth, g : R d x → R and h : R d y → R are convex but maybe nonsmooth functions. The problem (1) appears in many scenarios of machine learning, such as adversarial attack to regularized deep neural networks, regularized fair learning, and robust training [7, 13]. In this paper, we focus on the black-box setting of Problem (1), where the gradients are estimated by only functional values.

In the black-box setting, some evolutionary algorithms such as [46] have achieved good performance. However, they usually lack complexity analysis and may never converge to a solution due to pathological behavior [33]. Thus, ZO algorithms with convergence guarantees came into being. For example, ZO algorithms provide an alternative to higher-order optimization methods for solving robust network training with gradient or curvature regularization [37, 13]. Besides, ZO algorithms have also made considerable progress in escaping from saddle points [56].

As for the black-box problem (1), ZO algorithms provide an access for solving it where the gradients are computationally infeasible or expensive, such as the Area Under Curve (AUC) maximization [54] with the ReLU activation and generating poisoning data to evaluate the black-box models [22, 33, 61]. In these scenarios, ZO algorithms become one of the best choices. For example, [33] proposed ZO-Min-Max for solving NC-strongly concave (NC-SC) data poisoning attack problems.

More practically, it is desired to solve Problem (1) under weaker conditions such as general concavity and more tolerant smoothing parameters of ZO estimators. But existing ZO algorithms such as [50] have high overall complexity for NC-C problems, and require picky smoothing parameters to ensure convergence, which weakens the robustness. On the other hand, the stochastic loss is actually more common [28]. But there is no ZO algorithm to solve the stochastic NC-C problem (1), which motivates us to fill this gap. Thus, we summarize our motivations as follows:

Can we design a ZO algorithm to achieve a lower overall complexity with more weaker requirements on ZO estimators for NC-C problems?

Due to the lack of research on stochastic ZO algorithms in the NC-C setting, can we develop a new stochastic ZO algorithm with theoretical guarantees?

Our contributions. In this paper, we propose a unified algorithm to answer the above two questions. Our contributions can be summerized as follows.

To the best of our knowledge, the stochastic ZO-GDEGA is the first ZO stochastic algorithm with theoretical guarantees for solving NC-C problems, which for the first time finds a generalized ϵ -stationary point of ψ with an overall complexity of O ( d x ϵ -6 + d y ϵ -8 ) , as shown in Table 1.

Our ZO-GDEGA algorithm is more tolerant to the ZO estimations. Specifically, ZO-GDEGA allows a larger tolerance O ( ϵ ) for smoothness parameters µ 1 and µ 2 compared with existing methods, as shown in Table 1, which enhances the robustness of ZO algorithms.

As a by-product, ZO-GDEGA applied to NC-SC problems can obtain competitive complexity results O ( κ 2 ( d x + d y ) ϵ -2 ) and O ( κ 2 ( d x + κd y ) ϵ -4 ) for deterministic and stochastic settings, respectively.

Finally, the poisoning attack experiment shows that the poisoned data generated by ZO-GDEGA can reduce the accuracy by 2.1%-7.9% compared to baselines. The AUC maximization task shows that our algorithms can improve AUC performance by 0.4-5.4 units under rough ZO estimation.

2 Preliminaries and Related Work

This section provides several notations and definitions, and discusses some related works.

2.1 Notations

∥ · ∥ and ∥ · ∥ 1 denote the ℓ 2 -norm and ℓ 1 -norm of a vector, respectively. ∥ · ∥ ∞ denotes the ℓ ∞ -norm of a vector, i.e., ∥ x ∥ ∞ = max 1 ≤ i ≤ d x | x i | . We denote a = O ( b ) if a ≤ Cb for some constant C > 0 , any subgradient of g ( · ) at x by ∂g ( x ) , a ZO estimator of f ( · ) at x by ˆ ∇ f ( x ) for the gradient ∇ f ( x ) , the regularized coupling function by Γ( x, y ) := f ( x, y ) -h ( y ) , the max function by Φ( x ) := max y { f ( x, y ) -h ( y ) } and the regularized max function by ψ ( x ) := g ( x ) + Φ( x ) .

2.2 Related Work

ZO algorithms for nonconvex minimax optimization. For solving NC-SC minimax problems, some single-loop ZO algorithms have been presented. For example, [33] proposed the ZO-Min-Max by integrating alternating stochastic Gradient Descent Ascent (GDA) method and ZO estimators, which finds an ϵ -stationary point with the overall complexity O ( κ 6 dϵ -6 ) , when g ( x ) = I X ( x ) and h ( y ) = I Y ( y ) . [47] proposed the ZO-GDA for solving the deterministic problem (1) with g ( x ) ≡ 0 and h ( y ) = I Y ( y ) , and the ZO overall oracle complexity is bounded by O ( κ 5 dϵ -2 ) . Its stochastic variant, ZO-SGDA, can achieve the overall ZO oracle complexity O ( κ 5 dϵ -4 ) . Recently, [19] proposed an Acc-ZOMDA algorithm based on momentum acceleration techniques and further reduced the overall ZO oracle complexity. However, these algorithms have relatively strict restrictions on ZO estimators, as shown in Table 1, which affects their performance, as shown in Table 2.

As for NC-C problems, to the best of our knowledge, the only work proposed in [50] designs a ZO-AGP algorithm with the ZO oracle complexity O ( d x ϵ -8 + d y ϵ -10 ) , but it only considers the deterministic setting when g ( x )= I X ( x ) , h ( y )= I Y ( y ) , and X and Y are two convex compact sets, which limits its application to some scenarios such as regularized robust neural network training [21]. More recently, a new version of ZO-AGP [51] has been presented during the preparation of our work, which achieves lower complexity under the same constraints, but its theoretical results are still in terms of the coupling function f instead of the stronger definition in terms of ψ , as shown in Table 1, while our analysis is in terms of ψ and achieves lower complexity.

Extragradient methods. The extragradient (EG) method was first proposed in [27] for solving convex-concave saddle point problems and it adopts the gradient at the current point x t to find an intermediate point x t +1 / 2 and then uses the gradient at x t +1 / 2 to determine the next iteration point x t +1 . Specifically, at iteration t ,

where prox g γ ( x ) ≜ arg min z { g ( z ) + 1 2 γ ∥ z -x ∥ 2 } . On the one hand, the extra proximal gradient step guides the optimization process, which allows to escape cycling trajectories of the simultaneous gradient flow [23] and consider curvature information [40]. Compared with various GDA methods such as [31, 55], many works have shown the advantages of the first-order (FO) EG structure, such as handling noisy gradients in the convex-concave [26, 1] and NC-SC(C) [35] settings, but there is no insight into the ZO setting. On the other hand, in univariate convex optimization, the EG method has made considerable progress inspired by continuous time dynamic theory, and it can be explained as

an approximation of the more robust backward-Euler discretization [18], whereas gradient descent is a variant of the classical forward-Euler discretization [9]. Based on the two facts above, we aim to explore the performance of the EG structure in ZO minimax optimization to improve both theoretical and practical performance for solving the black-box problem (1).

Lower bounds for minimax optimization. For minimization problems, the lower bounds on ZO methods justify that the dependence on the dimension is inevitable without additional assumptions [12]. For minimax problems, will there be a similar conclusion? So far, researchers focus on the lower bounds of FO methods. For example, the lower bounds are Ω( ϵ -1 ) [41] and ˜ Ω( κ ) [58] for convex-concave (C-C) and SC-SC settings, respectively. For NC-SC problems, there is also a lower bound for the FO setting [59, 30]. But to the best of our knowledge, there is no work proving a lower bound for ZO algorithms solving NC minimax problems. This paper focuses on another aspect and provides the upper bound for ZO algorithms solving NC minimax problems.

Upper bounds for minimax optimization. For the NC-C setting, GDA [31], Alternating GDA (AGDA) [4] and GDmax [25, 25] are analyzed to guarantee convergence. So far, the best complexity bound for FO deterministic NC-C problems is O ( ϵ -6 ) . The works [60, 20] have further extended to the stochastic setting. For example, SAPD+ [60] achieved the complexity bound of O ( ϵ -6 ) , which matches that of the deterministic case. For the NC-SC setting, the works [34, 49] proved the advanced bound of O ( κ 3 ϵ -3 ) . SAPD+ achieved another advanced complexity bound of O ( κϵ -4 ) .

In minimizing optimization, the complexity of ZO methods is usually d times that of corresponding FO methods [12]. In this sense, our results match the upper bound in the deterministic NC-C setting. Unfortunately, there is no similar conclusion in the minimax optimization yet. On the other hand, existing ZO methods such as [49, 50] focus on modifying existing FO algorithms, while this paper focuses on designing ZO minimax algorithms to directly improve performance.

3 ZO-GDEGA for NC-C Problems

In this section, we design a unified single-loop ZO gradient descent extragradient ascent (ZOGDEGA) algorithm for solving the NC-C problem (1). The following assumptions are made for our analysis throughout this section.

Assumption 1. We assume f ( x, · ) is concave for a given x .

Assumption 2. [4] The regularizers g and h are proper, convex and lower semicontinuous.

1. Additionally, g is either L g -Lipschitz continuous on its domain, which is assumed to be open, or the indicator of a nonempty, convex and closed set. Either of those assumptions guarantees the bound

holds for any γ > 0 and all x ∈ dom g (in the case of the indicator the statement is trivially true).

2. Furthermore, h has a bounded domain dom h such that the diameter of dom h is bounded by D h .

Similar to [4], we also use the extension of the classical Danskin's theorem based on Assumptions 1 and 2 to guarantee that the solution set Y ∗ ( x ) := { y ∗ | y ∗ ∈ arg max y { f ( x, y ) -h ( y ) } } is nonempty for ∀ x ∈ R d x and Φ( x ) is ℓ -weakly convex. Based on these facts, we propose and analyze our ZO-GDEGA algorithm for solving the NC-C problem (1) in deterministic and stochastic settings.

3.1 ZO-GDEGA in the Deterministic Setting

We first approximate the FO gradient by ZO randomized gradient estimators. Then, we propose the ZO-GDEGA algorithm to solve the black-box NC-C problem (1). Our algorithms are single-loop and more easily scalable compared to nested-loop algorithms such as [32].

ZO randomized gradient estimators. We introduce the ZO randomized gradient estimators as follows: ˆ ∇ x f ( x, y ) = 1 q 1 ∑ q 1 i =1 d x ( f ( x + µ 1 u i ,y ) -f ( x,y )) µ 1 u i , ˆ ∇ y f ( x, y ) = 1 q 2 ∑ q 2 i =1 d y ( f ( x,y + µ 2 v i ) -f ( x,y )) µ 2 v i , where { u i } q 1 i =1 ⊆ R d x and { v i } q 2 i =1 ⊆ R d y are i.i.d. random direction vectors drawn uniformly from the unit Euclidean spheres, respectively. µ 1 and µ 2 are smoothing parameters, the conditions on which are strict in existing algorithms such as [51], while our algorithms allow them to be O ( ϵ ) , as shown in Table 1. The randomness caused by vectors u i and v i is coupled in the alternating

updates of x and y and undoubtedly increases the difficulty of complexity analysis. We introduce two smooth functions f µ 1 ( x, y ) = E u [ f ( x + µ 1 u, y )] and f µ 2 ( x, y ) = E v [ f ( x, y + µ 2 v )] to bridge the ZO estimators and the FO gradient, thereby assisting in complexity analysis as shown in Fig. 1.

Algorithm 1 Deterministic Zeroth-Order Gradient Descent Extragradient Ascent Algorithm

Initialize: x 0 , z 0 = y 0 , step sizes η x and η y .

1: for t = 0 , 1 , . . . , T -1 do

3:

z

t

+1

4: end for

5: Randomly draw ˆ x from x 1 , . . . , x T at uniform.

Output:

ˆ

x

.

To improve performance, we integrate the EG structure and the ZO randomized gradient estimators, and propose the ZO-GDEGA algorithm. Specifically, it contains a proximal gradient descent step and two proximal gradient ascent steps, as shown in Algorithm 1.

3.1.1 Update rule of x .

Algorithm 1 updates x by minimizing the following linearized approximation,

where z t is an auxiliary variable and its update rule is given later. Our design for updating x t +1 relies only on the previous point x t , and does not require x t +1 / 2 as in the standard EG method (2).

3.1.2 EG update rule of y .

The quality of the solution set Y ∗ ( x ) plays a key role on complexity. To take full advantage of the EG structure based on the concavity w.r.t. y , we integrate it into the update of y , which guides a new high-level idea from the continuous-time dynamic perspective.

A high-level idea. Here we show an intuition for the advantages of our algorithm. If h is 'simple", in the sense that the proximal operator has a closed-form solution [6]. Without loss of generality, we consider the case of h ( y ) ≡ 0 . In this case, the proximal operator becomes the identity transformation. In fact, one-step ZO estimation w.r.t. y can be viewed as the discretization of the stochastic continuoustime dynamic ˙ Y ( t )= ˆ ∇ y f ( X,Y ( t )) with the limit η y → 0 . To get more robust and accurate solutions, we use the backward-Euler instead of forward-Euler discretization to solve this dynamic. An exact backward-Euler step implies the discretization y t +1 = y t + η y ˆ ∇ y f ( x t +1 , y t +1 ) , but obtaining y t +1 in such a manner could be computationally prohibitive. Instead, we opt for an extra gradient ascent step z t +1 = y t + η y ˆ ∇ y f ( x t , y t ) to first approximate y t +1 once as shown in the 3 rd line of Algorithm 1, which can be viewed as a 'trial' step. Then, we use the ZO oracle at point ( x t +1 , z t +1 ) to approximate one-step backward-Euler discretization as shown in the end of the 3 rd line, which is one of the reasons why our ZO-GDEGA algorithm is more robust than [51].

3.1.3 Advantages over Existing Methods.

Compared with existing works, our ZO-GDEGA algorithm has the following three main advantages:

Stronger robustness. About ZO estimators, ZO-GDEGA can tolerate smoothness parameters µ 1 and µ 2 of size O ( ϵ ) , whereas existing ZO algorithms have stricter restrictions on smoothness parameters such as O ( ϵ 4 ) as shown in Table 1, which is the fundamental reason why ZO-GDEGA improves the robustness. Specific proofs and experimental verifications are in subsequent sections.

Lower per-iteration complexity. Compared with the standard EG method [35], Algorithm 1 only uses the EG structure for the update of y instead of both x and y , which reduces per-iteration complexity and maintains the same iteration complexity as the standard EG method. In fact, our ZO-GDEGA algorithm is easily extended to an FO method, which still reduces the computation cost and maintains the corresponding theoretical result. Since this paper mainly focuses on the ZO case, the FO variant of Algorithm 1 is shown in the Appendix.

=

prox

h

η

y

(

y

t

+

η

y

ˆ

∇

y

f

(

x

t

, y

t

))

;

More extensive applications. The proximal operators generalize the projection operators in existing works such as [51]. Compared with [21], our ZO-GDEGA does not require additional compactness of the domains, which significantly extend the applicability.

3.2 ZO-GDEGA in the Stochastic Setting

Weconsider that f is a stochastic function on a distribution D , i.e., f ( x, y ) := E ξ ∼ D f ( x, y ; ξ ) , and we can only access the stochastic function values f ( x, y ; ξ ) . In this case, we introduce the stochastic version of ZO estimators: ˆ ∇ x f ( x, y ; I 1 )= 1 b 1 ∑ b 1 j =1 ˆ ∇ x f ( x, y ; ζ j ) = 1 b 1 ∑ b 1 j =1 f ( x + µ 1 u j ,y ; ζ j ) -f ( x,y ; ζ j ) µ 1 /d x u j as well as ˆ ∇ y f ( x, y ; I 2 ) , where I 1 = { ζ j } b 1 j =1 , I 2 = { ξ j } b 2 j =1 denote mini-batch sets of b 1 and b 2 i.i.d. samples. According to [19], E U, I 1 [ ˆ ∇ x f ( x, y ; I 1 )] = ∇ x f µ 1 ( x, y ) and E V, I 2 [ ˆ ∇ y f ( x, y ; I 2 )] = ∇ y f µ 2 ( x, y ) with U = { u i } b 1 i =1 and V = { v i } b 2 i =1 , and we need the common Assumptions 3, 6 and 7 in ZO stochastic optimization. Due to the page limit, we place Assumptions 6 and 7 in the Appendix.

Based on the above analysis and Algorithm 1, we design a stochastic variant of ZO-GDEGA, as shown in Algorithm 2 in the Appendix. The main difference between Algorithms 2 and 1 is that the ZO estimators are replaced by their stochastic versions. In fact, for NC-C minimax problems, stochastic ZO-GDEGA is the first stochastic ZO algorithm and we prove its complexity in Section 5.

4 ZO-GDEGA for NC-SC Problems

In this section, we provide two by-products of our ZO-GDEGA algorithm for the NC-SC setting, as also shown in Algorithms 1 and 2. We design and analyze them based on Assumption 4.

Assumption 4. We assume f ( x, · ) is µ -strongly concave in y for a given x . Moreover, the regularizers g and h are proper, convex and lower semicontinuous.

Based on Assumption 4, we know that the max function Φ( x ) is ( κ +1) ℓ -smooth, where κ = ℓ/µ ≥ 1 is the condition number, which plays a key role in our analysis. Note that there are two main differences between our ZO-GDEGA for solving NC-SC and NC-C problems as follows:

Due to the strong concavity, there is no need to use the intermediate point z t to update x t +1 , but directly use the ZO estimators at the point ( x t , y t ) to accelerate updating, which contributes to achieve competitive complexity under weaker restrictions on µ 1 and µ 2 , thereby enhancing robustness.

The solution set Y ∗ ( x ) is a singleton, which consists of a single element y ∗ ( x ) , thus we can use the quantity δ t := ∥ y t -y ∗ ( x t ) ∥ 2 to measure the quality of proximal ZO extragradient ascent steps.

In summary, we propose a unified ZO algorithm for solving black-box NC minimax problems, which outperforms existing ZO algorithms. Next, we rigorously analyze its complexity.

5 Theoretical Analysis

In this section, we first define two types of generalized ϵ -stationary points as termination criteria. Then, we provide the complexity results of our ZO-GDEGA to find an ϵ -stationary point.

5.1 Termination Criteria

We generalize two classical definitions of ϵ -stationary point in [31] and [32] as follows.

Definition 2. In the NC-C setting, a point x is an ϵ -stationary point of an ℓ -weakly convex function ψ if its Moreau envelope 2 ψ 1 / 2 ℓ ( x ) satisfies ∥∇ ψ 1 / 2 ℓ ( x ) ∥ ≤ ϵ ; In the NC-SC setting, a point x is an ϵ -stationary point of a function ψ if dist (0 , ∂ψ ( x )) ≤ ϵ .

Definition 3. A pair of points ( x, y ) is an ϵ -stationary point of the coupling function f if we have

Based on [31, Proposition 4.11 and 4.12], the following two propositions clarify the relationship between the generalized Definitions 2 and 3.

Proposition 1. Under Assumptions 1 and 2, if a point (ˆ x, ˆ y ) is an ϵ 2 / ( ℓD h ) -stationary point in terms of Definition 3, a point ˆ x is an O ( ϵ ) -stationary point in terms of Definition 2.

Proposition 2. Under Assumption 4, if a point (ˆ x, ˆ y ) is an ϵ/κ -stationary point in terms of Definition 3, a point ˆ x is an O ( ϵ ) -stationary point in terms of Definition 2.

Thus, we can draw a similar conclusion as in [31]: The ϵ -stationary point definition of ψ is stronger than that of f . To obtain tighter complexity bounds, we analyze ZO algorithms for the first time based on ϵ -stationary point definition of ψ (i.e., Definition 2).

5.2 Complexity Analysis for NC-SC Problems

We first analyze the complexity of ZO-GDEGA for the NC-SC setting in deterministic and stochastic cases. Our analysis is a non-trivial extension of the proofs in [31] due to the following challenges.

Key technical challenges. In this case, bounding ∑ T t =0 δ t is a key step. But the proximal operators and the ZO EG structure make it much more difficult to bound this term than existing works. To address this challenge, we propose to establish the upper bound on ∑ T t =0 δ t in terms of ∑ T i =0 ∥ x i -x i +1 ∥ 2 (see the Appendix for details), which also reduces the overall complexity's dependence on κ , and results in the coefficients of µ 2 1 and µ 2 2 being only O (1) and O ( κ ) , thereby weakening their dependence on κ and enhancing robustness. Here we directly give the complexity results.

Theorem 1. We choose stepsizes η x ≤ 1 256 κ 2 ℓ , η y = 1 2 ℓ , µ 1 = O ( d -1 x ϵ ) and µ 2 = O ( κ -1 / 2 d -1 y ϵ ) . Under Assumption 4, our ZO-GDEGA can find an ϵ -stationary point in terms of Definition 2, i.e., min 1 ≤ t ≤ T dist ( -∂g ( x t ) , ∇ Φ( x t )) ≤ ϵ , with the overall ZO oracle complexity O ( κ 2 ( d x + d y ) ϵ -2 ) for deterministic and O ( κ 2 ( d x + κd y ) ϵ -4 ) for stochastic settings.

Theorem 1 shows that ZO-GDEGA allows for larger µ 1 and µ 2 than compared algorithms (see Table 1), which means that our algorithms can tolerate rougher ZO estimations. Besides, our complexity bounds have the weaker κ dependence than them. Thus, even our by-products have some advantages. Moreover, this analysis also builds a bridge for analyzing the NC-C setting.

5.3 Complexity Analysis for NC-C Problems

In this part, we analyze ZO-GDEGA in the NC-C setting. We provides two perspectives: continuityagnostic (more relaxed condition) and continuity-dependent (better bound) analysis.

5.3.1 Continuity-Agnostic Complexity Analysis.

We first analyze the complexity for the NC-C setting based on Theorem 1 and smooth technology in [38]. By adding a smoothing term, we approximate the NC-C problem (1) with the following NC-SC model: min x max y { ˆ Ψ( x, y ) = g ( x ) + ˆ f ( x, y ) -h ( y ) } , where ˆ f ( x, y ) = f ( x, y ) -ˆ µ 2 ∥ y -ˆ y ∥ 2 and given arbitrary ˆ y ∈ dom h . Based on Theorem 1 and careful selection of ˆ µ , Theorem 2 ensures that ZO-GDEGA can find an ϵ -stationary point for the NC-C problem (1).

Theorem 2. Under Assumptions 1 and 2, our ZO-GDEGA applied to the approximate NC-SC model with ˆ µ = O ( ϵ 2 / ( ℓD 2 h )) , can guarantee to generate an ϵ -stationary point x ϵ for the NC-C problem (1), i.e., E ∥∇ ψ 1 / 2 ℓ ( x ϵ ) ∥ ≤ ϵ , with overall complexity O (( d x + d y ) ϵ -6 ) and O ( d x ϵ -8 + d y ϵ -10 ) for the deterministic and stochastic settings, respectively.

Based on stronger Definition 2, Theorem 2 ensures that our ZO-GDEGA can achieve lower complexity for NC-C problems without relying on any extra assumptions, such as continuity and decreasing sequence assumptions, whereas [50, 51] depend on at least one of them. Besides, Theorem 2 inherits the advantages of our analysis for Theorem 1, i.e., enhancing robustness and reducing complexity.

5.3.2 Better Bounds with Continuity-dependent.

We also analyze our ZO-GDEGA algorithm for solving the NC-C problem (1) under the Lipschitz continuity assumption, which is common in NC-C optimization such as [31, 35, 43, 4].

Assumption 5 (Continuity) . f ( x, y ) is G -Lipschitz continuous in x , i.e., for ∀ y ∈ dom h , ∀ x, x ′ ∈ R d x satisfies that ∥ f ( x, y ) -f ( x ′ , y ) ∥ ≤ G ∥ x -x ′ ∥ .

In the case of (ii) in Table 1, Assumption 5 follows immediately by the smoothness and choosing G = ℓ ( D X + D Y ) + ∥∇ x f ( x ϵ , y ϵ ) ∥ , where max x,x ′ ∈X ∥ x -x ′ ∥ ≤ D X and max y,y ′ ∈Y ∥ y -y ′ ∥ ≤ D Y . Thus, ZO-GDEGA still work without Assumption 5 in this case. For the general problem (1), we use G for generalization and give a proof sketch. Detailed proofs are provided in the Appendix.

Proof sketch. We first analyze the recursive relationship between the Moreau envelopes ψ 1 / 2 ℓ ( x t ) and ψ 1 / 2 ℓ ( x t +1 ) based on the ZO gradient descent step. Then, we estimate the tricky error term ∆ t = Φ( x t ) -Γ( x t , z t ) to measure the upper bound of the ZO EG ascent steps. Based on these results, we obtain the overall complexity for solving the NC-C problem (1). In deterministic and stochastic settings, we provide tighter results than Theorem 2, respectively.

Deterministic Setting. Lemma B.13 provides the recursive relationship between ψ 1 / 2 ℓ ( x t +1 ) and ψ 1 / 2 ℓ ( x t ) . Our algorithms use more concise ZO estimation gradient descent step instead of EG structure to update x . Thus, the tricky term ∥∇ x f ( x t , y t ) -∇ x f ( x t -1 , y t -1 ) ∥ 2 can be removed in our analysis compared

Proximal EG Ascent

Proximal EG Descent

2

1

1

(

,

)

(

,

)

x

t

t

x

t

t

f

x

y

f

x

y

-

-

∇

-∇

Our ZO-GDEGA

First-order EG (Mahdavinia et al., 2022)

1

𝑇𝑇

+1

�

𝑡𝑡=0

𝑇𝑇

‖𝛻𝛻𝛻1

/

2ℓ

𝑥𝑥

𝑡𝑡

‖ 2

≤ 𝜖𝜖

2

1

𝑇𝑇

+1

�

𝑡𝑡=0

𝑇𝑇

‖𝛻𝛻𝜓𝜓1

/

2ℓ

𝑥𝑥

𝑡𝑡

‖ 2

≤ 𝜖𝜖

2

𝛻1

/

2ℓ

𝑥𝑥

𝑡𝑡+1

≤ 𝛻1

/

2ℓ

𝑥𝑥

𝑡𝑡

+…

𝜓𝜓1

/

2ℓ

𝑥𝑥

𝑡𝑡+1

≤ 𝜓𝜓1

/

2ℓ

𝑥𝑥

𝑡𝑡

+…

Δ𝑡𝑡+1

=

𝛻

(

𝑥𝑥

𝑡𝑡+

1

2

)

-𝑓𝑓

(

𝑥𝑥

𝑡𝑡+

1

2

,

𝑦𝑦

𝑡𝑡+

1

2

)

Δ𝑡𝑡+1

=

𝛻 𝑥𝑥𝑡𝑡+1

-Γ

(

𝑥𝑥

𝑡𝑡+1

,

𝑧𝑧

𝑡𝑡+1

)

ˆ

(

,

)

y

f

x

y

∇

2

(

,

)

y

f

x

y

µ

∇

(

,

)

y

f

x

y

∇

ˆ

(

,

)

x

f

x

y

∇

1

(

,

)

x

f

x

y

µ

∇

(

,

)

x

f

x

y

∇

with the standard EG method in [35] as shown in Fig. 1. Lemma B.15 proves that ∑ T t =0 E [∆ t ] can be well controlled by carefully choosing η y . More importantly, our analysis makes the coefficients of µ 2 1 and µ 2 2 independent of ϵ , which eases their dependence on ϵ compared with [51], thereby enhancing the robustness. Now, we begin to provide tighter results.

Theorem 3. Under Assumptions 1, 2 and 5, if q 1 = d x , q 2 = d y , η y =1 / ( √ 3 ℓ ) , η x = O ( ϵ 4 ) , µ 1 = O ( ϵ √ d x ) and µ 2 = O ( ϵ √ d y ) , our deterministic ZO-GDEGA can find an ϵ -stationary point of ψ , i.e.,

1 T +1 ∑ T t =0 E ∥∇ ψ 1 / 2 ℓ ( x t ) ∥≤ ϵ , for the NC-C setting with the overall complexity O (( d x + d y ) ϵ -6 ) .

Theorem 3 shows that our ZO-GDEGA achieves the same overall complexity as Theorem 2 and further weakens the constraints on smoothing parameters under the continuity assumption. Note that ZO-GDEGA is the first ZO algorithm with convergence guarantees to find an ϵ -stationary point of ψ . Meanwhile, our analysis can be easily extended to the stochastic setting.

Stochastic Setting. Due to the page limit, we directly provide results for stochastic ZO-GDEGA.

Theorem 4. Under assumptions 1, 2, 3 and 5, if we choose the suitable parameters such as µ 1 = O ( ϵ ) and µ 2 = O ( ϵ ) , our stochastic ZO-GDEGA algorithm can find an ϵ -stationary point in terms of Definition 2 with lower overall complexity O ( d x ϵ -6 + d y ϵ -8 ) than Theorem 2.

Theorem 4 shows that the overall complexity can be further reduced, and we can still choose µ 1 and µ 2 to be O ( ϵ ) to enhance the robustness. Note that we provide theoretical guarantees for the stochastic black-box NC-C setting for the first time. In summary, our ZO-GDEGA shows excellent theoretical properties for solving NC-C problems and competitiveness for solving NC-SC problems.

6 Experiments

In this section, we conduct black-box data poisoning attack and AUC maximization experiments. Due to the page limit, more experimental details and results are provided in the Appendix. Our codes are available: https://github.com/Weixin-An/ZO-GDEGA.

6.1 Data Poisoning Attack

Data poisoning attack is one of the most common black-box attack methods [29, 42]. The purpose of the attacker is: when the model parameter w is well-trained, adding a perturbation δ on the training data that makes the loss functions as large as possible, and then such poisoned training data

10 0

10 1

10 2

10 3

10 4

Number of iterations

0

1

2

3

4

Stationary gap

(

t

,

)

FO-AGP

ZO-AGP: q=5

ZO-GDEGA: q=5 (Ours)

ZO-GDEGA: q=20 (Ours)

10 0

10 1

10 2

10 3

10 4

Number of iterations

5

4

3

2

1

0

Objective value

f

1(

t

,

)

FO-AGP

No Poison

ZO-AGP: q=5

ZO-GDEGA: q=5 (Ours)

ZO-GDEGA: q=20 (Ours)

10 0

10 1

10 2

10 3

10 4

Number of iterations

0.75

0.80

0.85

0.90

0.95

1.00

Training accuracy

FO-AGP

No Poison

ZO-AGP: q=5

ZO-GDEGA: q=5 (Ours)

ZO-GDEGA: q=20 (Ours)

10 0

10 1

10 2

10 3

10 4

Number of iterations

0.65

0.70

0.75

0.80

0.85

0.90

0.95

Testing accuracy

FO-AGP

No Poison

ZO-AGP: q=5

ZO-GDEGA: q=5 (Ours)

ZO-GDEGA: q=20 (Ours)

0

50

100

150

200

250

CPU time (seconds)

0.70

0.75

0.80

0.85

0.90

Testing accuracy

ZO-AGP: q=5

ZO-GDEGA: q=5 (Ours)

ZO-GDEGA: q=20 (Ours)

5

10

15

20

Poisoning ratio (%)

0.60

0.65

0.70

0.75

0.80

0.85

0.90

Testing accuracy

ZO-AGP

ZO-GDEGA (Ours)

10 0

10 1

10 2

10 3

10 4

Number of iterations

0.65

0.70

0.75

0.80

0.85

0.90

Training accuracy

No Poison

ZO-AGP: q=5

ZO-GDEGA: q=5 (Ours)

ZO-GDEGA: q=20 (Ours)

10 0

10 1

10 2

10 3

10 4

Number of iterations

0.65

0.70

0.75

0.80

0.85

Testing accuracy

No Poison

ZO-AGP: q=5

ZO-GDEGA: q=5 (Ours)

ZO-GDEGA: q=20 (Ours)

0

200

400

600

800

0.650

0.675

0.700

0.725

0.750

0.775

0.800

0.825

Testing accuracy

ZO-AGP: q=5

ZO-GDEGA: q=5 (Ours)

ZO-GDEGA: q=20 (Ours)

CPU time (seconds)

( s i + δ, t i ) will reduce the model accuracy. Therefore, it is usually required for attackers to optimize the following objective function,

where D tr ≜ D tr,p ∪ D tr,c denotes the training dataset including n i.i.d samples, D tr,p and D tr,c denote the poisoned and clean subsets of D tr , respectively. We choose the cross-entropy loss to optimize δ and w . Note that Problem (5) can be rewritten as the NC-C (1) by setting g ( · ) = I ∥ δ ∥ ∞ ≤ r x ( · ) , h ( · ) ≡ 0 , and f = -f 1 . Therefore, it can be solved by our ZO-GDEGA algorithm.

Datasets. We validate ZO-GDEGA on a synthetic dataset and the epsilon_test dataset.

Synthetic datasets: We generate a dataset D = { s i , t i } 2 , 000 i =1 with feature vector s i ∈ R 100 from Gaussian distribution N (0 , I ) and split it into 70% training and 30% test samples. The label t i = 1 if 1 / (1 + e -( s ⊤ i w ∗ + n i ) ) > 0 . 5 , otherwise t i = 0 , where n i ∈ N (0 , 10 -3 ) is random noise, and we set w ∗ = 1 as the ground truth.

The epsilon_test dataset 3 : It contains 100,000 samples of 2,000 dimensions, and we also split it into 70% training samples and 30% testing samples.

Experimental Settings & Baselines. We set r x = 2 , µ 1 = µ 2 = 2 × 10 -5 and poisoning ratio |D tr,p | / |D tr | = 0 . 1 , and choose mini-batch size b 1 = b 2 = 100 and b 1 = b 2 = 10 for the synthetic and epsilon_test datasets, respectively. The baseline for solving Problem (5) is ZO-AGP. Note that here we replace the ZO estimators in deterministic ZO-AGP with corresponding stochastic versions and choose the same hyperparameter settings for a fair comparison.

Results. We use the poisoned data generated by the baselines and our ZO-GDEGA to attack the training procedure of the logistic regression model, and the experimental results on the synthetic

and epsilon_test datasets are shown in Figs. 2 and 3, respectively. The experiment in each case was carried out in 10 independent trials with random initialization and the shaded area around the line indicates the standard deviation. From Fig. 2, we find that our ZO-GDEGA can converge faster than baselines in terms of stationary gap and objective value -f 1 . From the training accuracy subfigure, both our ZO-GDEGA and the baselines (black-box attack) converge, and achieve nearoptimal solution compared to the FO-AGP algorithm (white-box attack) [52]. As for testing accuracy, it can be seen that compared with ZO-AGP, the poisoned data generated by our ZO-GDEGA are always more effective in reducing the accuracy of the logistic regression model in terms of both iterations and CPU time, which also confirms that our ZO-GDEGA achieves lower complexity than ZO-AGP. Besides, under different poisoning ratios, ZO-GDEGA can reduce the model accuracy by 2.1%-7.6% than ZO-AGP in terms of attack performance. From Fig. 3, we observe that ZO-GDEGA algorithm also performs about 8.0% lower than ZO-AGP on the epsilon_test dataset, which further verifies the superiority of our algorithm in the large-scale real-world datasets.

6.2 AUC Maximization

AUC is defined as the area under the ROC curve, which is a performance indicator to measure the pros and cons of a machine learning model. However, it is generally difficult to optimize the AUC value directly on the training task, but instead optimize the following minimax problem:

where r x and r y are the radius of the projection balls, s = ( s, t ) is drawn independently from the distribution P , and f ( θ, a, b, v ; s ) is defined as in [53]. When we choose the multilayer perception (MLP) model, Problem (6) becomes a NC-SC problem. The non-differentiable point of the nonlinear function such as ReLU causes some non-differentiable modules of the classifier, and the ZO algorithms are one of the techniques to solve this issue [15]. Note that our ZO-GDEGA is the first ZO algorithm to attempt to solve the AUC maximization problem.

Experimental Settings & Baselines. We conduct experiments on the MNIST , Fashion-MNIST and ijcnn1 datasets. Following [54], we use their training and testing sets but convert the classes of the data into two classes by randomly splitting them into two groups. We implement ZO-SGDA [47], ZO-Min-Max [33], Acc-ZOMDA [19] and our ZO-GDEGA to solve Problem (6) with Leaky ReLU. We choose a

two-layer MLP as the classification model, and set mini-batch b 1 = b 2 = 256 , q 1 = q 2 = 10 , r x = r y = 2 and step sizes η x = η y = 0 . 1 to train all the methods for 200 epochs.

Results. Weshow the average AUC performance from 10 independent trials with random initialization in Table 2. It shows that at small µ 1 and µ 2 , our ZO-GDEGA algorithms perform competitively compared with the baselines. At larger µ 1 and µ 2 , ZO-GDEGA can improve AUC performance by 0.4-5.4 units than baselines, which indicates that our algorithms are more robust to smoothing parameters and robustness may be more important than overall complexity in some cases when using ZO oracle to approximate gradients.

7 Conclusions and Future Work

In this paper, we proposed a unified ZO-GDEGA algorithm for solving black-box nonconvex minimax problems, which reduces the overall complexity and improves robustness. The experimental results match our theoretical analysis, which is reflected by the fact that ZO-GDEGA can obtain more effective attacks and improve AUC performance robustly. In summary, ZO-GDEGA achieves better performance than related algorithms and promotes the development of ZO optimization theory. In the future, we will extend our algorithm to non-smooth and federated learning settings as in [45, 44].

8 Acknowledgments

We want to thank the anonymous reviewers for their valuable suggestions and comments. This work was supported by the National Key Research and Development Program of China (No. 2023YFF0906204), National Natural Science Foundation of China (No. 62276182), and Peng Cheng Lab Program (No. PCL2023A08).

References

K Antonakopoulos. Adaptive extra-gradient methods for min-max optimization and games. In International Conference on Learning Representations , volume 3, page 7, 2021.

Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial networks. In Proceedings of the 34th International Conference on Machine Learning , volume 70, pages 214-223, 2017.

Amir Beck and Marc Teboulle. A fast iterative shrinkage-thresholding algorithm for linear inverse problems. Siam J Imaging Sciences , 2(1):183-202, 2009.

Radu Ioan Bo¸ t and Axel Böhm. Alternating proximal-gradient steps for (stochastic) nonconvexconcave minimax problems. SIAM Journal on Optimization , 33(3):1884-1913, 2023.

Stephen P Boyd and Lieven Vandenberghe. Convex optimization . Cambridge university press, 2004.

Antonin Chambolle and Thomas Pock. A first-order primal-dual algorithm for convex problems with applications to imaging. Journal of mathematical imaging and vision , 40:120-145, 2011.

Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM workshop on artificial intelligence and security , pages 15-26, 2017.

Yunmei Chen, Guanghui Lan, and Yuyuan Ouyang. Accelerated schemes for a class of variational inequalities. Mathematical Programming , 165:113-149, 2017.

Jelena Diakonikolas and Lorenzo Orecchia. Accelerated extra-gradient descent: A novel accelerated first-order method. In 9th Innovations in Theoretical Computer Science Conference (ITCS 2018) , volume 94, 2018.

Dmitriy Drusvyatskiy and Adrian S. Lewis. Error bounds, quadratic growth, and linear convergence of proximal methods. Mathematics of Operations Research , page moor.2017.0889, 2016.

John Duchi and Yoram Singer. Efficient online and batch learning using forward backward splitting. Journal of Machine Learning Research , 10(18):2899-2934, 2009.

John C Duchi, Michael I Jordan, Martin J Wainwright, and Andre Wibisono. Optimal rates for zero-order convex optimization: The power of two function evaluations. IEEE Transactions on Information Theory , 61(5):2788-2806, 2015.

Chris Finlay and Adam M Oberman. Scaleable input gradient regularization for adversarial robustness. Machine Learning with Applications , 3:100017, 2021.

Xiang Gao, Bo Jiang, and Shuzhong Zhang. On the information-adaptive variants of the admm: an iteration complexity perspective. Journal of Scientific Computing , 76:327-363, 2018.

Daniel Golovin, John Karro, Greg Kochanski, Chansoo Lee, Xingyou Song, and Qiuyi Zhang. Gradientless descent: High-dimensional zeroth-order optimization. In International Conference on Learning Representations , 2019.

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014.

Ishaan Gulrajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C Courville. Improved training of wasserstein gans. Advances in neural information processing systems , 30, 2017.

E Hairer, SP Nørsett, and G Wanner. Solving ordinary differential equations i: Nonstiff problems, 1993.

Feihu Huang, Shangqian Gao, Jian Pei, and Heng Huang. Accelerated zeroth-order and first-order momentum methods from mini to minimax optimization. The Journal of Machine Learning Research , 23(1):1616-1685, 2022.

Feihu Huang, Xidong Wu, and Zhengmian Hu. Adagda: Faster adaptive gradient descent ascent methods for minimax optimization. In International Conference on Artificial Intelligence and Statistics , pages 2365-2389. PMLR, 2023.

Feihu Huang, Xidong Wu, and Heng Huang. Efficient mirror descent ascent methods for nonsmooth minimax problems. Advances in Neural Information Processing Systems , 34:1043110443, 2021.

Andrew Ilyas, Logan Engstrom, and Aleksander Madry. Prior convictions: Black-box adversarial attacks with bandits and priors. In International Conference on Learning Representations , number 2019, 2019.

Samy Jelassi, Carles Domingo-Enrich, Damien Scieur, Arthur Mensch, and Joan Bruna. Extragradient with player sampling for faster nash equilibrium finding. In Proceedings of the International Conference on Machine Learning , 2020.

Kaiyi Ji, Zhe Wang, Yi Zhou, and Yingbin Liang. Improved zeroth-order variance reduced algorithms and analysis for nonconvex optimization. In International conference on machine learning , pages 3100-3109, 2019.

Chi Jin, Praneeth Netrapalli, and Michael Jordan. What is local optimality in nonconvexnonconcave minimax optimization? In International conference on machine learning , pages 4880-4889. PMLR, 2020.

Anatoli Juditsky, Arkadi Nemirovski, and Claire Tauvel. Solving variational inequalities with stochastic mirror-prox algorithm. Stochastic Systems , 1(1):17-58, 2011.

Galina M Korpelevich. The extragradient method for finding saddle points and other problems. Matecon , 12:747-756, 1976.

Jeffrey Larson, Matt Menickelly, and Stefan M Wild. Derivative-free optimization methods. Acta Numerica , 28(2010), 2019.

Bo Li, Yining Wang, Aarti Singh, and Yevgeniy Vorobeychik. Data poisoning attacks on factorization-based collaborative filtering. Advances in neural information processing systems , 29, 2016.

Haochuan Li, Yi Tian, Jingzhao Zhang, and Ali Jadbabaie. Complexity lower bounds for nonconvex-strongly-concave min-max optimization. Advances in Neural Information Processing Systems , 34:1792-1804, 2021.

Tianyi Lin, Chi Jin, and Michael Jordan. On gradient descent ascent for nonconvex-concave minimax problems. In International Conference on Machine Learning , pages 6083-6093, 2020.

Tianyi Lin, Chi Jin, and Michael I Jordan. Near-optimal algorithms for minimax optimization. In Conference on Learning Theory , pages 2738-2779, 2020.

Sijia Liu, Songtao Lu, Xiangyi Chen, Yao Feng, Kaidi Xu, Abdullah Al-Dujaili, Mingyi Hong, and Una-May O'Reilly. Min-max optimization without gradients: Convergence and applications to black-box evasion and poisoning attacks. In International conference on machine learning , pages 6282-6293, 2020.

Luo Luo, Haishan Ye, Zhichao Huang, and Tong Zhang. Stochastic recursive gradient descent ascent for stochastic nonconvex-strongly-concave minimax problems. Advances in Neural Information Processing Systems , 33:20566-20577, 2020.

P Mahdavinia, Y Deng, H Li, and M Mahdavi. Tight analysis of extra-gradient and optimistic gradient methods for nonconvex minimax problems. Neural Information Processing Systems , 2022.

Aryan Mokhtari, Asuman E Ozdaglar, and Sarath Pattathil. Convergence rate of o(1/k) for optimistic gradient and extragradient methods in smooth convex-concave saddle point problems. SIAM Journal on Optimization , 30(4):3230-3251, 2020.

Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Jonathan Uesato, and Pascal Frossard. Robustness via curvature regularization, and vice versa. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 9078-9086, 2019.

Yu Nesterov. Smooth minimization of non-smooth functions. Mathematical programming , 103:127-152, 2005.

Yurii Nesterov and Vladimir Spokoiny. Random gradient-free minimization of convex functions. Foundations of Computational Mathematics , 17(2):527-566, 2017.

Trong Phong Nguyen, Edouard Pauwels, Emile Richard, and Bruce W Suter. Extragradient method in optimization: Convergence and complexity. Journal of Optimization Theory and Applications , 176:137-162, 2018.

Yuyuan Ouyang and Yangyang Xu. Lower complexity bounds of first-order methods for convex-concave bilinear saddle-point problems. Mathematical Programming , 185(1):1-35, 2021.

Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference on computer and communications security , pages 506-519, 2017.

Hassan Rafique, Mingrui Liu, Qihang Lin, and Tianbao Yang. Weakly-convex-concave minmax optimization: provable algorithms and applications in machine learning. Optimization Methods and Software , 37(3):1087-1121, 2022.

Marco Rando, Cesare Molinari, Lorenzo Rosasco, and Silvia Villa. An optimal structured zerothorder algorithm for non-smooth optimization. Advances in Neural Information Processing Systems , 36, 2024.

Pranay Sharma, Rohan Panda, Gauri Joshi, and Pramod Varshney. Federated minimax optimization: Improved convergence analyses and algorithms. In International Conference on Machine Learning , pages 19683-19730. PMLR, 2022.

Adam Slowik and Halina Kwasnicka. Evolutionary algorithms and their applications to engineering problems. Neural Computing and Applications , 32:12363-12379, 2020.

Zhongruo Wang, Krishnakumar Balasubramanian, Shiqian Ma, and Meisam Razaviyayn. Zerothorder algorithms for nonconvex-strongly-concave minimax problems with improved complexities. Journal of Global Optimization , pages 1-32, 2022.

Lin Xiao and Tong Zhang. A proximal stochastic gradient method with progressive variance reduction. Siam Journal on Optimization , 24(4), 2014.

Tengyu Xu, Zhe Wang, Yingbin Liang, and H Vincent Poor. Enhanced first and zeroth order variance reduced algorithms for min-max optimization. 2020.

Zi Xu, Jingjing Shen, Ziqi Wang, and Yuhong Dai. Zeroth-order alternating randomized gradient projection algorithms for general nonconvex-concave minimax problems. arXiv preprint arXiv:2108.00473 , 2021.

Zi Xu, Ziqi Wang, Jingjing Shen, and Yuhong Dai. Derivative-free alternating projection algorithms for general nonconvex-concave minimax problems. SIAM Journal on Optimization , 34(2):1879-1908, 2024.

Zi Xu, Huiling Zhang, Yang Xu, and Guanghui Lan. A unified single-loop alternating gradient projection algorithm for nonconvex-concave and convex-nonconcave minimax problems. Mathematical Programming , pages 1-72, 2023.

Zhenhuan Yang, Shu Hu, Yunwen Lei, Kush R Vashney, Siwei Lyu, and Yiming Ying. Differentially private sgda for minimax problems. In Uncertainty in Artificial Intelligence , pages 2192-2202, 2022.

Yiming Ying, Longyin Wen, and Siwei Lyu. Stochastic online auc maximization. In D. Lee, M. Sugiyama, U. Luxburg, I. Guyon, and R. Garnett, editors, Advances in Neural Information Processing Systems , volume 29. Curran Associates, Inc., 2016.

Guodong Zhang, Yuanhao Wang, Laurent Lessard, and Roger B Grosse. Near-optimal local convergence of alternating gradient descent-ascent for minimax optimization. In International Conference on Artificial Intelligence and Statistics , pages 7659-7679, 2022.

Hualin Zhang, Huan Xiong, and Bin Gu. Zeroth-order negative curvature finding: Escaping saddle points without gradients. Advances in Neural Information Processing Systems , 35:3833238344, 2022.

Jiawei Zhang, Peijun Xiao, Ruoyu Sun, and Zhiquan Luo. A single-loop smoothed gradient descent-ascent algorithm for nonconvex-concave min-max problems. Advances in neural information processing systems , 33:7377-7389, 2020.

Junyu Zhang, Mingyi Hong, and Shuzhong Zhang. On lower iteration complexity bounds for the convex concave saddle point problems. Mathematical Programming , 194(1):901-935, 2022.

Siqi Zhang, Junchi Yang, Cristóbal Guzmán, Negar Kiyavash, and Niao He. The complexity of nonconvex-strongly-concave minimax optimization. In Uncertainty in Artificial Intelligence , pages 482-492. PMLR, 2021.

Xuan Zhang, Necdet Serhat Aybat, and Mert Gurbuzbalaban. Sapd+: An accelerated stochastic method for nonconvex-concave minimax problems. Advances in Neural Information Processing Systems , 35:21668-21681, 2022.

Yimeng Zhang, Yuguang Yao, Jinghan Jia, Jinfeng Yi, Mingyi Hong, Shiyu Chang, and Sijia Liu. How to robustify black-box ml models? a zeroth-order optimization perspective. In International Conference on Learning Representations , 2022.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: See the sections Abstract and Introduction.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: See the sections Experiments, Conclusions and Future Work.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: Please see the section Theoretical Analysis.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: Please see the section Experiments.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: Please see the section Experiments.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines (https://nips.cc/public/ guides/CodeSubmissionPolicy) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: //nips.cc/public/guides/CodeSubmissionPolicy) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: Please see the section Experiments.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: Please see the section Experiments.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: Please see the section Experiments.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines?

Answer: [Yes]

Justification:

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [NA]

Justification: This work is of a theoretical nature. The main contribution is to improve robustness and reduce complexity. There are no positive and negative societal impacts from this work, and as a result we did not discuss it.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification:

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: We used public datasets.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [Yes]

Justification: We describe the data generation method in detail in the experiments.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification:

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification:

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nIn this paper, a unified single-loop zeroth-order gradient descent extragradient ascent (ZO-GDEGA) algorithm to solve the nonconvex-concave minimax problem faster and more robustly. The theoretical analysis is provided to guarantee an overall complexity of $O(\\epsilon^{-6})$. The experimental results on the data poisoning attack task and the AUC maximization task are shown to validate the practical performance of the proposed method.\n\nSTRENGTHS:\n1. In this paper, the authors propose a zeroth-order algorithm that achieves lower complexity under the nonconvex-concave condition.\n2. The first convergence analysis of stochastic zeroth-order algorithm under the nonconvex-concave condition is provided.\n3. For nonconvex strongly-concave problems, the complexity with respect to the condition number is improved.\n\nWEAKNESSES:\n1. In section 2 related work, the complexity of first-order minimax algorithms is not discussed. To my understanding, the error of the zeroth-order gradient can be bounded by parameters $\\mu_1$ and $\\mu_2$ that are set as small as $O(\\epsilon)$. Therefore, the analysis should not change a lot based on the analysis of the first-order counterpart, which probably undermines the novelty and contribution.\n2. In ref [18] (Huang et al 2022), variance reduction is used to improve the complexity with respect to $\\epsilon$. The contribution of this paper will be further stronger if this part is also considered.\n3. The figures in the experiments section is too small and some curves are covered by the legends. I understand the space is limited but maybe some sections could be rearranged to the Appendix.\n\nQUESTIONS:\n1. Please see weakness [1]. Can you provide more details to explain how the zeroth-order gradient estimator makes the original analysis of the first-order method more challenging?\n2. Is it possible to further reduce the complexity with respect to $\\epsilon$ for the NC-C problem by integrating variance reduction with the proposed ZO-GDEGA algorithm?\n\nLIMITATIONS:\nI did not see any negative societal impact.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-01"}

comments: SUMMARY:
They design a new unified ZO gradient descent extragradient ascent (ZO-GDEGA) algorithm, which reduces the overall complexity to find an ε-stationary point of the function ψ for nonconvex-concave (NC-C) problems. ZO-GDEGA is the first ZO algorithm with complexity guarantees to solve stochastic NC-C problems.

STRENGTHS:
The theoretical section is very thorough and comprehensive.

WEAKNESSES:
(1)The paper lacks detailed link of code implementation.
(2)While the paper effectively addresses the NC-C problem from a theoretical perspective, it should also provide more experimental details and demonstrate that the NC-C problem exists within the experimental models.

QUESTIONS:
See in the Weakness part

LIMITATIONS:
None
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2024-07-08

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper studies zeroth-order methods for nonconvex-(strongly)-concave minimax optimization. The achieved rates improve previous results and tolerate much larger choice of the smoothing parameters. The proposed methods also perform well for some empirical tasks.\n\nSTRENGTHS:\nMinimax optimization is an important problem that has many applications in machine learning and related areas. In many settings, gradients are hard to estimate or impossible to obtain, which motivates the study of zeroth-order methods. Moreover, nonconvex-concave minimax is itself a class of nonconvex nonsmooth optimization, which is considered as challenge problems in the related literature. The paper proposes new algorithms with improved convergence results compared with previous work for this challenge class of the problem.\n\nWEAKNESSES:\n1. I think a discussion on lower bounds can improve the understanding and position of this work. For example, lower bounds on zeroth-order methods justify the dependence on the dimension is inevitable without additional assumptions [1]. This, together with lower bounds for minimax optimization, e.g., [2], provide lower bounds for the considered problem class, which suggest the foundamental limits of this problem and whether the complexity can be further improved.\n\n2. A discussion of the best known upper bounds for first-order methods could also help. As far as I know, the best rate for first-order nonconvex-concave minimax optimization is also $\\epsilon^{-6}$ [3]. The authors can do some additional literature review and check whether my statement is correct. As the complexity of zeroth-order methods is usually d times that of first-order methods, this suggests the results in this paper match the state-of-the-arts. For nonconvex-strongly-concave minimax optimization, [3] achieves a rate of $\\kappa\\epsilon^{-4}$, which suggests that the upper bounds in this paper can possibly be improved.\n\n3. Have the authors considered to use two-point estimators to construct zeroth-order gradient estiimators? In some cases, two-point estimators give better rates [4]. The paper mentions that for the NC-SC case there is no need to use $z_t$ to update $x_{t+1}$ but $y_t$ instead. However, there is $z_t$ involved in the update of $y_t$. Are there any typos in the statement of the algorithm? Also, I suggest to add dimension in the complexity stated in the abstract. Otherwise, this could be misleading.\n\nI did not have time to carefully check every step in the proof. If the results are correct, I think they make enough contributions to the related literature. Therefore, I will keep a low confidence score.\n\nReferences\n\n[1] Optimal rates for zero-order convex optimization: The power of two function evaluations. IEEE Transactions on Information Theory, 2015.\n\n[2] The complexity of nonconvex-strongly-concave minimax optimization. UAI, 2021.\n\n[3] SAPD+: An Accelerated Stochastic Method for Nonconvex-Concave Minimax Problems. NeurIPS, 2022.\n\n[4] An optimal algorithm for bandit and zero-order convex optimization with two-point feedback. JMLR, 2017.\n\nQUESTIONS:\nSee weaknesses.\n\nLIMITATIONS:\nSee weaknesses.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-12"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes zeroth-order method called ZO-GDEGA to find a near-stationary point for nonconvex-concave minimax optimization, with complexity guarantee. The proposed method is also extended to stochastic setting, being the first work on ZO method on stochastic NC-C problem. The method has weaker requirement on ZO gradient estimate, thus also has better dependency on condition number in the special case of NC-SC. Numerical results on data poisoning attack and AUC maximization show the proposed method is comparable and usually slightly better than compared baselines.\n\nSTRENGTHS:\n1. This work designs a unified single-loop ZO method for NC-C minimax, with better complexity and more robust allowance on ZO gradient estimate. The proposed idea of continuous-time dynamics to assist with updates of dual variable and its related analysis is novel. Overall complexity is proposed, with solid and rigorous proof, under weak assumptions such as not requiring lipschitz continuity, more tolerant ZO gradient, which also results in good complexity in the NC-SC special case.\n\n2. The proposed method can be extended to stochastic setting, with first-ever complexity in this case.\n\nWEAKNESSES:\n1. Complexity (deterministic NC-C): The work claims the $O(d\\epsilon^{-6})$ complexity of the proposed method is a 'reduced' complexity, however to the best of my knowledge, this is not the best-known complexity of ZO method on NC-C minimax. Even for single-loop methods, the existing method in [43] shown by table 1 has a better $O(d\\epsilon^{-4})$ complexity. Intuitively, only a complexity as good as this existing $O(d\\epsilon^{-4})$ is near-optimal, because first-order methods on NC-C minimax have $O(\\epsilon^{-4})$ complexity. Although assumption-wise, as this work claims, [43] has the extra assumption of 'decreasing regular parameter sequence', and also requires more accurate ZO gradient on the primal variable, but in my opinion, the extra assumption above is not too restrictive, and requiring more accurate ZO gradient would only cost a constant multiple of queries thus would not affect overall complexity. Therefore, the $O(d\\epsilon^{-6})$ complexity in this work is not good enough, and is in fact worse than certain existing single-loop ZO methods.\n\n2. Complexity (stochastic NC-C): I acknowledge this is the first-ever complexity of ZO method on stochastic NC-C minimax. However, the \n$O(d_x \\epsilon^{-6} + d_y \\epsilon^{-8})$ dependence is not near-optimal, since first-order methods on such problem just have $O( \\epsilon^{-6})$ complexity. ** Update: typo fixed, from $O(d \\epsilon^{-6})$ to $O(\\epsilon^{-6})$.\n\n3. Listed numerical results show the proposed method is similar and generally only slightly better than compared baselines. The difference is not significant in both experiments.\n\n4. Overall, both theoretical complexities and numerical results does not surpass existing methods, thus the contribution may not be strong enough for NeurIPS standard.\n\nQUESTIONS:\n1. Please address [Weaknesses 1].\n\n2. Please address [Weaknesses 2].\n\nLIMITATIONS:\nN/A", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2024-07-13"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nIn this paper, the authors establish a unified framework of zeroth-order optimization for nonconvex-concave minimax optimization problems in both deterministic and stochastic settings. This framework is based on the gradient descent-extragradient ascent algorithm. They claim that their algorithms require weaker assumptions on the zeroth-order estimator, while achieve competitive iteration complexity compared with the existing work. Besides, they provide some numerical experiments to verify the effectiveness of the proposed algorithms.\n\nSTRENGTHS:\nMain advantages can refer to the Summary. Besides, this paper has a good organization, which makes the readers reading easily. Numerous experiments including abundant baselines and datasets are provided to illustrate the effectiveness of the proposed algorithm.\n\nWEAKNESSES:\nIn the stochastic setting, the authors make the bounded variance assumption on the zeroth-order estimator in Assumption 3. It seems that the assumption makes the proof very similar to first-order method. It is true that the zeroth-order methods are used when computing derivative are not possible, but does this assumption rules out the most challenging technical part in the proof?\nThis paper has proposed zeroth-order method that is motivated by application scenes when the objective function is not smooth enough to enable one to compute the gradient. But there is no specific examples provided that such method plays a prominent role while the first-order method is not applicable. Since there is a definite trade-off when zeroth-order method are used compared to first-order, the smooth parameter is another factor that should be considered in using zeroth-order method. So I think providing a concrete application that zeroth-order method is inevitable will help convincing the importance of the algorithm in application.\n\nQUESTIONS:\nSimilar to aforementioned concerns on example, the experiments of poisoning data attack is a clear application that zeroth-order can be used. My question is whether it is possible to use first-order method in some cases? If this is the application that no first-order method can be used, then my previous conern on weakness can be addressed. I don't here mean that the authors should have compare zeroth-order method to first-order method in performance, since it is completely reasonable that first-order method outperforms zeroth-order and even it holds, nothing negative will impact the contribution of the paper.\n\nLIMITATIONS:\nThis paper is mostly a theoretical work, no negative societal impact may result in.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-13"}