Paper: Provable Convergence of Clipped Normalized-gradient Heavy-Ball Momentum for Adversarial Attacks (ICLR-2024)

Reviewer comment (Novelty):
A literature review is not sufficient. Checking through the reference list, the most recent literature is a paper from ICLR2021. The authors are encouraged to search for papers published in recent three years to highlight the difficulty of the problem and the novelty of their proposed method.

Author response:
Robustbench is indeed an important leaderboard evaluating the robustness of different training methods in adversarial training. In the revised version, we have cited the two given papers. We have searched for papers published in recent three years and find a closed-related survey, in which the adversarial transferability of AEs generated with representative attacks is re-evaluated across different types of DNNs, i.e., Wenqian Yu. et al. “Reliable Evaluation of Adversarial Transferability.” ArXiv abs/2306.08565 (2023).

Since we only focus on evaluating the transferability of adversarial attack of gradient-based algorithms, we choose to compare our clipped NGM with all the mentioned gradient-based algorithms in Wenqian Yu. et al 2023 using their evaluation set, which includes PGD, MI-FGSM, NI-FGSM and VMI-FGSM. In fact, our computing power only allows us to do so. We use the same parameters ($\alpha$ and $\gamma$) decided by our previous CNN experiments. The experimental results are shown in the following tables, in which the setting of other gradient-based algorithms is directly from Wenqian Yu. et al 2023.
|Attack|VGG16|Res50|Dense121|Inc-v3|Vit-S/16|Vit-B/16*|Vit-L/16|Deit-T/16|Deit-S/16|Deit-B/16|Swin-B/4/7|
|-|-|-|-|-|-|-|-|-|-|-|-|
|PGD|17.0|10.2|11.4|7.8|57.6|**100**|36.4|25.6|27.6|29.5|14.0|
|MI|39.3|21.6|21.8|15.0|62.7|**100**|49.6|35.8|38.3|38.4|18.7|
|NI|**40.5**|22.2|21.3|15.5|62.2|**100**|49.6|36.3|38.5|39.3|18.9|
|VMI|28.2|14.8|14.3|9.5|47.2|99.5|33.0|25.2|26.6|24.9|10.4|
|Ours|36.4|**25.1**|**25.8**|**19.4**|**77.2**|**100**|**64.6**|**44.9**|**50.2**|**51.5**|**20.1**|

|Attack|VGG16*|Res50|Dense121|Inc-v3|Vit-S/16|Vit-B/16|Vit-L/16|Deit-T/16|Deit-S/16|Deit-B/16| Swin-B/4/7|
|-|-|-|-|-|-|-|-|-|-|-|-|
|PGD|**99.4**|19.8|16.7|7.5|1.7|1.1|0.5|4.8|1.6|1.2|2.0|
|MI|99.3|41.0|39.0|23.0|5.3|3.5|1.5|12.9|6.2|3.2|4.8|
|NI|99.2|41.8|39.7|22.8|5.7|3.3|1.4|12.3|5.6|3.4|4.6|
|VMI|99.2|3.3|2.6|1.7|0.2|0.2|0.2|1.2|0.7|0.4|0.3|
|Ours|**99.4**|**51.9**|**41.6**|**28.8**|**6.6**|**3.8**|**1.7**|**14.8**|**7.4**|**3.9**|**5.7**|


We observe that our clipped NGM almost consistently outperforms MI-FGSM when using ViT-B/16 and VGG16 as the source model. Note that our algorithm is directly established upon MI-FGSM, we first focus on comparing with MI-FGSM by conducting the same experiments. The new experimental results further support our contribution.

Due to the limitation of our computing power, it is impossible to conduct all the experiments you asked. Note for adversarial attacks, ILSVRC 2012 (a subset of ImageNet) is commonly used such as in (Dong et al., 2018; Lin et al., 2020; Wang et al., 2021; Wenqian Yu. et al., 2023). In the future, we will use Robustbench to evaluate robustness using more models and datasets. Please note that our purpose here is mainly to show the sign-operation can be replaced by the clipping strategies rather than the comprehensive performance evaluation against a wide range of attack methods and models. Thanks.

Reviewer comment (Experiments):
Some literature is missing:  
Croce, Francesco, et al. "Robustbench: a standardized adversarial robustness benchmark." arXiv preprint arXiv:2010.09670 (2020).  
Croce, Francesco, and Matthias Hein. "Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks." International conference on machine learning. PMLR, 2020.  
Please compare the proposed method with the attack in the above literature. Robustbench is an important leaderboard evaluating the robustness of different training methods in adversarial training.

Author response:
Robustbench is indeed an important leaderboard evaluating the robustness of different training methods in adversarial training. In the revised version, we have cited the two given papers. We have searched for papers published in recent three years and find a closed-related survey, in which the adversarial transferability of AEs generated with representative attacks is re-evaluated across different types of DNNs, i.e., Wenqian Yu. et al. “Reliable Evaluation of Adversarial Transferability.” ArXiv abs/2306.08565 (2023).

Since we only focus on evaluating the transferability of adversarial attack of gradient-based algorithms, we choose to compare our clipped NGM with all the mentioned gradient-based algorithms in Wenqian Yu. et al 2023 using their evaluation set, which includes PGD, MI-FGSM, NI-FGSM and VMI-FGSM. In fact, our computing power only allows us to do so. We use the same parameters ($\alpha$ and $\gamma$) decided by our previous CNN experiments. The experimental results are shown in the following tables, in which the setting of other gradient-based algorithms is directly from Wenqian Yu. et al 2023.
|Attack|VGG16|Res50|Dense121|Inc-v3|Vit-S/16|Vit-B/16*|Vit-L/16|Deit-T/16|Deit-S/16|Deit-B/16|Swin-B/4/7|
|-|-|-|-|-|-|-|-|-|-|-|-|
|PGD|17.0|10.2|11.4|7.8|57.6|**100**|36.4|25.6|27.6|29.5|14.0|
|MI|39.3|21.6|21.8|15.0|62.7|**100**|49.6|35.8|38.3|38.4|18.7|
|NI|**40.5**|22.2|21.3|15.5|62.2|**100**|49.6|36.3|38.5|39.3|18.9|
|VMI|28.2|14.8|14.3|9.5|47.2|99.5|33.0|25.2|26.6|24.9|10.4|
|Ours|36.4|**25.1**|**25.8**|**19.4**|**77.2**|**100**|**64.6**|**44.9**|**50.2**|**51.5**|**20.1**|

|Attack|VGG16*|Res50|Dense121|Inc-v3|Vit-S/16|Vit-B/16|Vit-L/16|Deit-T/16|Deit-S/16|Deit-B/16| Swin-B/4/7|
|-|-|-|-|-|-|-|-|-|-|-|-|
|PGD|**99.4**|19.8|16.7|7.5|1.7|1.1|0.5|4.8|1.6|1.2|2.0|
|MI|99.3|41.0|39.0|23.0|5.3|3.5|1.5|12.9|6.2|3.2|4.8|
|NI|99.2|41.8|39.7|22.8|5.7|3.3|1.4|12.3|5.6|3.4|4.6|
|VMI|99.2|3.3|2.6|1.7|0.2|0.2|0.2|1.2|0.7|0.4|0.3|
|Ours|**99.4**|**51.9**|**41.6**|**28.8**|**6.6**|**3.8**|**1.7**|**14.8**|**7.4**|**3.9**|**5.7**|


We observe that our clipped NGM almost consistently outperforms MI-FGSM when using ViT-B/16 and VGG16 as the source model. Note that our algorithm is directly established upon MI-FGSM, we first focus on comparing with MI-FGSM by conducting the same experiments. The new experimental results further support our contribution.

Due to the limitation of our computing power, it is impossible to conduct all the experiments you asked. Note for adversarial attacks, ILSVRC 2012 (a subset of ImageNet) is commonly used such as in (Dong et al., 2018; Lin et al., 2020; Wang et al., 2021; Wenqian Yu. et al., 2023). In the future, we will use Robustbench to evaluate robustness using more models and datasets. Please note that our purpose here is mainly to show the sign-operation can be replaced by the clipping strategies rather than the comprehensive performance evaluation against a wide range of attack methods and models. Thanks.

Reviewer comment (Evaluation):
When describing the results in Figure 3, it is mentioned that "the generated noise in each image is human-imperceptible". However, I think the noise in the proposed method is more obvious than the one from PGD, and such a difference leads to the difference in the attack success rates. Figure 3 is not convincing enough.

Author response:
We have revised it to be “Whether the background is simple or complex, the difference between the noise images generated by MI-FGSM and our clipped NGM is almost human-imperceptible.”
In NI-FGSM (Lin et al., ICLR2020), 12 randomly selected benign images and their corresponding adversarial images are visualized. They indicated that the generated noise in each image is human-imperceptible. Your suggestion will encourage us to do some future work about imperceptibility. Thanks.

Reviewer comment (Experiments):
The authors need to use different data sets in the experiments, e.g., CIFAR-10, CIFAR-100, ImageNet. The current experiments are not sufficient to demonstrate the improvements of the proposed method. The authors may also consider other neural network architectures, e.g., WideResNet models or ViT.

Author response:
Robustbench is indeed an important leaderboard evaluating the robustness of different training methods in adversarial training. In the revised version, we have cited the two given papers. We have searched for papers published in recent three years and find a closed-related survey, in which the adversarial transferability of AEs generated with representative attacks is re-evaluated across different types of DNNs, i.e., Wenqian Yu. et al. “Reliable Evaluation of Adversarial Transferability.” ArXiv abs/2306.08565 (2023).

Since we only focus on evaluating the transferability of adversarial attack of gradient-based algorithms, we choose to compare our clipped NGM with all the mentioned gradient-based algorithms in Wenqian Yu. et al 2023 using their evaluation set, which includes PGD, MI-FGSM, NI-FGSM and VMI-FGSM. In fact, our computing power only allows us to do so. We use the same parameters ($\alpha$ and $\gamma$) decided by our previous CNN experiments. The experimental results are shown in the following tables, in which the setting of other gradient-based algorithms is directly from Wenqian Yu. et al 2023.
|Attack|VGG16|Res50|Dense121|Inc-v3|Vit-S/16|Vit-B/16*|Vit-L/16|Deit-T/16|Deit-S/16|Deit-B/16|Swin-B/4/7|
|-|-|-|-|-|-|-|-|-|-|-|-|
|PGD|17.0|10.2|11.4|7.8|57.6|**100**|36.4|25.6|27.6|29.5|14.0|
|MI|39.3|21.6|21.8|15.0|62.7|**100**|49.6|35.8|38.3|38.4|18.7|
|NI|**40.5**|22.2|21.3|15.5|62.2|**100**|49.6|36.3|38.5|39.3|18.9|
|VMI|28.2|14.8|14.3|9.5|47.2|99.5|33.0|25.2|26.6|24.9|10.4|
|Ours|36.4|**25.1**|**25.8**|**19.4**|**77.2**|**100**|**64.6**|**44.9**|**50.2**|**51.5**|**20.1**|

|Attack|VGG16*|Res50|Dense121|Inc-v3|Vit-S/16|Vit-B/16|Vit-L/16|Deit-T/16|Deit-S/16|Deit-B/16| Swin-B/4/7|
|-|-|-|-|-|-|-|-|-|-|-|-|
|PGD|**99.4**|19.8|16.7|7.5|1.7|1.1|0.5|4.8|1.6|1.2|2.0|
|MI|99.3|41.0|39.0|23.0|5.3|3.5|1.5|12.9|6.2|3.2|4.8|
|NI|99.2|41.8|39.7|22.8|5.7|3.3|1.4|12.3|5.6|3.4|4.6|
|VMI|99.2|3.3|2.6|1.7|0.2|0.2|0.2|1.2|0.7|0.4|0.3|
|Ours|**99.4**|**51.9**|**41.6**|**28.8**|**6.6**|**3.8**|**1.7**|**14.8**|**7.4**|**3.9**|**5.7**|


We observe that our clipped NGM almost consistently outperforms MI-FGSM when using ViT-B/16 and VGG16 as the source model. Note that our algorithm is directly established upon MI-FGSM, we first focus on comparing with MI-FGSM by conducting the same experiments. The new experimental results further support our contribution.

Due to the limitation of our computing power, it is impossible to conduct all the experiments you asked. Note for adversarial attacks, ILSVRC 2012 (a subset of ImageNet) is commonly used such as in (Dong et al., 2018; Lin et al., 2020; Wang et al., 2021; Wenqian Yu. et al., 2023). In the future, we will use Robustbench to evaluate robustness using more models and datasets. Please note that our purpose here is mainly to show the sign-operation can be replaced by the clipping strategies rather than the comprehensive performance evaluation against a wide range of attack methods and models. Thanks.

Reviewer comment (Novelty):
My understanding of the proposed attack method is that it combines attack and some existing optimization methods. In addition, from how the proof is presented in the appendix, the proof follows some routine steps in proving optimization convergence, and the theoretical contribution is also limited. The authors may need to highlight the novelty and emphasize the difficulty or potential challenge when crafting their proposed method.

Author response:
There is currently no convergence guarantee for a majority of gradient-based algorithms in adversarial attacks. While regular gradient and momentum methods do guarantee convergence, their practical performance is not satisfactory. To bridge this challenging theory-practice gap, we present a new algorithm called clipped NGM. It is inspired by the empirical success of sign-operation and normalized gradient in MI-FGSM rather than a simple combination of the known techniques. Another difficulty is that the step size conditions required to guarantee convergence of the regular clipped gradient algorithms are no longer satisfied due to using the normalized gradient. To overcome this difficulty, we present a new radius-varying clipping rule so that some routine steps in proving optimization convergence can be employed. It should be indicated that almost all optimization algorithms use some routine steps in convergence analysis.

Reviewer comment (Writing):
The writing needs improvement. For example, the math notations can be improved. An attack algorithm aims to find a perturbation in x, and (9) and (10) are using x. However, in other formulas, the notation w is used. The notation w is often used for model parameters rather than the data x, confusing readers.

Author response:
$ \boldsymbol{w} $ is for a pure optimization algorithm. $ \boldsymbol{x} $ is for describing an optimizer for adversarial attacks.

Reviewer comment (Writing):
Another suggestion is to emphasize the purpose of each paragraph at the beginning of the paragraphs. When reading this paper, sometimes I have to read the whole paragraph, understand the details, and eventually get to know the purpose of the paragraph. Although the paragraphs still contain all the information, reading this paper is tiring.

Author response:
Thanks. We will improve our presentation as soon as possible.

Reviewer comment (Theory):
Gradient clipping is shown to accelerate training theoretically in prior works, I missed any solid acceleration discussions in the paper.

Author response:
In fact, the acceleration of gradient clipping needs some assumptions such as the smoothness condition in Zhang et al., 2020a. For general convex functions, as far as we know, it remains unknown whether clipping can accelerate SGD. In this paper, we only focus on proving that the clipped NGM can attain the optimal averaging convergence, as opposed to the non-convergence of signSGD. Please note that our main purpose is to show that the clipping technique can serve as an alternative to the dominant sign operation in adversarial attacks. 

Of course, your question is very interesting. Our intuition is that the clipped NGM should have a better bound with smaller factors than SGD due to the rescaling of gradients. Your suggestion inspires us to carefully analyze the derived bound of Theorem 3.4 in our future work. At least, we can discuss the bounds in some special cases (e.g., we can let the two parts in the derived bounds be equal and discuss their minimal value). More generally, we can discuss whether we can use the lower bound from the clipped gradients to take the place of the original bound of gradients in the proof. Thanks.

Reviewer comment (Theory):
Eq. (15) may be questionable. Note that the clipping operator in Eq. (8) should be element-wise, and thus Eq. (15) includes the element-wise product of two vectors.

Author response:
It is not questionable. Eq. (15) is similar to Eq. (7) but using the normalized-gradient like that in MI-FGSM. We apologize for the original formulation $\text{clip}_{\gamma}: \mathbb{R}^{N} \rightarrow\mathbb{R}^{N}$. 

It should be $ \text{clip}_{\gamma}: \mathbb{R}^{N} \rightarrow\mathbb{R}  $.

Reviewer comment (Writing):
Both the English language and equations in this paper need to be improved. For instance, what’s the definition of the (L_0, L-1)-smooth function?

Author response:
It can be found in Zhang et al., NeurIPS 2020 (page 2, Definition 1.1).