SIGN SGD VIA Z EROTH -O RDER O RACLE
A BSTRACT
In this paper, we design and analyze a new zeroth-order (ZO) stochastic optimization algorithm, ZO-signSGD, which enjoys dual advantages of gradient-free operations and signSGD.
The latter requires only the sign information of gradient estimates but is able to achieve a comparable or even better convergence speed than SGD-type algorithms.
Our study shows that ZO-signSGD requires √ d times more iterations than signSGD, leading to a convergence rate of O ( √ d/ √ T ) under some mild conditions, where d is the number of optimization variables, and T is the number of iterations.
In addition, we analyze the effects of different types of gradient estimators on the convergence of ZO-signSGD, and propose several variants of ZO-signSGD with O ( √ d/ √ T ) convergence rate.
On the application side we explore the connection between ZO-signSGD and black-box adversarial attacks in robust deep learning.
Our empirical evaluations on image classiﬁcation datasets
MNIST and CIFAR-10 demonstrate the superior performance of ZO-signSGD on the generation of adversarial examples from black-box neural networks.
I NTRODUCTION
Zeroth-order (gradient-free) optimization has attracted an increasing amount of attention for solving machine learning (ML) problems in scenarios where explicit expressions for the gradients are difﬁcult or infeasible to obtain.
One recent application of great interest is to generate prediction-evasive adversarial examples, e.g., crafted images with imperceptible perturbations to deceive a well-trained image classiﬁer into misclassiﬁcation.
However, the black-box optimization nature limits the practical design of adversarial examples, where internal conﬁgurations and operating mechanism of public
ML systems (e.g., Google Cloud Vision API) are not revealed to practitioners and the only mode of interaction with the system is via submitting inputs and receiving the corresponding predicted outputs (Papernot et al., 2017;
Liu et al., 2017; Chen et al., 2017; Tu et al., 2018; Ilyas et al., 2018b; Cheng et al., 2018;
Bhagoji et al., 2018).
It was observed in both white-box and black-box settings 1 that simply leveraging the sign information of gradient estimates of an attacking loss can achieve superior empirical performance in generating adversarial examples (Goodfellow et al., 2015;
Madry et al., 2018; Ilyas et al., 2018a).
Spurred by that, this paper proposes a zeroth-order (ZO) sign-based descent algorithm (we call it ‘ZO-signSGD’) for solving black-box optimization problems, e.g. design of black-box adversarial examples.
The convergence behavior and algorithmic stability of the proposed
ZO-signSGD algorithm are carefully studied in both theory and practice.
In the ﬁrst-order setting, a sign-based stochastic gradient descent method, known as signSGD, was analyzed by (Bernstein et al., 2018; Balles & Hennig, 2017).
It was shown in (Bernstein et al., 2018) that signSGD not only reduces the per iteration cost of communicating gradients, but also could yield a faster empirical convergence speed than SGD (Kinga & Adam, 2015).
That is because although the sign operation compresses the gradient using a single bit, it could mitigate the negative effect of extremely components of gradient noise.
Theoretically, signSGD achieves O (1 / √ T ) convergence rate under the condition of a sufﬁciently large mini-batch size, where T denotes the total number of iterations.
The work in (Balles & Hennig, 2017) established a connection between signSGD and
Adam with restrictive convex analysis.
Prior to (Bernstein et al., 2018; Balles & Hennig, 2017), although signSGD was not formally deﬁned, the fast gradient sign method (Goodfellow et al., 2015) to generate white-box adversarial examples actually obeys the algorithmic protocol of signSGD.
The effectiveness of signSGD has been witnessed by robust adversarial training of deep neural networks (DNNs) (Madry et al., 2018).
Given the advantages of signSGD, one may wonder if it can be generalized for ZO optimization and what the corresponding convergence rate is
In this paper, we answer these questions afﬁrmatively.
Contributions We summarize our key contributions as follows.
• We propose a new ZO algorithm, ‘ZO-signSGD’, and rigorously prove its convergence rate of O ( √ d/ √ T ) under mild conditions.
• Our established convergence analysis applies to both mini-batch sampling schemes with and without replacement.
In particular, the ZO sign-based gradient descent algorithm can be treated as a special case in our proposed ZO-signSGD algorithm.
• We carefully study the effects of different types of gradient estimators on the convergence of ZO-signSGD, and propose three variants of ZO-signSGD for both centralized and distributed ZO optimization.
• We conduct extensive synthetic experiments to thoroughly benchmark the performance of ZO-signSGD and to investigate its parameter sensitivity.
We also demonstrate the superior performance of ZO-signSGD for generating adversarial examples from black-box DNNs.
Related work Other types of ZO algorithms have been developed for convex and nonconvex optimization, where the full gradient is approximated via a random or deterministic gradient estimate (Jamieson et al., 2012; Nesterov & Spokoiny, 2015; Ghadimi & Lan, 2013; Duchi et al., 2015;
Gao et al., 2014; Shamir, 2017; Hajinezhad et al., 2017; Ghadimi et al., 2016; Lian et al., 2016;
Liu et al., 2018b;c; Wang et al., 2018).
Examples include ZO-SGD (Ghadimi & Lan, 2013), ZO stochastic coordinate descent (ZO-SCD) (Lian et al., 2016), and ZO stochastic variance reduced gradient descent (ZO-SVRG)
(Liu et al., 2018c;a; Gu et al., 2016).
Both ZO-SGD and ZO-SCD can achieve O ( √ d/ √ T ) convergence rate.
And ZO-SVRG can further improve the iteration complexity to O ( d/T ) but suffers from an increase of function query complexity due to the additional variance reduced step, known as ‘gradient blending’ (Liu et al., 2018c), compared to ZO-SGD.
The existing work showed that ZO algorithms align with the iteration complexity of their ﬁrst-order counterparts up to a slowdown effect in terms of a small-degree polynomial of the problem size d .
SIGN SGD & I TS C ONNECTION TO A DVERSARIAL M ACHINE L EARNING
In this section, we provide a background on signSGD, together with the problem setup of our interest.
In particular, we show that the commonly-used methods for generating adversarial attacks fall into the framework of signSGD.
Preliminaries on signSGD Consider a nonconvex ﬁnite-sum problem of the form
[Equation]
where x ∈ R d are optimization variables, and { f i } are n individual nonconvex cost functions.
The ﬁnite-sum form (1) encompasses many ML problems, ranging from generalized linear models to neural networks.
If the gradients of { f i } are available, then problem (1) can be solved by many ﬁrst-order methods such as SGD, SCD, and signSGD.
The method of our interest is signSGD, which differs from SGD and SCD, takes the sign of gradient (or its estimate) as the descent direction.
It was recently shown in (Bernstein et al., 2018) that signSGD is quite robust to gradient noise and yields fast empirical convergence.
Algorithm 1 provides a generic sign-based gradient descent framework that encapsulates different variants of signSGD.
In Algorithm 1, GradEstimate( · ) signiﬁes a general gradient estimation procedure, which adopts either a stochastic gradient estimate in the ﬁrst-order setting (Bernstein et al., 2018) or a function difference based random gradient estimate in the ZO setting (Nesterov & Spokoiny, 2015;
Duchi et al., 2015).
We call the ZO variant of signSGD ‘ZO-signSGD’, which will be elaborated on in Sec. 3.
Adversarial attacks meet signSGD
It is now widely known that ML models (e.g., deep neural networks) are vulnerable to adversarial attacks , which craft inputs (e.g., images) with imperceptible perturbations to cause incorrect classiﬁcation (Szegedy et al., 2013; Goodfellow et al., 2015; Kurakin et al., 2017; Lin et al., 2019).
The resulting inputs crafted by adversaries are known as adversarial examples .
Investigating adversarial examples not only helps to understand the limitation of learning models, but also provides opportunities to improve the models’ robustness (Papernot et al., 2016;
Athalye et al., 2018; Madry et al., 2018).
In what follows, we show that the generation of adversarial examples in (Goodfellow et al., 2015; Kurakin et al., 2017) can be interpreted through signSGD.
Let x 0 denote the natural (legitimate) input of an ML model associated with the true label t 0 , and x (cid:48)
= x 0 + δ be the adversarial example to be designed, where δ are adversarial perturbations.
If f ( x , t 0 ) is the training loss of a learning model, then the goal of (white-box) adversarial attack is to ﬁnd minimal perturbation δ that is sufﬁcient to mislead the learning model, namely, to maximize the loss f
( x 0 + δ , t 0 ) .
Taking the ﬁrst-order approximation of f ( x (cid:48) , t 0 ) around x 0 , we obtain f ( x (cid:48) , t 0 )
≈ f
( x 0 , t 0 )
+ (cid:104)∇ x f ( x 0 , t 0 ) , δ (cid:105) .
By constraining the strength of perturbation in the (cid:96) ∞ ball of small radius (cid:15) (i.e., (cid:107) δ (cid:107) ∞ ≤ (cid:15) ), the linear approximation of f ( x (cid:48) , t 0 ) is then maximized at δ = (cid:15) sign( ∇ x f ( x 0 , t 0 ))
(Shaham et al., 2018).
Therefore, generation of adversarial examples proposed in (Goodfellow et al., 2015) obeys the sign-gradient update rule in (2),
[Equation]
Such a connection between adversarial example generation and signSGD also holds in other attacks, e.g., the iterative target attack method (Kurakin et al., 2017).
Similarly, a so-called black-box attack (Ilyas et al., 2018a; Bhagoji et al., 2018) is associated with our proposed ZO-signSGD algorithm.
ZO- SIGN SGD FOR B LACK -B OX O PTIMIZATION
One limitation of signSGD (Bernstein et al., 2018) is the need of ﬁrst-order information, i.e., stochastic gradients.
However, there exists a large practical demand for solving ML problems where explicit expressions of the gradients are difﬁcult or infeasible to obtain, e.g., the generation of adversarial examples from black-box neural networks as discussed in Sec. 1 and 2.
Gradient estimation via ZO oracle In the ZO setting where the ﬁrst-order information is unavail- able, the gradient estimator at Step 3 of Algorithm 1 has only access to function values of { f i ( x ) } given a query point x .
Based on that, we construct a ZO gradient estimate through a forward differ- ence of two function values (Nesterov & Spokoiny, 2015; Gao et al., 2014; Duchi et al., 2015).
In
Algorithm 1, GradEstimate( x ) is then speciﬁed as
[Equation]
where x = x k in Algorithm 1, I k is a mini-batch of size |I
k | =
b , { u i,j } qj =1 are i.i.d.
random directions drawn from a uniform distribution over a unit sphere, and ˆ ∇
f i ( x ; u i,j ) gives a two-point based random gradient estimate with direction
u i,j and smoothing parameter µ > 0 .
We remark that the random direction vectors in (3) can also be drawn from the standard Gaussian distribution (Nesterov & Spokoiny, 2015).
However, the uniform distribution could be more useful in practice since it is deﬁned in a bounded space rather than the whole real space required for Gaussian.
We highlight that unlike the ﬁrst-order stochastic gradient estimate, the ZO gradient estimate (3) is a biased approximation to the true gradient of f .
Instead, it becomes unbiased to the gradient of the randomized smoothing function f µ (Duchi et al., 2012; Gao et al., 2014),
[Equation]
where f i,µ gives the randomized smoothing version of f i , and the random variable v follows a uniform distribution over the unit Euclidean ball.
Clearly, there exists a gap between a ZO gradient estimate and the true gradient of f , but as will be evident later, such a gap can be measured through the smoothing function f µ .
Motivations of ZO-signSGD.
Compared to SGD-type methods, the fast empirical convergence of signSGD and ZO-signSGD has been shown in the application of generating white-box and black-box adversarial examples (Goodfellow et al., 2015;
Madry et al., 2018; Ilyas et al., 2018a).
As mentioned in (Bernstein et al., 2018), the sign operation could mitigate the negative effect of (coordinate-wise) gradient noise of large variance.
Recall that the ZO gradient estimate is a biased approximation to the true gradient, and thus, could suffer from having larger noise variance than (ﬁrst-order) stochastic gradients.
In this context, one could beneﬁt from ZO-signSGD due to its robustness to gradient noise.
In Appendix 1, we provide two concrete examples (Fig.
A1 and Fig.
A2) to conﬁrm the aforementioned analysis.
In Fig.
A1, we show the robustness of ZO-signSGD against sparse noise perturbation through a toy quadratic optimization problem, originally introduced in (Bernstein et al., 2018) to motivate the fast convergence of signSGD against SGD.
In Fig.
A2, we show that gradient estimation via ZO oracle indeed encounters gradient noise of large variance.
Thus, taking the sign of a gradient estimate might scale down the extremely noisy components.
ZO-signSGD & technical challenges beyond signSGD Algorithm 1 becomes ZO-signSGD as the ZO gradient estimate (3) is applied.
We note that the extension from ﬁrst order to ZO is nontrivial, as the proposed ZO-signSGD algorithm yields three key differences to signSGD.
First, ZO-signSGD has milder assumption on the choice of mini-batch sampling.
Recall that signSGD in (Bernstein et al., 2018) achieves O (1 / √ T ) convergence rate given the condition that the mini-batch size is sufﬁciently large, b
= O ( T ) .
However, this condition only becomes true when the mini-batch sample is randomly selected from [ n ] with replacement , which is unusual when n ≤ T .
Here [ n ] represents the integer set { 1 , 2 , . .
. , n } .
And signSGD fails to cover signGD when b = n , since sampling with replacement leads to I k (cid:54) =
[ n ] even if b = n .
In the proposed ZO-signSGD algorithm, we will relax the assumption on mini-batch sampling.
Second, in ZO-signSGD both the ZO gradient estimator and the sign operator give rise to approximation errors to the true gradient.
Although the statistical properties of ZO gradient estimates can be acquired with the aid of the randomized smoothing function (4), the use of mini-batch sampling without replacement introduces extra difﬁculty to bound the variance of ZO gradient estimates since mini-batch samples are no longer independent.
Moreover, the sign-based descent algorithm evaluates the convergence error in the (cid:96) 1 -norm geometry, leading to a mismatch with the (cid:96) 2 -norm based gradient variance.
Besides translating the the gradient norm from (cid:96) 1 to (cid:96) 2 , the probabilistic convergence method (Ghadimi & Lan, 2013) is used to bound the eventual convergence error of ZO-signSGD.
Finally, beyond the standard ZO gradient estimator (3), we will cover multiple variants of ZOsignSGD for centralized or distributed optimization.
C ONVERGENCE A NALYSIS OF ZO- SIGN SGD
In this section, we begin by stating assumptions used in our analysis.
We then derive the convergence rate of ZO-signSGD for nonconvex optimization.
Assumptions of problem (1) are listed as follows.
A1:
Functions { f i } have L -Lipschitz continuous gradients, where L ∈ (0 , ∞ ) .
A2: At time k , the gradient of f i is upper bounded by (cid:107)∇ f i ( x k ) (cid:107) 2 ≤ σ for i ∈ [ n ] .
Both A1 and A2 are the standard assumptions used in nonconvex optimization literature (Bernstein et al., 2018;
Reddi et al., 2018; Chen et al., 2018).
A1 implies the L -smoothness of f i , namely, for any x and y we obtain f i ( x ) − f i ( y ) ≤ (cid:104)∇ f i ( y ) , x − y (cid:105)
+ ( L/ 2) (cid:107) x − y (cid:107) 2 i .
A2 implies the bounded variance of ∇ f
i in (Bernstein et al., 2018, Assumption 3), namely, 1 n (cid:80) ni
=1 (cid:107)∇ f i ( x ) − ∇ f ( x ) (cid:107) 22 ≤ 4 σ 2 , where we have used the fact that (cid:107)∇ f ( x ) (cid:107) 2 ≤ σ under A2.
Throughout the paper, we assume that problem (1) is solvable, namely, f ( x ∗ ) >
−∞ where x ∗ is an optimal solution.
We recall that Algorithm 1 becomes ZO-signSGD when the gradient estimation step (3) is applied.
For nonconvex problems, the convergence of an algorithm is typically measured by stationarity, e.g., using (cid:107)∇ f ( x ) (cid:107) 22 in SGD (Ghadimi & Lan, 2013) and (cid:107)∇ f ( x ) (cid:107) 1 in signSGD
(Bernstein et al., 2018).
For the latter, the (cid:96) 1 geometry is met when quantifying the stochasticity through the (non-linear) sign operation.
Different from signSGD, ZO-signSGD only obtains a biased estimate to the true gradient.
In Proposition 1, we bypass such a bias by leveraging the randomized smoothing technique used for
ZO optimization (Gao et al., 2014; Nesterov & Spokoiny, 2015; Duchi et al., 2015).
Proposition 1 Under A1, the outputs { x k } T − 1 k =0 of ZO-signSGD, i.e., Algorithm 1 with (3), satisﬁes
T
[Equation]
where the expectation is taken with respect to all the randomness of ZO-signSGD, f µ is the randomized smoothing function of f in (4), and ˆ g k = GradEstimate( x k ) in (3).
Proof: See Appendix 2.
[Equation]
In Proposition 1, the rationale behind introducing the smoothing function f µ is that ∇ f µ ( x k ) is the mean of ZO gradient estimate ˆ g k .
And thus, the convergence of ZO-signSGD is now linked with the variance of ˆ g k , i.e., E [ (cid:107) ˆ g k − ∇ f µ ( x k ) (cid:107) 22 ] .
This crucial relationship presented in Proposition 1 holds for a general class of signSGD-type algorithms that use different ZO gradient estimators.
Spurred by (5), we next investigate the second-order moment of ˆ g k in Proposition 2.
Proposition 2 Under A1 and A2, the variance of ZO gradient estimate ˆ g k is upper bounded by
[Equation]
where C ( d, µ ) :
=
2 dσ 2 + µ 2 L 2 d 2 / 2 .
In (6), α b and β b are Boolean variables depending on the choice of mini-batch sampling,
[Equation]
where I ( x > a ) is the indicator function of x with respect to the constraint x > a , and I ( x > a )
=if x > a and 0 otherwise.
Proof: See Appendix 3.
[Equation]
Compared to the variance bound ( σ 2 /b ) of the stochastic gradient estimate of f in signSGD
(Bernstein et al., 2018), Proposition 2 provides a general result for the ZO gradient estimate ˆ g k .
It is clear that the bound in (6) contains two parts: h 1 : = 4 α b ( q + [Equation] bq σ
[Equation]
and h
[Equation]
:= ( [Equation] C ( d, µ ) , where the former h 1 = O ( σ 2 /b ) characterizes the reduced variance (using b mini-batch samples) for the stochastic gradient estimate of the smoothing function f µ , and the latter h 2 =
O ( C ( d, µ ) / ( bq )) reveals the dimension-dependent variance induced by ZO gradient estimate using b mini-batch samples and q random directions.
If a stochastic gradient estimate of f is used in signSGD, then h 2 is eliminated and the variance bound in (6) is reduced to ( σ 2 /b ) .
Furthermore, Proposition 2 covers mini-batch sampling with and without replacement, while signSGD only considers the former case.
For the latter case, Proposition 2 implies that if b = n (i.e., I k
=
[ n ] for ZO-signGD), then the variance E (cid:2) (cid:107) ˆ g k − ∇ f µ ( x k ) (cid:107) 22 (cid:3) is reduced to O ( C ( d, µ ) / ( nq )) , corresponding to α b = 0 and β b = 1 in (7).
In the other extreme case of b = 1 , both the studied mini-batch schemes become identical, corresponding to α b = 1 and β b = 0 .
Proposition 2 also implies that the use of large b and q reduces the variance of the gradient estimate, and will further improve the convergence rate.
With the aid of Proposition 1 and 2, we can then show the convergence rate of ZO-signSGD in terms of stationarity of the original function f .
The remaining difﬁculty is how to bound the gap between f and its smoothed version f µ .
It has been shown in (Gao et al., 2014; Nesterov & Spokoiny, 2015) that there exists a tight relationship between f µ and f given the fact that the former is a convolution of the latter and the density function of a random perturbation v in (4).
We demonstrate the convergence rate of ZO-signSGD in Theorem 1.
Theorem 1 Under A1 and A2, if we randomly pick x R from { x k } T − 1 k =0 with probability P
( R = k )
=
δ k
[Equation]
k =
δ k , then the convergence rate of ZO-signSGD is given by
[Equation]
where f ∗ denotes the minimum value.
Proof: See Appendix 4.
[Equation]
In Theorem 1, we translate the gradient norm from (cid:96) 1 to (cid:96) 2 , and adopt a probabilistic output x R (Ghadimi & Lan, 2013; Lei et al., 2017) to avoid exhaustive search over { x k } for min k
(cid:107)∇ f ( x k ) (cid:107) 2 .
Note that the convergence rate of ZO-signSGD relies on the learning rate δ k , the problem size d , the smoothing parameter µ , the mini-batch size b , and the number of random perturbations q for
ZO gradient estimation.
We next obtain explicit dependence on these parameters by specifying
Theorem 1.
If δ k = δ
=
O ( 1 √ dT ) and µ = O ( 1 √ dT ) , then the convergence in (8) simpliﬁes to
[Equation]
where α b and β b were deﬁned in (7), and 1 ≤ ( α b + β b ) ≤ 2 .
We provide several key insights on the convergence rate of ZO-signSGD through (9).
First, the convergence rate of ZO-signSGD is measured through (cid:107)∇ f ( x R ) (cid:107) 2 rather than its squared counterpart (cid:107)∇ f ( x R ) (cid:107) 22 , where the latter was used in measuring the convergence of ZO-SGD.
We recall from (Ghadimi & Lan, 2013, Theorem 3.2 & Corollary 3.3) that ZO-SGD yields the convergence error E (cid:2) (cid:107)∇ f ( x R ) (cid:107) 22 (cid:3) ≤ O ( √ d √ T ) .
Since (cid:107)∇ f ( x R ) (cid:107) 22 ≤ (cid:107)∇ f ( x R ) (cid:107) 2 as (cid:107)∇ f ( x R ) (cid:107) 22 ≤ 1 , the convergence of ZO-signSGD meets a stricter criterion than that of ZO-SGD.
The possible downside of ZO-signSGD is that it suffers an additional error of order O ( √ d √ b + d √ bq ) in the worst case.
The aforementioned results imply that ZO-signSGD could only converge to a neighborhood of a stationary point but with a fast convergence speed.
Here the size of the neighborhood is controlled by the mini-batch size b and the number of random direction vectors q .
Also, our convergence analysis applies to mini-batch sampling both with and without replacement.
When b ∈ [1 , n ) , ZO-signSGD achieves O ( √ d √ T + √ d √ b + d √ bq ) convergence rate regardless of the choice of mini-batch sampling.
When b = n , it is known from (9) that the use of mini-batch without replacement recovers ZO-signGD, yielding the convergence rate O ( √ d √ T + d √ nq ) .
By contrast, the use of mini-batch with replacement leads to the worse convergence rate O ( √ d √ T + d √ nq + √ d √ n ) .
Clearly, as b = n and n < T , ZO-signSGD using mini-batch with replacement fails to achieve the rate O ( √ d √ T ) regardless of the choice of q .
By contrast, ZO-signSGD using mini-batch without replacement recovers O ( √ d √ T ) as q = O ( dTn ) .
When b > n , ZO-signSGD is restricted to using mini-batch sampling with replacement.
Similar to signSGD
(Bernstein et al., 2018), we can obtain
O ( √ d √ T ) convergence rate as b =
O ( T ) and q = O ( dTn ) , where the dependence on q is induced by the use of ZO gradient estimation.
V ARIANTS OF ZO- SIGN SGD
Here we study three variants of ZO-signSGD, where the gradient will be estimated using a) the central difference of function values, b) the sign of ZO gradient estimates with majority vote , or c) the sign of ZO gradient estimates with majority vote for distributed optimization.
That is,
[Equation]
where { u i,j } and ˆ ∇ f i ( x ; u i,j ) have been deﬁned in (3).
The gradient estimator (12) is proposed for distributed optimization over a star network that consists of M agents and 1 central processor.
Each agent m ∈ [ M ] has only access to n m data (in terms of n m individual costs { f i } ) with (cid:80) Mm =1 n m = n , and the mini-batch I m,k per agent satisﬁes b m = |I
m,k | ∈ [1 , n m ] .
According to (12), the central processor receives 1 -bit compressed gradients sign (cid:16) 1 b m q (cid:80) i ∈I m,k (cid:80) qj =1 ˆ ∇ f i ( x ; u i,j ) (cid:17) from
M agents and then performs the sign-based descent (2) and sends its 1-bit update back to every agent.
The ZO gradient estimator (10) was used in (Shamir, 2017) for bandit convex optimization and in (Ilyas et al., 2018a) for designing black-box adversarial attacks.
Compared to the form of forward difference (3), the central difference (10) requires b ( q − 1) times more function queries in gradient estimation.
At the cost of more function queries, one may wonder if the convergence rate of ZO-signSGD can be further improved.
Corollary 1 Suppose that the conditions in Theorem 1 hold, ZO-signSGD with gradient estimator (10) yields the same convergence rate of ZO-signSGD that uses the estimator (3).
Proof: Recall that Proposition 1 is independent of speciﬁc forms of gradient estimators, and thus holds for (10).
Although Proposition 2 relies on the second-order moments of each gradient estimator, we prove that under A1 and A2, both (3) and (10) maintain the same statistical properties.
As a result,
Proposition 2 and Theorem 1 also hold for (10); see more details in Appendix 5.
(cid:3)
We next study the gradient estimator (11), whose sign is equivalent to the majority vote (i.e., the element-wise median) of signs of individual gradient estimates { ˆ ∇ f i ( x ; u i,j ) } .
It was shown in (Bernstein et al., 2018) that signSGD with majority vote has a better convergence rate under additional assumptions of unimodal symmetric noise distribution of coordinate-wise gradient estimates.
In
Corollary 2, we show that such a speed-up in convergence can also be achieved by ZO-signSGD with majority vote, which we refer to as ‘ZO-M-signSGD’.
Corollary 2 Suppose that the conditions in Theorem 1 hold, and the distribution of gradient noise is unimodal and symmetric.
Then, ZO-M-signSGD with δ k
= O ( 1 √ dT ) and µ = O ( 1 √ dT ) yields
[Equation]
Proof: See Appendix 6.
[Equation]
We recall from Theorem 1 that under the same parameter setting of Corollary 2, ZO-signSGD yields O ( √ d √ T + √ d √ b + d √ bq ) convergence rate in the worst case.
It is clear from (13) that the error correction term of order √ d √ b is eliminated in ZO-M-signSGD.
Such an improvement in convergence is achieved under the condition of unimodal symmetric gradient noise.
We remark that different from the stochastic gradient noise studied in (Bernstein et al., 2018), the ZO gradient estimation noise could violate this assumption.
For example, in a scalar case, if the gradient estimate g follows the distribution where g = 1 with probability 0 .
9 , g = − 10 with probability 0 .
1 , then E [ g ] <
and sign( E [ g ]) < 0 .
However, E
[sign( g )] > 0 .
This implies that without the assumption of symmetry, the sign of gradient estimates with majority vote ( E [sign( g )] ) can be in the opposite direction of the sign of averaged gradients ( sign( E [ g ]) ).
Our results in the next section show that ZO-M-signSGD may not outperform ZO-signSGD.
Lastly, we focus on the gradient estimator (12), whose sign can be interpreted as the major vote of M distributed agents about the sign of the true gradient (Bernstein et al., 2018).
The resulting variant of ZO-signSGD is called ‘ZO-D-signSGD’, and its convergence rate is illustrated in Corollary 3.
Compared to ZO-M-signSGD for centralized optimization, ZO-D-signSGD suffers an extra error correction term O ( √ d √ n ) in the distributed setting.
It is also worth mentioning that if M = n and q = 1 , then the gradient estimator (12) reduces to (11) with I k
=
[ n ] .
In this case, Corollary 2 andreach a consensus on O ( √ d √ T + d √ n ) convergence error.
Corollary 3 Suppose that the conditions in Corollary 2 hold.
ZO-M-signSGD with b m = (cid:98) n M (cid:99) , δ k
= O ( 1 √ dT ) and µ = O ( 1 √ dT ) yields
[Equation]
Proof: See Appendix 7.
[Equation]
[Figure]
E XPERIMENTS
In this section, we empirically show the effectiveness of ZO-signSGD, and validate its convergence behavior on both synthetic and real-world datasets such as MNIST and CIFAR-10.
For the synthetic experiment, we study the problem of binary classiﬁcation in the least squared formulation.
For the real-world application, we design adversarial examples from black-box neural networks as mentioned in Sec. 2.
Throughout this section, we compare ZO-signSGD and its variants with SGD, signSGD
(Bernstein et al., 2018), ZO-SGD (Ghadimi & Lan, 2013), and ZO-SCD (Lian et al., 2016).
Binary classiﬁcation We consider the least squared problem with a nonconvex loss function (Xu et al., 2017; Liu et al., 2018b) min x ∈ R d 1 n (cid:80) ni
=
( y i − 1 / (1 + e − a Ti x )) 2 , which satisﬁes Assumption A2 by letting σ = max i { 2 (cid:107) a i (cid:107) 2 } . Here instead of using the conventional cost function of logistic regression (a convex function), the considered least squared formulation is introduced to align with our nonconvex theoretical analysis.
For generating the synthetic dataset, we randomly draw samples { a i } from N ( 0 , I ) , and obtain the label y i =
if 1 / (1 + e − a Ti x ) > 0 . 5 and 0 otherwise.
The number of training samples { a i , y i } is set by n = 2000 against 200 testing samples.
We ﬁnd the best constant learning rate for algorithms via a greedy search over η ∈ [0 . 001 , 0 . 1] (see Appendix 8. for more details), and we choose the smoothing parameter µ = 10 / √ Td .
Unless speciﬁed otherwise, let b
= q = 10 , T = 5000 and d = 100 .
In Fig.
1, we report the training loss, the test accuracy, as well as the effects of algorithmic parameters on the convergence of the studied algorithms.
We observe from Fig.
1-(a)
and (b) that ZO-signSGD outperforms other ZO algorithms, and signSGD yields the best convergence performance once the ﬁrst-order information is available.
In Fig.
1-(c) and (d), we observe that the convergence performance of ZO algorithms is improved as b and q increase.
In particular, ZO-signSGD and ZO-M-signSGD at b = q = 30 approach to the best result provided by signSGD.
In Fig.
1-(e) and (f), the convergence of all algorithms degrades as the problem size d increases.
However, ZO-signSGD and ZO-M-signSGD converge faster than ZO-SGD and ZO-SCD.
In Fig.
2, we demonstrate the convergence trajectory of different variants of ZO-signSGD for b ∈ { 40 , 400 } .
To make a fair comparison between ZOsignSGD and ZO-D-signSGD, let each of M = 40 agents use a mini-batch of size b/M .
As we can see, ZO-signSGD outperforms ZO-M-signSGD and ZO-D-signSGD.
And the convergence is improved as the mini-batch size increases.
However, we observe that in all examples, ZO-signSGD [Figure] and its variants converge to moderate accuracy much faster than ZO-SGD, only within a few tens of iterations.
Generating black-box adversarial examples
Here we study adversarial robustness by generating adversarial examples from a black-box image classiﬁer trained by a deep neural network (DNN) model; see details on problem formulation in Appendix 8.2.
We recall from Sec.
2 that the task of black-box adversarial attack falls within the category of ZO optimization as one can only access to the input-output relation of the DNN while crafting adversarial examples.
The DNN models trained on MNIST and CIFAR-10 (Carlini & Wagner, 2017) are performed as the zeroth-order oracle 2 .
We select one image from each class of MNIST and CIFAR-10 and separately implement black-box attacks using the same attacking loss function (see Appendix 8.2) but with different ZO optimization algorithms (ZO-SGD, ZO-signSGD and ZO-M-signSGD).
We also set the same parameters for each method, i.e., µ = 0 .
01 , q = 9 , and δ = 0 .
for MNIST and δ = 0 .
0005 for
CIFAR-10, to accommodate to the dimension factor d .
Moreover, we benchmark their performance with the natural evolution strategy (NES) based two-point gradient estimator in (Ilyas et al., 2018a) for solving the same attacking loss function, where the sign of gradient estimate is also used in the
[Table]
descent step.
We call the resulting black-box attack generation method ‘ZO-NES’.
Similar to (10),
NES computes the ZO gradient estimate using the central difference of two function values.
Thus, one iteration of ZO-NES requires 2 q function queries and thus we set q = 5 to align with the number of function queries used in other ZO methods.
All methods use the the same natural image as the initial point for ﬁnding adversarial examples.
Fig.
3 shows the plots of black-box attacking loss versus iterations (more results are shown in
Appendix 8.3).
We ﬁnd that ZO-signSGD usually takes signiﬁcantly less iterations than other methods to ﬁnd the ﬁrst successful adversarial example with a similar attacking loss.
For MNIST, the average iteration over all attacked images in Table A1 to ﬁnd the ﬁrst successful adversarial example is 184 for ZO-SGD, 103 for ZO-signSGD, 151 for ZO-M-signSGD, and 227 for ZO-NES.
Their corresponding average (cid:96) 2 distortion is 2 .
345 for ZO-SGD, 2 . 381 for ZO-signSGD, 2 .
418 for ZO-MsignSGD, and 2 .
488 for ZO-NES.
For CIFAR-10, the average iteration over all attacked images in
Table A2 to ﬁnd the ﬁrst successful adversarial example is 302 for ZO-SGD, 250 for ZO-signSGD, 389 for ZO-M-signSGD, and 363 for ZO-NES.
Their corresponding average (cid:96) 2 distortion is 0 .for
ZO-SGD, 0 .
208 for ZO-signSGD, 0 .
219 for ZO-M-signSGD, and 0 .
235 for ZO-NES.
As a visual illustration, we compare the adversarial examples of a hand-written digit “1” of each attacking method at different iterations in Table 1, corresponding to Fig.
3-(a).
As we can see, ZO-signSGD and
ZO-M-signSGD can reduce roughly 54% of iterations (around 600 less model queries) than ZO-SGD to ﬁnd the ﬁrst successful adversarial example.
Given the ﬁrst successful adversarial example, we observe that ZO-signSGD yields slightly higher (cid:96) 2 distortion than ZO-SGD.
This is not surprising since Theorem 1 suggests that ZO-signSGD might not converge to a solution of very high accuracy but it can converge to moderate accuracy sufﬁcient for black-box attacks at a very fast speed.
Note that the ﬁrst successful adversarial examples generated by different ZO methods are all visually similar to the original ones but lead to different top-1 predictions; see more results in Appendix 8.3.
In addition, we observe that ZO-NES is not as effective as ZO-signSGD in either query efﬁciency (given by the number of iterations to achieve the ﬁrst successful attack) or attack distortion.
Thus, compared to ZO-NES, ZO-signSGD offers a provable and an efﬁcient black-box adversarial attacking method.
C ONCLUSION
Motivated by the impressive convergence behavior of (ﬁrst-order)
signSGD and the empirical success in crafting adversarial examples from black-box ML models, in this paper we rigorously prove the
O ( √ d/ √ T ) convergence rate of ZO-signSGD and its variants under mild conditions.
Compared to signSGD, ZO-signSGD suffers a slowdown (proportional to the problem size d ) in convergence rate, however, it enjoys the gradient-free advantages.
Compared to other ZO algorithms, we corroborate the superior performance of ZO-signSGD on both synthetic and real-word datasets, particularly for its application to black-box adversarial attacks.
In the future, we would like to generalize our analysis to nonsmooth and nonconvex constrained optimization problems.
A CKNOWLEDGMENTS
This work was supported by the MIT-IBM Watson AI Lab.
A PPENDIX M OTIVATING E XAMPLES OF F AST C ONVERGENCE OF ZO- SIGN SGD 1. E XAMPLE OF SPARSE NOISE PERTURBATION
We consider to minimize the function f ( x ) = 12 (cid:107) x (cid:107) 22 .
Similar to (Bernstein et al., 2018, FigureA.1), we assume that the ZO gradient estimate of f ( x ) and its ﬁrst-order gradient ∇ f ( x ) =
x suffer from a sparse noise vector v , where v 1 ∈ N (0 , 100 2 ) , and v i =
for i ≥ 2 .
As a result, the used descent direction at iteration t is given by ˆ ∇ f ( x t ) + v or ∇ f ( x t ) + v .
Fig.
A1 presents the convergence performance of 5 algorithms: SGD, signSGD, ZO-SGD, ZO-signSGD and its variant using the central difference based gradient estimator (10).
Here we tune a constant learning rate ﬁnding 0 .
001 best for SGD and ZO-SGD and 0 .
01 best for signSGD and its ZO variants.
As we can see, sign-based ﬁrst-order and ZO algorithms converge much faster than the stochastic gradient-based descent algorithms.
This is not surprising since the presence of extremely noisy component vleads to an inaccurate gradient value, and thus degrades the convergence of SGD and ZO-SGD.
By contrast, the sign information is more robust to outliers and thus leads to better convergence performance of sign SGD and its variants.
We also note that the convergence trajectory of ZO-signSGD using the gradient estimator (10) coincides with that using the gradient estimator (3) given by the forward difference of two function values.
1. S TATISTICS OF GRADIENT ESTIMATES
The intuition behind why ZO-signSGD could outperform ZO-SGD is that the sign operation can mitigate the negative effect of (coordinate-wise) gradient noise of large variance.
To conﬁrm this point, we examine the coordinate-wise variance of gradient noises during an entire training run of the binary classiﬁer provided in the ﬁrst experiment of Sec.6.
At each iteration, we perform an additional 100 random trials to obtain the statistics of gradient estimates.
In Fig.
A2-(a), we present the (cid:96) 1 norm of the mean of gradient estimates (over 100 trials) versus the number of iterations.
As we can see, both signSGD and ZO-signSGD outperform SGD and ZO-SGD, evidenced by a fast decrease of the (cid:96) 1 norm of gradient estimate.
In Fig.
A2-(b), we present the coordinate-wise gradient noise variance (over 100 trails at each coordinate) against the number of iterations.
It is not surprising that compared to ﬁrst-order methods, ZO methods suffer gradient noise of larger variance.
In this scenario, we could beneﬁt from ZO-signSGD since taking the sign of gradient estimates might scale down extremely noisy components.
Indeed, we observe a signiﬁcant decrease of the noise variance while performing ZO-signSGD compared to ZO-SGD.
[Figure]
P ROOF OF P ROPOSITION
Based on the deﬁnition of the smoothing function f µ , for any x and y we have
[Equation]
where the ﬁrst inequality holds due to Jensen’s inequality, and the second inequality holds due to A1.
It is known from (15) that f µ has L -Lipschitz continuous gradient.
By the L -smoothness of f µ , we obtain that
[Equation]
(cid:54)
=
sign(( ∇ f µ ( x k )) [Equation] )] , (16) where ( ∇ f µ ( x ))
i denotes the i th element of ∇ f µ ( x ) .
Taking expectation for both sides of (16), we obtain that
[Equation]
Similar to (Bernstein et al., 2018, Theorem1), we relax Prob [sign(ˆ g k,i ) (cid:54) =
sign(( ∇ f µ ( x k )) i )] by Markov’s inequality,
Prob
[Equation]
Substituting (18) into (17), we obtain
[Equation]
where the second inequality holds due to (cid:107) x (cid:107) 1 ≤ √ d (cid:107) x (cid:107) [Equation] and the last inequality holds by applying Jensen’s inequality to the concave function √· , i.e., E [
[Equation]
∇
[Equation]
Taking sum of both sides of (19), we then obtain (5).
[Equation]
P ROOF OF P ROPOSITION
We recall from (3) that
[Equation]
Let z i := ˆ ∇ f i ( x k ) − ∇ f µ ( x k ) and z i,j = ˆ ∇ f i ( x k ; u i,j ) − ∇ f µ ( x k ) .
Thus,
[Equation]
where there are two sources of randomness: a) minibatch sampling i
∈
I k , and b) the random direction sampling u
= u i,j .
Note that these two sources of randomness are independent, and the random direction samples { u i,j } are i.i.d..
Next, we discuss two types of mini-batch sampling: a) mini-batch samples without replacement, and b) mini-
batch samples with replacement.
Suppose that I k is a uniform random subset of [ n ] (no replacement), motivated by (Lei et al., 2017, Lemma A.1) we introduce a new variable W i
=
I ( i ∈ I k ) , where I is an indicator function, and I ( i ∈ I k )
= 1 if i ∈ I k , and 0 otherwise.
As a result, we have
[Equation]
From (21), the variance of ˆ g k is given by
E
[Equation]
(cid:13)(cid:13)(cid:13) (cid:13)(cid:13)(cid:13) b (cid:88)
i ∈I k
[Equation]
(cid:13)(cid:13)(cid:13) (cid:13)(cid:13)(cid:13)
[Equation]
b
[Equation]

[Equation]
] E u [ (cid:107) z i (cid:107) 22 ] (cid:1) + (cid:88) i (cid:54) =
j
E i,j ∈I k
[ W i W j ] (cid:104) E u [ z i ] , E u
[ z j ] (cid:105) 
 = 1 b(cid:32) b n n (cid:88) i =
E u [ (cid:107) z
i (cid:107) 22 ] + b ( b − 1) n ( n − 1) (cid:13)(cid:13)(cid:13)(cid:13)(cid:13) n (cid:88) i =
E u
[ z i ] (cid:13)(cid:13)(cid:13)(cid:13)(cid:13)  − b ( b − 1) n ( n − 1) n (cid:88)
i =
(cid:107) E u
[ z i ] (cid:107)(cid:33) ( a ) =bn n (cid:88) i =
E u [ (cid:107) z
i (cid:107) 22 ] − b −b ( n − 1) n n (cid:88) i
= (cid:107) E u
[ z i ] (cid:107)= 1 bn n (cid:88) i =
E u [ (cid:107) z
i (cid:107) 22 ] − b −b ( n − 1) n n (cid:88) i =
E u [ (cid:107) z
i (cid:107) 22 ] + b −b ( n − 1) n n (cid:88) i = (cid:0) E u
[ (cid:107) z
i (cid:107) 22 ] − (cid:107) E u
[ z i ] (cid:107) 22 (cid:1) ( b ) = n − b ( n − 1) bn n (cid:88) i =
E u [ (cid:107)
[Equation] ] +
[Equation]
In (23), the equality (a) holds since E u [ z i ]
= ∇ f i,µ ( x k ) − ∇ f µ ( x k ) and f µ ( x ) = 1 n (cid:80) ni
=1 f i,µ ( x ) from (4), where we have used the fact that E u [ ˆ ∇ f i ( x k )]
= ˆ ∇ f i,µ ( x k ) (Liu et al., 2018c, Lemma.1), and recall that f i,µ denotes the smoothing function of f i .
The above implies that (cid:80) ni
=1 E u
[ z i ] =
(cid:80) i ∇ f i,µ ( x k ) − n ∇ f µ ( x k ) = 0 .
And the equality (b) holds due to E u
[ (cid:107) z
i (cid:107) 22 ] − (cid:107) E u
[ z i ] (cid:107)
= E u (cid:107)
z i − E u
[ z i ] (cid:107) 22 .
On the other hand, suppose that the mini-batch I k contains i.i.d.
samples (namely, with replacement), the vectors { z i } are then i.i.d.
under both mini-batch sampling and random direction sampling.
Therefore, we obtain that
[Equation]
[Table]
[Equation]
[Table]
[Equation]
(24) where the second equality holds since E i ∈I k , u
[ z i
[Equation]
=
[Equation]
n
[Equation]
x k
[Equation]
= 0 .
Combining both (23) and (24), we obtain that E
[Table]
[Equation]
[Table]
[Equation]
[Table] [Equation] [Table] [Equation]
[Table]
[Equation]
In (25), α b = 1 and β b = 0 if the mini-batch contains i.i
[Table]
d. samples from [ n ] with replacement, and α b = I ( b < n ) and β b = I ( b > 1) if samples are randomly selected without replacement. In (25), we next bound
[Table]
n
[Equation]
[Table]
[Equation]
[Table] [Equation] [Table] [Equation]
[Table] [Equation] [Table] [Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
(26) where we have used the facts that E u [ z i,j ] =
E u
[ z i, 1 ] and E u [ (cid:107)
z i,j (cid:107) 22 ] =
E u
[ (cid:107) z
i, 1 (cid:107) 22 ] for any j since random direction vectors { u i,j } qj =1 are i.i.d.
samples.
In (26), we further bound (cid:80) i E u
[ (cid:107) z
i [Equation] 1 (cid:107) 22 ] ,
[Equation]
∇ f µ
[Equation]
[Equation]
[Equation]
where for ease of notation, let ˆ ∇ f i :
= ˆ ∇ f i ( x k ; u i, 1 ) , ˆ ∇ f i,µ : = ˆ ∇ f i,µ ( x k ) and ∇ f µ := ∇ f µ ( x k ) .
According to (Liu et al., 2018c, Lemma1), the ﬁrst term at RHS of (27) yields
[Equation]
where the last inequality holds due to A2.
Based on the deﬁnition of f µ , the second term at RHS of (27) yields
[Equation]
where we have used the Jensen’s inequality and 1 n (cid:80) ni
=1 (cid:107)∇ f i ( x ) − ∇ f ( x ) (cid:107) 22 ≤ 4 σ 2 under A2.
Substituting (28) and (29) into (27), we have
[Equation]
where C ( d, µ ) was deﬁned in (28).
We are now ready to bound (26).
Based on 1 n (cid:80) i (cid:107) E
[Equation]
[Equation]
=
[Equation]
(cid:107)∇ f
[Equation]
µ [Equation] ∇ f
[Equation]
22 ≤ 4 σ 2 from (29), and substituting (30) into (26), we obtain that
[Equation]
In (25), we also need to bound E u
[ (cid:107)
[Equation]
where the equality (a) holds since E u
[Equation]
) for any j , given by (Liu et [Equation] 2018c, Lemma1).
Substituting (31) and (32) into (25)
[Equation]
P ROOF OF T HEOREM
Substituting (6) into (5), we obtain
E
[Equation]
It is known from (Liu et al., 2018c, Lemma1) that
[Equation] [Equation]
From (35) we have f µ ( x 0 ) − f ( x 0 ) ≤ µ 2 L 2 and f ∗ − f ∗ µ ≤ µ 2 L 2 , where f ∗ µ = min x f µ ( x ) and f ∗ =
min x f ( x ) .
This yields f µ ( x 0 ) − f ( x 0 ) + f ∗ − f ∗ µ ≤ µ 2 L , and thus f
[Equation]
Substituting (36) into (34), we obtain
E (cid:34)
[Equation]
Due to (cid:107)∇ f µ ( x k ) (cid:107) 2 ≤ (cid:107)∇ f µ ( x k ) (cid:107) 1 and dividing (cid:80) T − 1 k =
δ k for both sides of (37), we obtain that
E
[Equation]
[Equation]
By introducing the random variable R with probability P
( R = k ) =
[Equation]
k , we then obtain that
[Equation]
Based on (35), we further have
[Equation]
where we have used the fact that √ a 2 + b 2 ≤ ( a + b ) for a, b ≥ 0 .
Substituting (38) and (39) into (40), we ﬁnally obtain (8).
[Equation]
P ROOF OF C OROLLARY
Upon deﬁning ˜ ∇ f i ( x ; u ) =
d [ f i ( x + µ u ) − f i ( x − µ u )] u 2 µ (against ˆ ∇ f i ( x ; u ) in (3)), our major task is to derive the ﬁrst- and second-order moments of ˜ ∇ f i ( x ; u ) .
Given x , we ﬁrst study the mean of ˜ ∇ f i ( x ; u ) ,
[Equation]
where (a) holds since the distribution of u is symmetric around the origin, (b) holds since E [ u ] = 0 , and (c) holds since ∇ f i,µ ( x )
=
E u (cid:104) dµ f i ( x + µ u ) u (cid:105) obtained from (Gao et al., 2014, Lemma4.1).
It is clear from (41) that E u (cid:104) ˜ ∇ f i ( x ; u ) (cid:105) =
E u (cid:104) ˆ ∇ f i ( x ; u ) (cid:105) .
We next study the second-order moment of ˜ ∇ f i ( x ; u ) ,
[Equation]
where we have used the fact that (cid:107) u (cid:107) 2 = 1 .
Based on (41) and (42), we can conclude that both (3) and (10) maintain the same statistical properties.
Following the proofs of Proposition2 and Theorem1, it is not difﬁcult to reach the convergence rate in (8).
[Equation]
P ROOF OF C OROLLARY
Let ˆ g i,jk := ˆ ∇ f i ( x k ; u i,j ) .
If we replace ˆ g k with ˆ g i,jk in (18), we then have
[Equation]
where ˆ g i,jk,l is the l th coordinate of ˆ g i,jk .
By letting b = 1 and q = 1 in Proposition2, we know that E (cid:2) (cid:107) ˆ g i,jk − ∇ f µ ( x k ) (cid:107) 22 (cid:3) is upper bounded.
Moreover, by Jensen’s inequality we have
[Equation]
where ξ l is ﬁnite since E (cid:2) (cid:107)
ˆ g i,jk − ∇ f µ ( x k ) (cid:107)
cid:3) is upper bounded.
Substituting (44) into (43), we have
[Equation]
With the new gradient estimate ¯ g k = (cid:80) [Equation] ∈I k
[Equation]
qj =1 sign(ˆ g i,jk ) in (11), we require to bound
[Equation]
where ¯ g k,l is the l th coordinate of ¯ g k .
We recall that ˆ g i,jk,l is an unbiased stochastic approximation to gradient component ( ∇ f µ ( x k ))
l with variance ξ 2 l .
Under the assumption that the noise distribution is unimodal and symmetric, we know from (Bernstein et al., 2018, LemmaD1)
that
[Equation]
where S :
= | ( ∇ f µ ( x k ))
l | /ξ l .
Let Z count the number of estimates { ˆ g i,jk,l } yielding the correct sign of (( ∇ f µ ( x k )) l .
Thus, the probability of error in (46) is equal to
Prob [sign
[Equation]
[Equation]
Following the proof of (Bernstein et al., 2018, Theorem2b) under (47), it is not difﬁcult to obtain that
[Equation]
That is,
[Equation]
Replace ˆ g k with ¯ g k in (17), we obtain that
[Equation]
Compared (51) with (19), the standard deviation (cid:113) E [ (cid:107) ˆ g i,jk − ∇ f µ ( x k ) (cid:107) 22 ] is reduced by the factor 1 / √ bq .
According to Proposition2, let b = q = 1 , we obtain
E
[Equation]
Based on (51)-(52) and following the proof of Theorem1, we have
[Equation]
where C ( d, µ ) :
=
2 dσ 2 + µ 2 L 2 d 2 / 2 .
If µ = O ( 1 √ dT ) and δ k
= O ( 1 √ dT ) , then the convergence rate simpliﬁes to O ( √ d √ T + d √ bq ) .
(cid:3)
P ROOF OF C OROLLARY
Let ˆ g mk := 1 b m q (cid:80) i ∈I m,k (cid:80) qj =1 ˆ ∇ f i ( x k ; u i,j ) and ¯ g k = 1 M (cid:80)
Mm =1 sign(ˆ g mk ) .
Following (43)-(50), we can similarly obtain that
[Equation]
where ξ l := (cid:113) E [(ˆ g mk,l − ( ∇ f µ ( x k )) l ) 2 ] .
By mimicking the derivation in (51), we have
[Equation]
According to Proposition2, let b = (cid:98) n/M (cid:99) , we obtain
[Equation]
Based on (55)-(56) and following the proof of Theorem1, we have
[Equation]
where
C ( d, µ ) :
=
2 dσ 2 + µ 2 L 2 d 2 / 2 .
Since µ = O ( 1 √ dT ) , δ k = O ( 1 √ dT ) and bM ≈ n , then the convergence rate simpliﬁes to O ( √ d √ T + √ d √ n + d √ nq ) .
(cid:3)
S UPPLEMENTAL E XPERIMENTS 8. S YNTHETIC EXPERIMENTS
In Fig.
A3, we demonstrate the effect of the learning rate δ on the training loss of SGD, signSGD, ZO-SGD, ZO-SCD, ZO-signSGD and ZO-M-signSGD.
We observe that compared to the gradient-based algorithms (SGD,
ZO-SGD and ZO-SCD)
, the gradient sign-based algorithms support a more ﬂexible choice of learning rates (corresponding to less variance), since the sign operation has an normalization effect to reduce oscillations in convergence.
We ﬁnd δ = 0 .
1 best for SGD, δ = 0 .
009 best for signSGD, δ = 0 .
1 best for ZOSGD and
ZOSCD, δ = 0 .
0178 best for ZOsignSGD, and δ = 0 .
0501 best for ZO-M-signSGD.
8. B LACK - BOX ATTACK FORMULATION
The target DNN classiﬁer F =
[ F 1 , F 2 , . . .
, F K ] takes an image as an input and produces the classiﬁcation predictions (here the probability distribution) of K image classes, where F k denotes the prediction of class k .
Given F , an adversarial example x of a legitimate example x 0 means it is visually similar to x 0 but will yield a different top-1 prediction than x 0 .
Let ( x 0 , t 0 ) denote a legitimate image x 0 and its groundtruth label t 0 ∈ { 1 , 2 , . .
. , K } .
Without loss of generality, we assume the pixel value range of x 0 lies within [ − 0 .
5] d .
By using the tanh transformation on the adversarial image x such that x = tanh( w ) / 2 , where w ∈ R d , we adopt the untargeted black-box attacking loss designed in (Chen et al., 2017), which is deﬁned as minimize
[Equation]
(58) where c is a regularization coefﬁcient and x = tanh( w ) / 2 ensures x lies within the valid image space [ − 0 .
5] d .
The ﬁrst term in the attacking objective is a hinge loss function that penalizes the top-1 prediction of x being t 0 .
The log F ( · ) operation preserves the class prediction ranking and better handles numerical stability.
The second term encourages the visual similarity between x and x 0 through penalizing their squared (cid:96)difference (i.e., the squared distortion).
In our experiment, we set c = 1 for MNIST and c = 0 .
1 for CIFAR-10.
We also note that different from the use of signed gradients in existing black-box attacks (e.g., Ilyas et al.
(2018a);
Bhagoji et al.
due to the explicit (cid:96) ∞ perturbation constraint, the use and beneﬁt of ZO-signSGD for solving (58) in our experiment are non-trivial since the attacking objective does not impose any (cid:96) ∞ constraint.
8. A DDITIONAL BLACK - BOX ATTACKING RESULTS ON MNIST AND CIFAR-
Image ID
Original
Classiﬁed as
ZO-SGD
Classiﬁed as
ZO-signSGD
Classiﬁed as
ZO-M-signSGD
Classiﬁed as
ZO-NES
Classiﬁed as
[Table] [Table]
Classiﬁed as
[Table]
Classiﬁed
[Table]
[Table]
ZO
[Table]
M
[Table]
signSGD
Classiﬁed as
[Table]
ZO
[Table]
NES
Classiﬁed as
[Table]
[Figure] [Figure]