Dice Projected Gradient Descent (DPGD)

• DPGD is a context-dependent projected gradient method that adapts its formulation across adversarial robustness, distributed optimization, and low-rank challenges.
• In adversarial robustness, DPGD dynamically reweights losses over correctly and misclassified samples to generate more effective adversarial examples for model distillation.
• In distributed and low-rank settings, DPGD leverages projection techniques—either gradient-free updates or dual projections—to ensure convergence and stationarity.

Searching arXiv for the cited DPGD-related papers and terminology to ground the article in current records. Dice Projected Gradient Descent (DPGD) is a polysemous term whose meaning depends on research context. In adversarial robustness, it denotes an attack-specific variant of $\ell_\infty$-projected gradient descent introduced within Dice Adversarial Robustness Distillation (DARD), where the PGD loss is split between correctly classified and misclassified samples and reweighted across iterations (Zou et al., 15 Sep 2025). Earlier literature used the acronym DPGD for online gradient-free distributed projected gradient descent in time-varying multi-agent optimization (Pang et al., 2019) and for decentralized projected gradient descent in constrained decentralized optimization (Choi et al., 2023). In low-rank optimization, the related expression “Dice-PGD” or projected-projected gradient descent refers to a two-projection scheme on the determinantal variety, combining a projection of $-\nabla f(X)$ onto the tangent cone with a projection back onto the feasible low-rank set (Olikier et al., 2022). The term therefore does not identify a single canonical algorithm across arXiv literature.

1. Terminology and scope

The strongest current match to the literal phrase “Dice Projected Gradient Descent” appears in the DARD framework, which introduces DPGD as “an adversarial example generalization method optimized for effective attack” (Zou et al., 15 Sep 2025). In that usage, DPGD is a training-time adversarial attack designed for robustness distillation rather than a distributed optimization method.

At the same time, the acronym DPGD has an established earlier history in optimization. In “Randomized Gradient-Free Distributed Online Optimization via a Dynamic Regret Analysis,” DPGD stands for “online gradient-free distributed projected gradient descent” on a strongly connected directed graph, with Gaussian smoothing and dynamic regret guarantees (Pang et al., 2019). In “On the convergence analysis of the decentralized projected gradient descent method,” the paper uses “DPG” in the text, but the method matches what is typically called decentralized projected gradient descent, with convergence to an $O(\sqrt{\alpha})$-neighborhood in general convex domains, an $O(\alpha)$-neighborhood in a half-space case, and exact convergence under diminishing step sizes (Choi et al., 2023). In “Low-rank optimization methods based on projected-projected gradient descent that accumulate at Bouligand stationary points,” the phrase “Dice-PGD / DPGD” is used for a projected-projected scheme in which the “double projection” structure is central (Olikier et al., 2022).

Usage	Core meaning	Paper
Dice Projected Gradient Descent	$\ell_\infty$ PGD variant for adversarial example generation	(Zou et al., 15 Sep 2025)
Distributed Projected Gradient Descent	Online gradient-free distributed projected descent with regret analysis	(Pang et al., 2019)
Decentralized Projected Gradient Descent	Constrained decentralized optimization with projection	(Choi et al., 2023)
Dice-PGD / Projected-Projected Gradient Descent	Tangent-cone projection plus feasible-set projection for low-rank optimization	(Olikier et al., 2022)

A recurrent misconception is that DPGD is a universally standardized name. The literature instead shows a context-dependent acronym, with materially different update rules, objectives, and guarantees.

2. DPGD in adversarial robustness distillation

In the DARD framework, DPGD is described as an attack-specific variant of $\ell_\infty$-PGD designed to generate stronger and more “useful” adversarial examples for robustness distillation than standard PGD (Zou et al., 15 Sep 2025). The motivation has two parts. First, standard PGD optimizes a cross-entropy loss uniformly over examples, whereas DPGD explicitly separates correctly predicted and misclassified samples. Second, adversarial examples are the main training data for the student model in DARD, so the quality and diversity of generated perturbations directly affect distillation.

The backbone remains standard $\ell_\infty$-bounded PGD. Given a natural input $\mathbf{x}_{\text{nat}}$ with label $\mathbf{y}$ and classifier $f$, the adversarial example is obtained from

$-\nabla f(X)$0

with projected gradient ascent

$-\nabla f(X)$1

DPGD modifies the loss inside this update.

The defining loss is

$-\nabla f(X)$2

with a time-varying weight

$-\nabla f(X)$3

Here, $-\nabla f(X)$4 is the loss on correctly classified examples and $-\nabla f(X)$5 is the loss on misclassified examples. Operationally, at early iterations $-\nabla f(X)$6, so the loss is dominated by correctly predicted samples; as $-\nabla f(X)$7 increases, the contribution of misclassified samples gradually grows. The paper describes the intended behavior as aggressively breaking initially correct examples early in the attack and later refining perturbations on already misclassified examples (Zou et al., 15 Sep 2025).

This correctness-based split can be written through the indicator

$-\nabla f(X)$8

With the partitions

$-\nabla f(X)$9

the batch loss becomes

$O(\sqrt{\alpha})$0

The paper emphasizes that, in this classification adaptation, “Dice” does not mean the classical segmentation Dice coefficient per se; it refers to the explicit partition and reweighting of correctly and incorrectly classified subsets across iterations (Zou et al., 15 Sep 2025).

3. Role within DARD and training objective

Within DARD, DPGD is not merely an evaluation attack. It is used to generate the adversarial examples that drive both teacher adversarial pretraining and student robustness distillation (Zou et al., 15 Sep 2025). The pipeline described in the paper has three stages. First, DPGD generates adversarial examples using the student model. Second, these DPGD adversarial examples are used to adversarially pretrain the teacher. Third, during student training, the student again generates adversarial examples via DPGD, while the teacher’s soft predictions on natural and adversarial inputs are averaged to form soft labels.

The teacher-side soft label combination is

$O(\sqrt{\alpha})$1

with $O(\sqrt{\alpha})$2 chosen as $O(\sqrt{\alpha})$3 in experiments. The student objective is given as

$O(\sqrt{\alpha})$4

where $O(\sqrt{\alpha})$5 are student parameters, $O(\sqrt{\alpha})$6 is cross-entropy on adversarial inputs, and $O(\sqrt{\alpha})$7 aligns student predictions on clean inputs with the teacher’s combined soft labels (Zou et al., 15 Sep 2025).

The best-performing DARD variant is described as using only adversarial examples for the $O(\sqrt{\alpha})$8 term, teacher soft labels averaged from both clean and adversarial inputs for the distillation term, and DPGD for generating adversarial examples. An alternative called TDARD jointly uses natural and adversarial inputs as training data, while PGDARD replaces DPGD with standard PGD. The reported ablation states that PGDARD underperforms full DARD, which the authors use as evidence that DPGD generates more effective training-time adversarial examples (Zou et al., 15 Sep 2025).

The implementation details specified in the experimental section are an $O(\sqrt{\alpha})$9 threat model with $O(\alpha)$0, number of steps $O(\alpha)$1, step size $O(\alpha)$2, and the dynamic schedule $O(\alpha)$3. The text also mentions “dynamic step-size tuning and channel-wise gradient masking” in the contributions list, but does not provide explicit formulas or implementation details in the main text (Zou et al., 15 Sep 2025).

4. Empirical behavior and relation to standard attacks

Relative to standard PGD, DPGD keeps the same projected sign-gradient update but changes the optimization objective from a single uniform loss to a two-part loss with dynamic weighting (Zou et al., 15 Sep 2025). Standard PGD treats every sample identically at every iteration; DPGD instead changes emphasis over time, first focusing on correctly classified examples and later increasing attention to already misclassified examples. The paper presents this as a mechanism for producing stronger and more informative adversarial examples for robustness distillation.

The reported robustness evaluations are conducted under standard attacks rather than DPGD itself. The paper lists FGSM, PGD, BIM, T-PGD, and AutoAttack as evaluation attacks, and tables report results under clean accuracy, PGD20, BIM, and AutoAttack (Zou et al., 15 Sep 2025). For ResNet-18 on CIFAR-10, the reported clean accuracy is $O(\alpha)$4 for SAT, $O(\alpha)$5 for ARD, and $O(\alpha)$6 for DARD; under PGD20 the reported accuracies are $O(\alpha)$7, $O(\alpha)$8, and $O(\alpha)$9; under BIM they are $\ell_\infty$0, $\ell_\infty$1, and $\ell_\infty$2; under AutoAttack they are $\ell_\infty$3, $\ell_\infty$4, and $\ell_\infty$5, respectively (Zou et al., 15 Sep 2025). For CIFAR-100 under PGD20, the reported accuracies are $\ell_\infty$6 for SAT, $\ell_\infty$7 for ARD, and $\ell_\infty$8 for DARD (Zou et al., 15 Sep 2025).

The empirical claim attached to DPGD is therefore indirect but specific: training with DPGD inside DARD yields models that are more robust under external attacks than the same distillation framework using standard PGD. The paper does not isolate a standalone attack success rate comparison between DPGD and PGD; instead, the ablation is framed through downstream robustness and convergence behavior (Zou et al., 15 Sep 2025).

A second common misconception concerns the word “Dice.” In this adversarial setting, the paper does not define a literal Dice coefficient loss for classification. The “Dice” component is the correctness-based partition of the minibatch and the dynamic reweighting schedule applied to the two resulting subsets (Zou et al., 15 Sep 2025).

5. Earlier DPGD usage in distributed and decentralized optimization

Before the DARD formulation, DPGD primarily denoted distributed or decentralized projected gradient methods. In the online distributed optimization setting, the 2019 paper studies a group of agents whose local objective functions vary with time and are revealed only after each decision is executed (Pang et al., 2019). No gradients are available, and each agent can only update from revealed scalar function values and neighbor information. The proposed algorithm is an online gradient-free distributed projected gradient descent method in which each agent approximates the gradient based on two point values and Gaussian smoothing.

For agent $\ell_\infty$9, the core update is

$\ell_\infty$0

together with the auxiliary surplus update

$\ell_\infty$1

Here $\ell_\infty$2 is the gradient-free oracle

$\ell_\infty$3

and the projection $\ell_\infty$4 enforces the convex compact constraint set $\ell_\infty$5 (Pang et al., 2019). The paper proves a dynamic regret bound as a function of minimizer path length, step size, and smoothing parameter, and shows that the dynamic regret is sublinear in $\ell_\infty$6 if the minimizer path length also grows sublinearly. It also gives the rate

$\ell_\infty$7

under the choice $\ell_\infty$8, $\ell_\infty$9, $\ell_\infty$0, and $\ell_\infty$1 (Pang et al., 2019).

In the constrained decentralized setting, the 2023 paper analyzes

$\ell_\infty$2

with a symmetric doubly stochastic mixing matrix $\ell_\infty$3, connected undirected graph, $\ell_\infty$4-smooth local functions, and $\ell_\infty$5-strongly convex aggregate objective (Choi et al., 2023). Under constant sufficiently small step size, each $\ell_\infty$6 converges to an $\ell_\infty$7-neighborhood of the optimal point in a general convex closed domain. If the domain is the half-space $\ell_\infty$8, with optimizer on the boundary and positive normal derivative, the neighborhood improves to $\ell_\infty$9. For diminishing step sizes $\mathbf{x}_{\text{nat}}$0, the method achieves exact convergence with $\mathbf{x}_{\text{nat}}$1 for $\mathbf{x}_{\text{nat}}$2 and $\mathbf{x}_{\text{nat}}$3 for $\mathbf{x}_{\text{nat}}$4 (Choi et al., 2023).

Neither of these papers uses “Dice” as the formal expansion of DPGD. Their relevance lies in showing that the acronym had a well-developed earlier meaning centered on projected gradient methods over networks.

6. Dice-PGD as projected-projected gradient descent in low-rank optimization

A different line of work uses “Dice-PGD / DPGD” for projected-projected gradient descent on the real determinantal variety

$\mathbf{x}_{\text{nat}}$5

where the objective is to minimize a differentiable function with locally Lipschitz continuous gradient over matrices of upper-bounded rank (Olikier et al., 2022). The key geometric object is the tangent cone $\mathbf{x}_{\text{nat}}$6, and the associated stationarity measure is

$\mathbf{x}_{\text{nat}}$7

A point is stationary precisely when $\mathbf{x}_{\text{nat}}$8, which is equivalent to Bouligand stationarity.

The projected-projected step has two projections. First, $\mathbf{x}_{\text{nat}}$9 is projected onto the tangent cone to obtain a feasible first-order descent direction

$\mathbf{y}$0

Second, after taking a step $\mathbf{y}$1, the method projects back onto $\mathbf{y}$2,

$\mathbf{y}$3

with backtracking line search enforcing the Armijo condition

$\mathbf{y}$4

This double-projection structure is the source of the “projected-projected” terminology (Olikier et al., 2022).

The paper then extends this basic step with rank reduction. Given the numerical rank $\mathbf{y}$5, it considers lower-rank projections $\mathbf{y}$6 and applies one projected-projected step from each candidate, selecting the one with minimum objective value. The main theorem states that if the sequence is finite, its last element is stationary, and if it is infinite, each accumulation point is stationary, i.e., a zero of $\mathbf{y}$7 (Olikier et al., 2022). The paper frames this as an apocalypse-free first-order method whose accumulation points are Bouligand stationary.

In this literature, “Dice” is tied neither to distributed consensus nor to adversarial robustness. It denotes, informally, the double projection operation and, in the rank-reduced variant, the trial of multiple projected candidates across ranks (Olikier et al., 2022).

7. Conceptual synthesis

Across these papers, DPGD designates three distinct projected-gradient constructions. In adversarial robustness, it is an $\mathbf{y}$8 attack with a dynamically reweighted two-part loss over correct and incorrect samples (Zou et al., 15 Sep 2025). In distributed and decentralized optimization, it is a constrained multi-agent projected gradient method, gradient-free in the online directed-graph setting (Pang et al., 2019) and gradient-based in the strongly convex decentralized setting (Choi et al., 2023). In low-rank optimization, it is a projected-projected method on a singular algebraic variety, analyzed through tangent cones and Bouligand stationarity (Olikier et al., 2022).

The principal unifying feature is the presence of projection as a structural device: projection onto an $\mathbf{y}$9 perturbation set in adversarial attack generation, projection onto a feasible convex set in network optimization, and projection onto both tangent and feasible low-rank geometry in determinantal-variety optimization. Beyond that shared motif, the objectives, information models, convergence criteria, and meanings of “Dice” are not interchangeable.