Directed Gradient Sign Method (DGSM)

• DGSM is a sign-based gradient construction method that uses ℓ∞ geometry to define exact steepest descent directions in optimization and adversarial perturbations in control.
• In smooth optimization, it guarantees progress by updating along –sign(∇f) with performance governed by the ℓ∞-smoothness constant, L∞.
• In direct data-driven control, DGSM crafts stealthy adversarial attacks by perturbing offline data in a sign pattern aligned with eigenvalue sensitivities to destabilize systems.

Directed Gradient Sign Method (DGSM) denotes a sign-based gradient construction whose defining feature is an $\ell_\infty$ or elementwise-max geometry. In the literature covered here, the acronym appears in two technically distinct senses. In smooth optimization, DGSM is the $\ell_\infty$ steepest-descent method, with updates along $-\mathrm{sign}(\nabla f)$ and progress governed by the $\ell_\infty$-smoothness constant $L_\infty$ (Balles et al., 2020). In direct data-driven control, DGSM is an adversarial poisoning attack that perturbs offline data in a sign pattern aligned with eigenvalue or spectral-radius sensitivities of the synthesized closed loop, with the aim of reducing stability and possibly pushing eigenvalues outside the unit circle (Sasahara, 2023, Sasahara, 20 Jul 2025). The shared structure is a coordinatewise sign rule, but the underlying objectives differ: deterministic descent in one case, destabilization under stealthy perturbation budgets in the other.

1. Terminological scope and common geometric structure

The two uses of DGSM are linked by a common geometric intuition: the sign operator is natural when the constraint or smoothness model is coordinatewise, either through the norm ball $\{d:\|d\|_\infty\le 1\}$ or through an elementwise perturbation budget $\|\Delta\|_{\max}\le \varepsilon$ (Balles et al., 2020, Sasahara, 2023).

Usage	Core rule	Governing quantity
$\ell_\infty$ steepest descent	$x_{t+1}=x_t-\eta_t\,\mathrm{sign}(\nabla f(x_t))$	$L_\infty$, $\ell_\infty$0
Adversarial destabilization in control	$\ell_\infty$1 or $\ell_\infty$2	closed-loop eigenvalues, $\ell_\infty$3

In the optimization setting, the sign vector is an exact steepest-descent direction under $\ell_\infty$4 geometry. In the control setting, the same sign mechanism is made “directed” by a spectral projection that resolves the complex-valued direction in which an eigenvalue should be moved so that its modulus increases. This suggests that DGSM is best understood not as a single algorithmic template with a single objective, but as a class of sign-based procedures whose meaning is fixed by the geometry of the constraint set and the performance functional being differentiated.

2. DGSM as $\ell_\infty$5 steepest descent

For a differentiable $\ell_\infty$6, steepest descent with respect to a norm $\ell_\infty$7 selects a direction

$\ell_\infty$8

When $\ell_\infty$9, the feasible set is the hypercube $-\mathrm{sign}(\nabla f)$0, the linear objective decouples coordinatewise, and the minimizer is

$-\mathrm{sign}(\nabla f)$1

The canonical update is therefore

$-\mathrm{sign}(\nabla f)$2

and the norm-scaled steepest-descent form is

$-\mathrm{sign}(\nabla f)$3

The latter arises from minimizing a local quadratic upper bound and yields a constant-step guarantee (Balles et al., 2020).

The relevant smoothness notion is Lipschitz continuity of the gradient in the dual norm:

$-\mathrm{sign}(\nabla f)$4

which implies

$-\mathrm{sign}(\nabla f)$5

This replaces the more restrictive separable smoothness assumption used in earlier signSGD analyses. If constants $-\mathrm{sign}(\nabla f)$6 satisfy

$-\mathrm{sign}(\nabla f)$7

then separable smoothness implies $-\mathrm{sign}(\nabla f)$8-smoothness with $-\mathrm{sign}(\nabla f)$9. For sign steps, both assumptions yield the same bound because the update has equal coordinate magnitude (Balles et al., 2020).

The basic descent estimate for

$\ell_\infty$0

is

$\ell_\infty$1

The optimal step size is

$\ell_\infty$2

and the guaranteed decrease is

$\ell_\infty$3

This is the steepest-descent improvement lemma specialized to $\ell_\infty$4 geometry (Balles et al., 2020).

The same framework yields standard complexity bounds. For nonconvex deterministic DGSM,

$\ell_\infty$5

For convex $\ell_\infty$6 that is $\ell_\infty$7-smooth,

$\ell_\infty$8

where $\ell_\infty$9 is a norm-dependent radius of the initial level set. Under the Polyak–Łojasiewicz condition in the dual norm,

$L_\infty$0

DGSM with step $L_\infty$1 obeys

$L_\infty$2

3. Hessian geometry, comparison with gradient descent, and relation to adaptive methods

The geometry of DGSM is encoded in the Hessian through the operator norm identity

$L_\infty$3

where

$L_\infty$4

Although computing $L_\infty$5 is NP-hard in general, the cited analysis gives bounds that isolate when sign-based methods should outperform standard $L_\infty$6 gradient descent (Balles et al., 2020).

For positive semidefinite symmetric $L_\infty$7 with eigenvalues $L_\infty$8,

$L_\infty$9

where

$\{d:\|d\|_\infty\le 1\}$0

Hence $\{d:\|d\|_\infty\le 1\}$1 becomes smaller when the Hessian is concentrated on its diagonal, that is, when the objective is axis-aligned in the coordinate basis. For a general symmetric eigendecomposition

$\{d:\|d\|_\infty\le 1\}$2

the bound

$\{d:\|d\|_\infty\le 1\}$3

shows that large eigenvalues are less harmful when their eigenvectors are axis-aligned. A lower bound of the form

$\{d:\|d\|_\infty\le 1\}$4

is also available. In two dimensions, for

$\{d:\|d\|_\infty\le 1\}$5

positive definite,

$\{d:\|d\|_\infty\le 1\}$6

which makes the dependence on off-diagonal coupling explicit.

The global relationship to ordinary smoothness is

$\{d:\|d\|_\infty\le 1\}$7

with the upper bound loose in favorable geometries. When the spectrum has outliers, so that $\{d:\|d\|_\infty\le 1\}$8, and the Hessian is diagonally concentrated, the bound above gives $\{d:\|d\|_\infty\le 1\}$9. The paper identifies two favorable properties: diagonal concentration and spectral disparity. Both are reported as common in deep networks and as empirically correlated with strong performance of sign-based methods and Adam (Balles et al., 2020).

The per-step guaranteed improvements of gradient descent and DGSM are

$\|\Delta\|_{\max}\le \varepsilon$0

Defining

$\|\Delta\|_{\max}\le \varepsilon$1

the ratio becomes

$\|\Delta\|_{\max}\le \varepsilon$2

DGSM is therefore favored when gradients are dense, so that $\|\Delta\|_{\max}\le \varepsilon$3 is close to $\|\Delta\|_{\max}\le \varepsilon$4, and when the Hessian geometry shrinks $\|\Delta\|_{\max}\le \varepsilon$5 far below $\|\Delta\|_{\max}\le \varepsilon$6.

The same work also gives an interpretation of Adam as predominantly sign-based. Its update direction can be decomposed as

$\|\Delta\|_{\max}\le \varepsilon$7

with coordinatewise damping factors $\|\Delta\|_{\max}\le \varepsilon$8 that decrease with gradient variance. Empirical evidence in CNN training indicates that shuffling or averaging $\|\Delta\|_{\max}\le \varepsilon$9 across coordinates barely degrades Adam’s performance, which supports viewing Adam as a DGSM-like method augmented by momentum and mild per-coordinate normalization (Balles et al., 2020).

4. DGSM as an adversarial attack in direct data-driven control

In direct data-driven control, DGSM is an attack on the offline data used to synthesize a controller. The 2023 formulation studies Willems’ fundamental lemma-based LQR design for the discrete-time plant

$\ell_\infty$0

with unknown but stabilizable $\ell_\infty$1. Using measured trajectories, one forms

$\ell_\infty$2

assumes $\ell_\infty$3, and introduces $\ell_\infty$4 such that

$\ell_\infty$5

The resulting closed-loop matrix is

$\ell_\infty$6

so controller synthesis depends explicitly on the collected data $\ell_\infty$7 (Sasahara, 2023).

A later treatment writes the offline data as

$\ell_\infty$8

with

$\ell_\infty$9

and formulates data-driven LQR as an SDP in variables $x_{t+1}=x_t-\eta_t\,\mathrm{sign}(\nabla f(x_t))$0 with objective

$x_{t+1}=x_t-\eta_t\,\mathrm{sign}(\nabla f(x_t))$1

subject to a block-diagonal LMI $x_{t+1}=x_t-\eta_t\,\mathrm{sign}(\nabla f(x_t))$2. The synthesized controller is

$x_{t+1}=x_t-\eta_t\,\mathrm{sign}(\nabla f(x_t))$3

This formulation is used to differentiate the synthesis map exactly through the KKT system (Sasahara, 20 Jul 2025).

The adversarial objective is spectral. For discrete-time stability, the test is $x_{t+1}=x_t-\eta_t\,\mathrm{sign}(\nabla f(x_t))$4, so the poisoning problem is

$x_{t+1}=x_t-\eta_t\,\mathrm{sign}(\nabla f(x_t))$5

where $x_{t+1}=x_t-\eta_t\,\mathrm{sign}(\nabla f(x_t))$6 is the spectral radius and $x_{t+1}=x_t-\eta_t\,\mathrm{sign}(\nabla f(x_t))$7 is the elementwise max norm. A relative stealthiness variant constrains $x_{t+1}=x_t-\eta_t\,\mathrm{sign}(\nabla f(x_t))$8 relative to the norms of $x_{t+1}=x_t-\eta_t\,\mathrm{sign}(\nabla f(x_t))$9 (Sasahara, 20 Jul 2025). The design goal is not to increase a loss in the machine-learning sense, but to move a closed-loop eigenvalue toward and beyond the unit circle.

This difference from FGSM is central. FGSM uses

$L_\infty$0

whereas DGSM in control uses a spectral stability gradient. The attack exploits the fact that small but carefully aligned perturbations of offline data can induce a different synthesized gain $L_\infty$1 and a different closed-loop matrix $L_\infty$2 with possibly unstable eigenvalues, even when the clean closed loop has a large margin of stability (Sasahara, 2023).

5. Spectral gradients, directional projection, and algorithmic variants

The 2023 attack computes eigenvalue sensitivities numerically. For a simple eigenvalue $L_\infty$3 of $L_\infty$4 with right and left eigenvectors $L_\infty$5,

$L_\infty$6

and, for the spectral abscissa,

$L_\infty$7

Because the map from data to controller passes through a convex program, the paper does not derive $L_\infty$8 analytically. Instead it approximates

$L_\infty$9

by central differences, where $\ell_\infty$00 is a perturbation basis. The attack then applies a directional projection $\ell_\infty$01 so that the sign pattern pushes the chosen eigenvalue radially outward. The resulting perturbation rule is

$\ell_\infty$02

and the algorithm increases $\ell_\infty$03 over a candidate set until some $\ell_\infty$04 (Sasahara, 2023).

The 2025 work replaces numerical differentiation with implicit differentiation through the KKT conditions of the SDP layer. With $\ell_\infty$05 and $\ell_\infty$06 itself dependent on $\ell_\infty$07, the chain rule is

$\ell_\infty$08

For a simple dominant eigenvalue $\ell_\infty$09 of $\ell_\infty$10, with right and left eigenvectors $\ell_\infty$11,

$\ell_\infty$12

and

$\ell_\infty$13

Since $\ell_\infty$14, the gradient with respect to $\ell_\infty$15 follows immediately. The dependence of $\ell_\infty$16 on $\ell_\infty$17 is obtained by differentiating the KKT equalities, which yields a linear system in $\ell_\infty$18, $\ell_\infty$19, and $\ell_\infty$20. To avoid rank deficiency, the scalar complementarity relation is replaced by the matrix equality $\ell_\infty$21, producing an augmented KKT linearization (Sasahara, 20 Jul 2025).

The “directed” realization used for complex eigenvalues is explicit in the later work:

$\ell_\infty$22

Elementwise,

$\ell_\infty$23

so the sign of each perturbation component is chosen to increase the modulus of the dominant eigenvalue in the linearized model.

This formulation also introduces an iterative variant, I-DGSM, which performs projected gradient ascent:

$\ell_\infty$24

with

$\ell_\infty$25

and $\ell_\infty$26 implemented by elementwise clipping. Initialization is $\ell_\infty$27, a practical step size is $\ell_\infty$28, and stopping occurs when $\ell_\infty$29 or when the iteration cap is reached (Sasahara, 20 Jul 2025).

Algorithmically, the transition from numerical differentiation to implicit differentiation is decisive. Naive central differences require solving the SDP $\ell_\infty$30 times per gradient. The implicit-differentiation pipeline solves the SDP once, assembles KKT derivative blocks, solves one linear system, and then evaluates $\ell_\infty$31. Empirically this yields approximately $\ell_\infty$32 speedup relative to naive numerical differentiation, with an additional $\ell_\infty$33–$\ell_\infty$34 gain when analytical derivative expressions are used for the KKT blocks and the Jacobians of $\ell_\infty$35 (Sasahara, 20 Jul 2025).

6. Robustness, defenses, empirical findings, and limitations

The control literature studies DGSM together with defensive regularization. One family of defenses is certainty-equivalence regularization. In the 2023 formulation this adds

$\ell_\infty$36

to the synthesis objective, with

$\ell_\infty$37

under the original LMI constraints. A second 2023 defense is robustness-inducing regularization, which adds

$\ell_\infty$38

and is intended to reduce sensitivity to disturbances by shrinking $\ell_\infty$39 (Sasahara, 2023). The 2025 paper uses the Frobenius-squared certainty-equivalence regularizer

$\ell_\infty$40

in the SDP formulation and shows that it suppresses directions aligned with the null space of $\ell_\infty$41 while preserving control performance in benign settings (Sasahara, 20 Jul 2025).

A stronger 2025 defense is robust data-driven control against all perturbations satisfying $\ell_\infty$42, implemented through an S-procedure-based SDP with Lyapunov certificates and a nominal performance cap $\ell_\infty$43. The paper states two guarantees: if $\ell_\infty$44, then $\ell_\infty$45; if $\ell_\infty$46, then the closed loop is stable. The same work also proves a sufficient stability condition for the regularized synthesis in terms of the signal-to-perturbation ratio

$\ell_\infty$47

with stability ensured when

$\ell_\infty$48

Empirically, DGSM is consistently more effective than random perturbations. In the 2023 inverted-pendulum study, with $\ell_\infty$49 trials and threshold $\ell_\infty$50, the destabilizing budget $\ell_\infty$51 increases monotonically with both regularization parameters, yet DGSM remains far more potent than the random baseline: for the same $\ell_\infty$52, DGSM’s $\ell_\infty$53 is about $\ell_\infty$54 of the random baseline’s $\ell_\infty$55 (Sasahara, 2023). The same paper reports a demonstration in which clean closed-loop eigenvalues $\ell_\infty$56 move to $\ell_\infty$57 under DGSM, thereby crossing the unit circle while the perturbed time signals remain visually indistinguishable from the clean data.

The 2025 experiments on six LTI benchmarks reach a similar conclusion at larger scale. Across motor position, suspension, inverted pendulum, aircraft pitch, ball-and-beam, and triple tank systems, I-DGSM achieves comparable attack success rates with perturbations approximately $\ell_\infty$58–$\ell_\infty$59 smaller than baseline random attacks; single-step DGSM is slightly less effective than I-DGSM but still stronger than the baseline (Sasahara, 20 Jul 2025). A representative triple-tank example with $\ell_\infty$60 and $\ell_\infty$61 shows that perturbations at only $\ell_\infty$62–$\ell_\infty$63 of data amplitude can move a pole outside the unit circle, for example to $\ell_\infty$64. Increasing $\ell_\infty$65 reduces attack success rates substantially; for the inverted pendulum, the attack success rate falls from $\ell_\infty$66 to $\ell_\infty$67 as $\ell_\infty$68 increases, while the relative control performance remains approximately $\ell_\infty$69.

Several limitations qualify these results. Both attack analyses assume differentiability of the synthesis mapping around a locally unique optimum and rely on a simple dominant eigenvalue; spectral radius becomes nonsmooth when multiple eigenvalues share the same modulus, and the cited work does not address subgradient or bundle methods in that regime (Sasahara, 20 Jul 2025). In the 2023 method, central differences can be noisy and eigenvalue sensitivities are ill-conditioned near repeated or nearly defective eigenvalues (Sasahara, 2023). The stealthiness models are also idealized: they use elementwise max-norm or relative norm constraints and do not encode richer actuator, sensor, or temporal-structure constraints. Finally, analytical derivative assembly in the implicit-differentiation approach can be memory-intensive for large $\ell_\infty$70, $\ell_\infty$71, and $\ell_\infty$72 (Sasahara, 20 Jul 2025).

Taken together, the cited works establish two complementary interpretations of DGSM. In optimization, sign updates are not merely heuristic; they are exact steepest-descent directions for $\ell_\infty$73 geometry, and their effectiveness depends on Hessian diagonal concentration, spectral disparity, and gradient density (Balles et al., 2020). In direct data-driven control, DGSM is a targeted adversarial mechanism that exploits the same coordinatewise sign structure under an elementwise perturbation budget, but now to maximize the spectral radius of the synthesized closed loop; its advantage over random perturbations comes from directional alignment with eigenvalue sensitivities rather than from a larger perturbation norm alone (Sasahara, 2023, Sasahara, 20 Jul 2025).