---
title: Directed Gradient Sign Method (DGSM)
url: https://www.emergentmind.com/topics/directed-gradient-sign-method-dgsm
type: topic
---

# Directed Gradient Sign Method (DGSM)

Directed Gradient Sign Method (DGSM) denotes a sign-based gradient construction whose defining feature is an $\ell_\infty$ or elementwise-max geometry. In the literature covered here, the acronym appears in two technically distinct senses. In smooth optimization, DGSM is the $\ell_\infty$ steepest-descent method, with updates along $-\mathrm{sign}(\nabla f)$ and progress governed by the $\ell_\infty$-smoothness constant $L_\infty$ [2002.08056]. In direct data-driven control, DGSM is an adversarial poisoning attack that perturbs offline data in a sign pattern aligned with eigenvalue or spectral-radius sensitivities of the synthesized closed loop, with the aim of reducing stability and possibly pushing eigenvalues outside the unit circle [2303.06837] [2507.14863]. The shared structure is a coordinatewise sign rule, but the underlying objectives differ: deterministic descent in one case, destabilization under stealthy perturbation budgets in the other.

## 1. Terminological scope and common geometric structure

The two uses of DGSM are linked by a common geometric intuition: the sign operator is natural when the constraint or smoothness model is coordinatewise, either through the norm ball $\{d:\|d\|_\infty\le 1\}$ or through an elementwise perturbation budget $\|\Delta\|_{\max}\le \varepsilon$ [2002.08056] [2303.06837].

| Usage | Core rule | Governing quantity |
|---|---|---|
| $\ell_\infty$ steepest descent | $x_{t+1}=x_t-\eta_t\,\mathrm{sign}(\nabla f(x_t))$ | $L_\infty$, $\|\nabla f(x)\|_1$ |
| Adversarial destabilization in control | $\Delta=\varepsilon\,\mathrm{sign}(\Pi_\lambda(\nabla_D \lambda))$ or $\Delta^\star=\varepsilon\,\mathrm{sign}(\nabla_D \rho(A_{\mathrm{cl}}(D)))$ | closed-loop eigenvalues, $\rho(A_{\mathrm{cl}})$ |

In the optimization setting, the sign vector is an exact steepest-descent direction under $\ell_\infty$ geometry. In the control setting, the same sign mechanism is made “directed” by a spectral projection that resolves the complex-valued direction in which an eigenvalue should be moved so that its modulus increases. This suggests that DGSM is best understood not as a single algorithmic template with a single objective, but as a class of sign-based procedures whose meaning is fixed by the geometry of the constraint set and the performance functional being differentiated.

## 2. DGSM as $\ell_\infty$ steepest descent

For a differentiable $f:\mathbb{R}^d\to\mathbb{R}$, steepest descent with respect to a norm $\|\cdot\|$ selects a direction
$$
d^\ast(x)\in \arg\min\{\langle \nabla f(x),d\rangle:\|d\|\le 1\}.
$$
When $\|\cdot\|=\|\cdot\|_\infty$, the feasible set is the hypercube $[-1,1]^d$, the linear objective decouples coordinatewise, and the minimizer is
$$
\arg\min_{\|d\|_\infty\le 1}\langle \nabla f(x),d\rangle = -\mathrm{sign}(\nabla f(x)).
$$
The canonical update is therefore
$$
x_{t+1}=x_t-\eta_t\,\mathrm{sign}(\nabla f(x_t)),
$$
and the norm-scaled steepest-descent form is
$$
x_{t+1}=x_t-\frac{1}{L_\infty}\|\nabla f(x_t)\|_1\,\mathrm{sign}(\nabla f(x_t)).
$$
The latter arises from minimizing a local quadratic upper bound and yields a constant-step guarantee [2002.08056].

The relevant smoothness notion is Lipschitz continuity of the gradient in the dual norm:
$$
\|\nabla f(x)-\nabla f(y)\|_1\le L_\infty\|x-y\|_\infty \quad \text{for all }x,y,
$$
which implies
$$
f(y)\le f(x)+\langle \nabla f(x),y-x\rangle+\frac{L_\infty}{2}\|y-x\|_\infty^2.
$$
This replaces the more restrictive separable smoothness assumption used in earlier signSGD analyses. If constants $l_1,\dots,l_d>0$ satisfy
$$
f(y)\le f(x)+\langle \nabla f(x),y-x\rangle+\frac{1}{2}\sum_{i=1}^d l_i(y_i-x_i)^2,
$$
then separable smoothness implies $\ell_\infty$-smoothness with $L_\infty=\sum_i l_i$. For sign steps, both assumptions yield the same bound because the update has equal coordinate magnitude [2002.08056].

The basic descent estimate for
$$
x^+=x-\eta\,\mathrm{sign}(\nabla f(x))
$$
is
$$
f(x^+)\le f(x)-\eta\|\nabla f(x)\|_1+\frac{L_\infty}{2}\eta^2.
$$
The optimal step size is
$$
\eta^\ast=\frac{\|\nabla f(x)\|_1}{L_\infty},
$$
and the guaranteed decrease is
$$
f(x)-f(x^+)\ge \frac{\|\nabla f(x)\|_1^2}{2L_\infty}.
$$
This is the steepest-descent improvement lemma specialized to $\ell_\infty$ geometry [2002.08056].

The same framework yields standard complexity bounds. For nonconvex deterministic DGSM,
$$
\frac{1}{T}\sum_{t=0}^{T-1}\|\nabla f(x_t)\|_1^2\le \frac{2L_\infty(f(x_0)-f^\star)}{T}.
$$
For convex $f$ that is $L_\infty$-smooth,
$$
f(x_T)-f^\star\le \frac{2L_\infty R_\infty^2}{T+4},
$$
where $R_\infty$ is a norm-dependent radius of the initial level set. Under the Polyak–Łojasiewicz condition in the dual norm,
$$
\|\nabla f(x)\|_1^2\ge 2\mu_\infty(f(x)-f^\star),
$$
DGSM with step $1/L_\infty$ obeys
$$
f(x_T)-f^\star\le \left(1-\frac{\mu_\infty}{L_\infty}\right)^T (f(x_0)-f^\star).
$$

## 3. Hessian geometry, comparison with gradient descent, and relation to adaptive methods

The geometry of DGSM is encoded in the Hessian through the operator norm identity
$$
L_\infty=\sup_x\|\nabla^2 f(x)\|_{\infty,1},
$$
where
$$
\|A\|_{\infty,1}:=\max_{\|z\|_\infty\le 1}\|Az\|_1.
$$
Although computing $\|A\|_{\infty,1}$ is NP-hard in general, the cited analysis gives bounds that isolate when sign-based methods should outperform standard $\ell_2$ gradient descent [2002.08056].

For positive semidefinite symmetric $H$ with eigenvalues $\{\lambda_i\}$,
$$
\|H\|_{\infty,1}\le \rho_{\mathrm{diag}}(H)^{-1}\sum_{i=1}^d \lambda_i,
$$
where
$$
\rho_{\mathrm{diag}}(H):=\frac{\sum_i |H_{ii}|}{\sum_{i,j}|H_{ij}|}\in [1/d,1].
$$
Hence $L_\infty$ becomes smaller when the Hessian is concentrated on its diagonal, that is, when the objective is axis-aligned in the coordinate basis. For a general symmetric eigendecomposition
$$
H=\sum_i \lambda_i v^{(i)}(v^{(i)})^\top,
$$
the bound
$$
\|H\|_{\infty,1}\le \sum_i |\lambda_i|\,\|v^{(i)}\|_1^2
$$
shows that large eigenvalues are less harmful when their eigenvectors are axis-aligned. A lower bound of the form
$$
\|H\|_{\infty,1}\ge |\lambda_i|\frac{\|v^{(i)}\|_1}{\|v^{(i)}\|_\infty}
$$
is also available. In two dimensions, for
$$
H=\begin{bmatrix} a & b \\ b & d\end{bmatrix}
$$
positive definite,
$$
\|H\|_{\infty,1}=a+d+2|b|,
$$
which makes the dependence on off-diagonal coupling explicit.

The global relationship to ordinary smoothness is
$$
L_2\le L_\infty \le dL_2,
$$
with the upper bound loose in favorable geometries. When the spectrum has outliers, so that $\lambda_{\max}\gg \mathrm{average}(\lambda_i)$, and the Hessian is diagonally concentrated, the bound above gives $L_\infty\ll dL_2$. The paper identifies two favorable properties: diagonal concentration and spectral disparity. Both are reported as common in deep networks and as empirically correlated with strong performance of sign-based methods and Adam [2002.08056].

The per-step guaranteed improvements of gradient descent and DGSM are
$$
I_{\mathrm{GD}}(x)=\frac{\|\nabla f(x)\|_2^2}{L_2},
\qquad
I_{\mathrm{DGSM}}(x)=\frac{\|\nabla f(x)\|_1^2}{L_\infty}.
$$
Defining
$$
\phi(\nabla f(x)):=\frac{\|\nabla f(x)\|_1^2}{d\|\nabla f(x)\|_2^2}\in [1/d,1],
$$
the ratio becomes
$$
R(x):=\frac{I_{\mathrm{DGSM}}(x)}{I_{\mathrm{GD}}(x)}
=\phi(\nabla f(x))\cdot \frac{dL_2}{L_\infty}.
$$
DGSM is therefore favored when gradients are dense, so that $\phi$ is close to $1$, and when the Hessian geometry shrinks $L_\infty$ far below $dL_2$.

The same work also gives an interpretation of Adam as predominantly sign-based. Its update direction can be decomposed as
$$
\frac{g_t}{\sqrt{v_t}+\epsilon}=\gamma_t\circ \mathrm{sign}(g_t),
$$
with coordinatewise damping factors $\gamma_t\in (0,1]$ that decrease with gradient variance. Empirical evidence in CNN training indicates that shuffling or averaging $\gamma_t$ across coordinates barely degrades Adam’s performance, which supports viewing Adam as a DGSM-like method augmented by momentum and mild per-coordinate normalization [2002.08056].

## 4. DGSM as an adversarial attack in direct data-driven control

In direct data-driven control, DGSM is an attack on the offline data used to synthesize a controller. The 2023 formulation studies Willems’ fundamental lemma-based LQR design for the discrete-time plant
$$
x(t+1)=Ax(t)+Bu(t)+d(t),
$$
with unknown but stabilizable $(A,B)$. Using measured trajectories, one forms
$$
W_0 := \begin{bmatrix} U_0^\top & X_0^\top \end{bmatrix}^\top,
$$
assumes $\mathrm{rank}\,W_0=n+m$, and introduces $G\in \mathbb{R}^{T\times n}$ such that
$$
\begin{bmatrix} K^\top & I \end{bmatrix}^\top = W_0 G.
$$
The resulting closed-loop matrix is
$$
A_{\mathrm{cl}}(D):=A+BK=(X_1-D_0)G,
$$
so controller synthesis depends explicitly on the collected data $D=(U_0,X)$ [2303.06837].

A later treatment writes the offline data as
$$
D\coloneqq \begin{bmatrix} Z^\top & X^\top & U^\top \end{bmatrix}^\top\in \mathbb{R}^{(2n+m)\times T},
$$
with
$$
Z=AX+BU \quad \text{or} \quad Z=AX+BU+W,
$$
and formulates data-driven LQR as an SDP in variables $(L,S)$ with objective
$$
J(L,S,D)\coloneqq \mathrm{tr}(QXL)+\mathrm{tr}(S)+\gamma\|\Pi L\|_{\mathrm{F}}^2,
$$
subject to a block-diagonal LMI $F(L,S,D)\succeq 0$. The synthesized controller is
$$
K=UL(XL)^{-1},
\qquad
P=XL.
$$
This formulation is used to differentiate the synthesis map exactly through the KKT system [2507.14863].

The adversarial objective is spectral. For discrete-time stability, the test is $|\lambda_i|<1$, so the poisoning problem is
$$
\max_{\Delta}\ \rho\big(A_{\mathrm{cl}}(D+\Delta)\big)
\quad \text{s.t.} \quad
\|\Delta\|_{\max}\le \varepsilon,
$$
where $\rho(\cdot)$ is the spectral radius and $\|\cdot\|_{\max}$ is the elementwise max norm. A relative stealthiness variant constrains $\Delta_Z,\Delta_X,\Delta_U$ relative to the norms of $Z,X,U$ [2507.14863]. The design goal is not to increase a loss in the machine-learning sense, but to move a closed-loop eigenvalue toward and beyond the unit circle.

This difference from FGSM is central. FGSM uses
$$
x_{\mathrm{adv}}=x+\varepsilon\,\mathrm{sign}(\nabla_x L(x,y)),
$$
whereas DGSM in control uses a spectral stability gradient. The attack exploits the fact that small but carefully aligned perturbations of offline data can induce a different synthesized gain $\hat K$ and a different closed-loop matrix $A+B\hat K$ with possibly unstable eigenvalues, even when the clean closed loop has a large margin of stability [2303.06837].

## 5. Spectral gradients, directional projection, and algorithmic variants

The 2023 attack computes eigenvalue sensitivities numerically. For a simple eigenvalue $\lambda$ of $A$ with right and left eigenvectors $v,w$,
$$
\frac{\partial \lambda}{\partial A}=\frac{v w^\top}{w^\top v},
$$
and, for the spectral abscissa,
$$
\nabla_A \alpha(A)=\mathrm{Re}\!\left(\frac{vw^\top}{w^\top v}\right).
$$
Because the map from data to controller passes through a convex program, the paper does not derive $\partial A_{ij}/\partial D$ analytically. Instead it approximates
$$
(\nabla_\Delta \lambda_i)_{k\ell}\approx
\frac{\lambda_i(U_0,X,\Delta+hE_{k\ell})-\lambda_i(U_0,X,\Delta-hE_{k\ell})}{2h}
$$
by central differences, where $E_{k\ell}$ is a perturbation basis. The attack then applies a directional projection $\Pi_{\lambda_i}$ so that the sign pattern pushes the chosen eigenvalue radially outward. The resulting perturbation rule is
$$
\Delta=\varepsilon\,\mathrm{sign}\!\big(\Pi_{\lambda_i}(\nabla_\Delta \lambda_i(U_0,X,\Delta))\big),
$$
and the algorithm increases $\varepsilon$ over a candidate set until some $|\lambda_i|>1$ [2303.06837].

The 2025 work replaces numerical differentiation with implicit differentiation through the KKT conditions of the SDP layer. With $K=F_K(L,D)$ and $L$ itself dependent on $D$, the chain rule is
$$
\frac{d\rho}{dD}
=
\frac{d\rho}{dK}
\left(
\frac{\partial F_K}{\partial L}\frac{dL}{dD}
+
\frac{\partial F_K}{\partial D}
\right).
$$
For a simple dominant eigenvalue $\lambda$ of $A_{\mathrm{cl}}$, with right and left eigenvectors $v,w$,
$$
d\lambda = \frac{w^\top(dA_{\mathrm{cl}})v}{w^\top v},
$$
and
$$
d|\lambda|
=
\frac{\mathrm{Re}\!\left(\overline{\lambda}\,d\lambda\right)}{|\lambda|}.
$$
Since $dA_{\mathrm{cl}}=B\,dK$, the gradient with respect to $K$ follows immediately. The dependence of $L$ on $D$ is obtained by differentiating the KKT equalities, which yields a linear system in $dL/dD$, $dS/dD$, and $d\Lambda/dD$. To avoid rank deficiency, the scalar complementarity relation is replaced by the matrix equality $F\Lambda^\top=0$, producing an augmented KKT linearization [2507.14863].

The “directed” realization used for complex eigenvalues is explicit in the later work:
$$
\Pi_\lambda(g)\coloneqq \overline{\lambda}\,g+\lambda\,\overline{g}
=2\,\mathrm{Re}(\overline{\lambda}g).
$$
Elementwise,
$$
\Delta_{kl}=\varepsilon\,\mathrm{sign}\!\big(\Pi_\lambda((\nabla_D \lambda)_{kl})\big),
$$
so the sign of each perturbation component is chosen to increase the modulus of the dominant eigenvalue in the linearized model.

This formulation also introduces an iterative variant, I-DGSM, which performs projected gradient ascent:
$$
\Delta^{(t+1)}
=
\Pi_{\mathcal{S}}\!\left(
\Delta^{(t)}+\alpha\,\nabla_D \rho(A_{\mathrm{cl}}(D+\Delta^{(t)}))
\right),
$$
with
$$
\mathcal{S}=\{\Delta:\|\Delta\|_{\max}\le \varepsilon\},
$$
and $\Pi_{\mathcal{S}}$ implemented by elementwise clipping. Initialization is $\Delta^{(0)}=0$, a practical step size is $\alpha=\varepsilon\|D\|_{\max}$, and stopping occurs when $\rho(A_{\mathrm{cl}}(D+\Delta^{(t)}))\ge 1$ or when the iteration cap is reached [2507.14863].

Algorithmically, the transition from numerical differentiation to implicit differentiation is decisive. Naive central differences require solving the SDP $O(((2n+m)T))$ times per gradient. The implicit-differentiation pipeline solves the SDP once, assembles KKT derivative blocks, solves one linear system, and then evaluates $d\rho/dD$. Empirically this yields approximately $70\times$ speedup relative to naive numerical differentiation, with an additional $1.6$–$2.9\times$ gain when analytical derivative expressions are used for the KKT blocks and the Jacobians of $F_K$ [2507.14863].

## 6. Robustness, defenses, empirical findings, and limitations

The control literature studies DGSM together with defensive regularization. One family of defenses is certainty-equivalence regularization. In the 2023 formulation this adds
$$
\gamma\|\Pi G\|
$$
to the synthesis objective, with
$$
\Pi:=I-W_0^\dagger W_0,
$$
under the original LMI constraints. A second 2023 defense is robustness-inducing regularization, which adds
$$
\rho(GPG^\top)
$$
and is intended to reduce sensitivity to disturbances by shrinking $GPG^\top$ [2303.06837]. The 2025 paper uses the Frobenius-squared certainty-equivalence regularizer
$$
\gamma\|\Pi L\|_{\mathrm{F}}^2
$$
in the SDP formulation and shows that it suppresses directions aligned with the null space of $\Phi$ while preserving control performance in benign settings [2507.14863].

A stronger 2025 defense is robust data-driven control against all perturbations satisfying $\|\Delta\|_{\max}\le \varepsilon$, implemented through an S-procedure-based SDP with Lyapunov certificates and a nominal performance cap $J_{\mathrm{LQR}}$. The paper states two guarantees: if $\Delta=0$, then $\mathcal{J}(K)\le J_{\mathrm{LQR}}$; if $\|\Delta\|_{\max}\le \varepsilon$, then the closed loop is stable. The same work also proves a sufficient stability condition for the regularized synthesis in terms of the signal-to-perturbation ratio
$$
\mu\coloneqq \min\!\left(\frac{\|Z\|_2}{\|\Delta_Z\|_2},\,\frac{\sigma_{\min}(\Phi)}{\|\Delta_\Phi\|_2}\right),
$$
with stability ensured when
$$
\mu>
\left(
-1+\sqrt{1+\frac{1}{2\|Z\|_2^2\|\Phi\|_2}}
\right)^{-1}.
$$

Empirically, DGSM is consistently more effective than random perturbations. In the 2023 inverted-pendulum study, with $N_{\mathrm{all}}=50$ trials and threshold $\tau=0.8$, the destabilizing budget $\bar\varepsilon$ increases monotonically with both regularization parameters, yet DGSM remains far more potent than the random baseline: for the same $\gamma$, DGSM’s $\bar\varepsilon$ is about $10\%$ of the random baseline’s $\bar\varepsilon$ [2303.06837]. The same paper reports a demonstration in which clean closed-loop eigenvalues $\{-0.0177,\,0.0212,\,-0.0275\}$ move to $\{0.1824,\,0.3613,\,1.0120\}$ under DGSM, thereby crossing the unit circle while the perturbed time signals remain visually indistinguishable from the clean data.

The 2025 experiments on six LTI benchmarks reach a similar conclusion at larger scale. Across motor position, suspension, inverted pendulum, aircraft pitch, ball-and-beam, and triple tank systems, I-DGSM achieves comparable attack success rates with perturbations approximately $10\times$–$100\times$ smaller than baseline random attacks; single-step DGSM is slightly less effective than I-DGSM but still stronger than the baseline [2507.14863]. A representative triple-tank example with $\varepsilon=0.005$ and $\gamma=10^{-4}$ shows that perturbations at only $0.1\%$–$0.5\%$ of data amplitude can move a pole outside the unit circle, for example to $1.0016$. Increasing $\gamma$ reduces attack success rates substantially; for the inverted pendulum, the attack success rate falls from $1.00$ to $0.05$ as $\gamma$ increases, while the relative control performance remains approximately $1.00$.

Several limitations qualify these results. Both attack analyses assume differentiability of the synthesis mapping around a locally unique optimum and rely on a simple dominant eigenvalue; spectral radius becomes nonsmooth when multiple eigenvalues share the same modulus, and the cited work does not address subgradient or bundle methods in that regime [2507.14863]. In the 2023 method, central differences can be noisy and eigenvalue sensitivities are ill-conditioned near repeated or nearly defective eigenvalues [2303.06837]. The stealthiness models are also idealized: they use elementwise max-norm or relative norm constraints and do not encode richer actuator, sensor, or temporal-structure constraints. Finally, analytical derivative assembly in the implicit-differentiation approach can be memory-intensive for large $T$, $n$, and $m$ [2507.14863].

Taken together, the cited works establish two complementary interpretations of DGSM. In optimization, sign updates are not merely heuristic; they are exact steepest-descent directions for $\ell_\infty$ geometry, and their effectiveness depends on Hessian diagonal concentration, spectral disparity, and gradient density [2002.08056]. In direct data-driven control, DGSM is a targeted adversarial mechanism that exploits the same coordinatewise sign structure under an elementwise perturbation budget, but now to maximize the spectral radius of the synthesized closed loop; its advantage over random perturbations comes from directional alignment with eigenvalue sensitivities rather than from a larger perturbation norm alone [2303.06837] [2507.14863].

Source: https://www.emergentmind.com/topics/directed-gradient-sign-method-dgsm