---
title: 'DISBELIEVE: Distance-Constrained Adversarial Perturbation'
url: https://www.emergentmind.com/topics/distance-constrained-adversarial-perturbation-disbelieve
type: topic
---

# DISBELIEVE: Distance-Constrained Adversarial Perturbation

Distance-Constrained Adversarial Perturbation (DISBELIEVE) encompasses a class of adversarial attack methodologies that maximize misclassification or model degradation objectives under explicit distance constraints. Typical instantiations arise in both federated learning and classical neural network settings, formalized via optimization over client parameter updates or input perturbations subject to norm or geometric bounds. The common thread is an adversary who seeks to evade defense mechanisms by ensuring that the crafted adversarial perturbations (to models or inputs) remain close—according to some prescribed metric—to benign references, while still having maximal negative impact.

## 1. Mathematical Formulations and Formal Objectives

Central to distance-constrained adversarial perturbation is the adversarial optimization problem:
- **Federated setting:** Given benign update set $\{w_i\}$ and malicious update $w_{\mathrm{adv}}$, maximize the global classification loss, constrained such that $\|w_{\mathrm{adv}} - \mu^{\mathrm{param}}\|_2^2 \leq P_{\mathrm{dist}}$,
  $$
  \begin{aligned}
  &\max_{w_{\text{adv}}} L_{\text{global}}\left(\{w_i\}_{i\in\mathcal B}, w_{\text{adv}}\right) \\
  &\;\textrm{s.t.}\;\; \|w_{\mathrm{adv}} - \mu^{\mathrm{param}}\|_2^2 \leq P_{\mathrm{dist}}
  \end{aligned}
  $$
  where $P_{\mathrm{dist}}$ is the intra-malicious “spread” [2308.07387].

- **Input-space perturbation:** For a classifier $f:X\to\Delta_n$ and base sample $x$, find $u$ that meets a misclassification criterion $\hat{y}(u)\neq y$ while $m(u;x) \leq \epsilon$ for metric $m$, or minimizes $m(u;x)$ subject to $F(u):=\max_{i\neq y}Z_i(u) - Z_y(u) \geq 0$, where $Z_i$ denotes class logits [1908.01667].

Both paradigms may use auxiliary constraints or surrogate formulations (e.g., log-barrier or projected gradient) that enforce the boundedness of the attack in $L_p$, total variation, or task-specific geometry.

## 2. Algorithms and Optimization Schemes

### 2.1 Model Poisoning in Federated Learning

The DISBELIEVE algorithm (for federated systems) proceeds as follows:
1. Gather malicious clients' parameters or gradients, compute their empirical mean and (max or min) pairwise intra-cluster squared distance.
2. Initialize a malicious proxy model or gradient at the intra-malicious mean.
3. Iteratively update the proxy to maximize classification loss on local malicious client data, using gradient ascent.
4. **Projection step:** After each update, if the candidate $w$ deviates beyond the allowed radius from the mean, project it radially back onto the sphere of feasible $L_2$ distance to maintain $\|w-\mu^{\mathrm{param}}\|_2^2 \leq P_{\mathrm{dist}}$.
5. Terminate when both the constraint and loss plateau. The resulting $w_{\mathrm{adv}}$ is submitted as the aggregated malicious update [2308.07387].

### 2.2 Proximal-Gradient Input Attacks

For input-space attacks (ProxLogBarrier framework):
1. Reformulate the hard constraint (misclassification at minimal metric distance) as an unconstrained objective with a log-barrier penalizing violation of the class decision constraint.
2. At each iteration, take a gradient step w.r.t. the log-barrier penalized objective, followed by the corresponding proximal operator for the chosen metric (e.g., $L_2$, $L_1$, $L_\infty$, $L_0$, or TV).
3. After each update, enforce the sample remains misclassified by backtracking along the line segment joining previous and current iterate.
4. The process iterates with decaying barrier coefficients to increasingly sharpen constraint enforcement [1908.01667].

Closed-form proximal operators for various distances enable efficient projection—even for non-smooth metrics such as $L_0$ and TV.

## 3. Distance Constraints versus Robust Defenses

A critical insight in DISBELIEVE-based attacks is that many robust aggregation rules—KRUM, Trimmed Mean, DOS (COPOD-based outlier scoring)—use explicit or implicit distance metrics to detect poisoning. If the adversarial update is constructed to remain within the intra-client (benign or malicious) spread, it will not be flagged as anomalous. Specifically:
- **KRUM** selects the most “central” update by neighbor distance; a carefully crafted $w_{\mathrm{adv}}$ that is not outlying can be accepted.
- **Trimmed Mean** removes only coordinatewise outliers; by remaining within coordinate bounds derived from the normal update distribution, $w_{\mathrm{adv}}$ is not rejected.
- **DOS** assigns outlier risk based on distance from the cluster centroid; staying near the center maximizes aggregation weight for the attack [2308.07387].

This principle extends to metric-based input defenses: if adversarial perturbations keep within certified radii, many provable- or heuristic-robust classifiers cannot guarantee protection.

## 4. Theoretical Guarantees and Provable Robustness

Certain distance-constrained attack strategies admit formal guarantees on approximation quality and robustness:
- For a point $x$ and classifier $f$, the minimal adversarial perturbation $d(x) = \|\delta^*(x)\|$ (Euclidean or other norm) is bounded within constant factor $\rho\in(\sqrt{2},2)$ by root-finding solutions along the model gradient under mild smoothness and boundary-regularity assumptions. Concretely,
  $$
  d(x)\leq t(x)\leq 2\cos(\alpha)\,d(x)
  $$
  for $t(x)$ derived from projected line search along $-\nabla f$ [2201.01235].

- The distance constraint radius $t(x)/\rho^*$ can serve as a certified region: no adversarial example with $\|\delta\|\leq t(x)/\rho^*$ can alter classification, providing a practical robustness certificate with quantifiable error [2201.01235].

- In the ProxLogBarrier algorithm, convergence to first-order stationary points for the penalized composite objective is guaranteed under standard properties (Lipschitz gradient, prox-existence), though not global optimality due to nonconvexity [1908.01667].

## 5. Empirical Performance and Benchmarks

Distance-constrained adversarial perturbations, when deployed as per DISBELIEVE, produce significant degradation in both federated and centralized learning settings:
- **Federated model poisoning (parameter/gradient-based):** On datasets such as CheXpert-Small, HAM10000, BreakHis, and CIFAR-10, DISBELIEVE yields severe drops in global AUC under all evaluated defenses. Example: CheXpert-Small, AUC with DISBELIEVE under DOS drops from 0.71 (no attack) to 0.44, outperforming other attacks such as LIE and Min-Max [2308.07387].
- **Input-space attacks:** On MNIST, CIFAR-10, ImageNet, ProxLogBarrier achieves higher attack success rates and smaller perturbations under multiple metrics; e.g., on CIFAR-10 (undefended, $L_0$), $68.5\%$ of images fooled at $\varepsilon=80$ pixel changes, median value $39$, outperforming previous $L_0$-specialized attacks [1908.01667].
- **Robustness validation:** Empirical evaluations confirm that when attacks are restricted to certified radii (distance estimates $t(x)/\rho^*$), observed attacks fail on nearly all tested points within this neighborhood, corroborating theoretical robustness claims [2201.01235].

## 6. Connections across Domains and Practical Recommendations

Distance-constrained adversarial perturbation frameworks unify several attack and certification strategies across federated and centralized settings:
- The adversarial “budget” paradigm—maximizing loss under metric bounds—arises identically at the model and input levels.
- Closed-form proximal operators and geometric reduction underpin efficient and generalizable algorithm designs (applicable for $L_p$, $L_0$, TV seminorm, and others).
- Distance-based certificate methodologies deliver both practical protection and tight theoretical approximation bounds, especially in the local boundary neighborhood.

Practical recommendations for practitioners include: Choosing hyperparameters (barrier coefficient $\lambda_0\approx 0.1$, decay $\beta\approx 0.75$, gradient step sizes $h\approx 0.1$, proximity parameter $\mu \in [1,3]$), initializing with large perturbations for misclassification, and focusing on attack-constrained radii commensurate with empirical and theoretical guarantees [1908.01667].

## 7. Summary Table: Key Algorithmic Elements

| Attack Variant     | Distance Metric / Constraint      | Optimization Core    |
|--------------------|----------------------------------|---------------------|
| DISBELIEVE (federated) | Intra-malicious $L_2^2$ bound      | Loss-maximization + projection |
| ProxLogBarrier (input) | Any (closed-form prox: $L_p$, $L_0$, TV) | Proximal gradient + log-barrier | 
| Certified perturbation | Euclidean ($L_2$) minimal distance | Gradient-aligned root-finding |

These approaches collectively demonstrate that distance-constrained adversarial perturbation constitutes a principled and broadly effective methodology for evading detection-based defenses and for probing the certified robustness of neural systems [2308.07387, 1908.01667, 2201.01235].

Source: https://www.emergentmind.com/topics/distance-constrained-adversarial-perturbation-disbelieve