Gradient-Based Sparse Adversarial Attack

• Gradient-based sparse adversarial attacks are methods that leverage gradient signals to craft perturbations on limited input features while meeting ℓ0 and ℓ∞ constraints.
• They employ optimization techniques like Frank–Wolfe, BFGS, and greedy selection to efficiently determine the most impactful coordinates for modification.
• Empirical evaluations across image, text, and 3D modalities show high attack success rates and improved perceptibility control in adversarial settings.

Gradient-based sparse adversarial attacks are methods for constructing adversarial examples by using gradients, gradient surrogates, or related sensitivity information to alter only a small support of the input while inducing misclassification. In the image setting, representative formulations combine an $\ell_0$ sparsity budget with an $\ell_\infty$ magnitude bound; later work extends the same logic to group-wise image perturbations, dynamic 3D sparse convolution networks, spiking neural networks, and transformer-based text classifiers, where sparsity is imposed on pixels, overlapping groups, temporal events, or token blocks rather than on dense perturbation fields alone (Imtiaz et al., 2022, Sadiku et al., 2023, Tao et al., 2021, Sadrizadeh et al., 2022).

1. Core optimization formulations

A canonical formulation seeks a perturbation $\delta$ that maximizes task loss while remaining both sparse and bounded in magnitude. SAIF writes the untargeted problem as

$$\max_{\delta}\; D(\delta) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k,$$

with $D(\delta)=L(f(x+\delta),y)$, and also gives the equivalent generic minimization form

$$\min_{\delta}\; L(f(x+\delta),y) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k.$$

Here $\|\delta\|_0 \le k$ forces $k$-sparsity, while $\|\delta\|_\infty \le \epsilon$ bounds each pixel-wise change to $[-\epsilon,\epsilon]$ (Imtiaz et al., 2022).

GreedyFool states the sparse objective in a complementary way:

$\ell_\infty$0

Its adversarial loss is a C&W-style margin loss,

$\ell_\infty$1

where $\ell_\infty$2 is the logit for class $\ell_\infty$3 and $\ell_\infty$4 is a confidence parameter (Dong et al., 2020).

In text, the same principle appears as block sparsity over token embeddings rather than coordinate sparsity over pixels. The block-sparse transformer attack optimizes

$\ell_\infty$5

or, in hard form, restricts the number of nonzero blocks to at most $\ell_\infty$6, so that only a few token substitutions are permitted (Sadrizadeh et al., 2022).

2. Support selection and gradient-driven optimization

The practical difficulty is not merely optimizing perturbation magnitude, but discovering which coordinates should be active. A recurring pattern is to use gradients to rank coordinates and then to refine the perturbation on the selected support. GreedyFool explicitly follows this route. At iteration $\ell_\infty$7, it computes the loss gradient $\ell_\infty$8, converts a learned distortion map $\ell_\infty$9 into a weight map $\delta$0 using thresholds $\delta$1, forms a masked weighted gradient

$\delta$2

and ranks pixels by $\delta$3. Its first stage grows the support by selecting the top-$\delta$4 unselected pixel indices and updating only those coordinates; its second stage reduces the support by removing pixels with small perturbation magnitude whenever adversariality can be preserved. The paper attributes its gains over SparseFool to fresh-gradient selection, the distortion map, and the two-stage refine procedure (Dong et al., 2020).

SAIF replaces greedy growth with a Frank–Wolfe procedure over the convex hull of $\delta$5-sparse $\delta$6 atoms. Its linear minimization oracle selects the $\delta$7 indices with largest absolute gradient magnitude and sets

$\delta$8

where $\delta$9 is the top-$$\max_{\delta}\; D(\delta) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k,$$0 index set. The update is

$$\max_{\delta}\; D(\delta) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k,$$1

Under standard assumptions, the Frank–Wolfe gap satisfies a sublinear stationarity rate of $$\max_{\delta}\; D(\delta) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k,$$2 (Imtiaz et al., 2022).

LP-BFGS uses a different decomposition. Instead of discovering the support online, it first computes Integrated Gradients attributions, selects the top-$$\max_{\delta}\; D(\delta) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k,$$3 coordinates by $$\max_{\delta}\; D(\delta) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k,$$4, and then optimizes only those variables with BFGS. If $$\max_{\delta}\; D(\delta) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k,$$5, the search direction is $$\max_{\delta}\; D(\delta) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k,$$6 with inverse-Hessian approximation $$\max_{\delta}\; D(\delta) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k,$$7, followed by a Wolfe line search and the standard BFGS update. Because $$\max_{\delta}\; D(\delta) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k,$$8, the method treats full-matrix BFGS as tractable even though storing $$\max_{\delta}\; D(\delta) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k,$$9 costs $D(\delta)=L(f(x+\delta),y)$0 memory and updates cost $D(\delta)=L(f(x+\delta),y)$1 time per iteration (Zhang et al., 2022).

Method	Sparsity model	Core mechanism
GreedyFool (Dong et al., 2020)	Pixel-wise $D(\delta)=L(f(x+\delta),y)$2 under $D(\delta)=L(f(x+\delta),y)$3 budget	Distortion-aware gradient ranking with grow and reduce stages
SAIF (Imtiaz et al., 2022)	$D(\delta)=L(f(x+\delta),y)$4-sparse under $D(\delta)=L(f(x+\delta),y)$5 bound	Frank–Wolfe LMO on top-$D(\delta)=L(f(x+\delta),y)$6 gradient coordinates
LP-BFGS (Zhang et al., 2022)	Exactly $D(\delta)=L(f(x+\delta),y)$7 selected pixels	BFGS on Integrated-Gradients-selected variables
GSE (Sadiku et al., 2023)	Group-wise sparse patches	$D(\delta)=L(f(x+\delta),y)$8 proximal phase plus projected Nesterov refinement
ATOS (Heshmati et al., 18 Oct 2025)	Element-, pixel-, and group-wise sparsity	OSL$D(\delta)=L(f(x+\delta),y)$9 regularization with smooth $$\min_{\delta}\; L(f(x+\delta),y) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k.$$0 control

3. Structured sparsity and explainable perturbations

Sparse attacks need not be element-wise. GSE formulates group-wise sparse attacks through a two-phase algorithm. In Phase I it optimizes a quasinorm adversarial loss,

$$\min_{\delta}\; L(f(x+\delta),y) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k.$$1

using the $$\min_{\delta}\; L(f(x+\delta),y) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k.$$2-quasinorm proximal operator tailored for non-convex programming. In Phase II it freezes the discovered support subspace $$\min_{\delta}\; L(f(x+\delta),y) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k.$$3 and solves

$$\min_{\delta}\; L(f(x+\delta),y) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k.$$4

with projected Nesterov’s accelerated gradient descent. The paper reports a remarkable increase in group-wise sparsity, namely $$\min_{\delta}\; L(f(x+\delta),y) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k.$$5 on CIFAR-10 and $$\min_{\delta}\; L(f(x+\delta),y) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k.$$6 on ImageNet in the average-case targeted setting, while also reporting a $$\min_{\delta}\; L(f(x+\delta),y) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k.$$7 attack success rate, faster computation times, and improved explainability (Sadiku et al., 2023).

ATOS generalizes the same theme into a single differentiable framework for element-wise, pixel-wise, and group-wise perturbations. Its objective is

$$\min_{\delta}\; L(f(x+\delta),y) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k.$$8

The key regularizer is the Overlapping Smoothed $$\min_{\delta}\; L(f(x+\delta),y) \quad \text{subject to} \quad \|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k.$$9 function,

$\|\delta\|_0 \le k$0

which approaches the true count of nonzero groups as $\|\delta\|_0 \le k$1 and behaves like a weighted $\|\delta\|_0 \le k$2 penalty for large $\|\delta\|_0 \le k$3. ATOS couples this with a log-sum-exp approximation to the $\|\delta\|_0 \le k$4 norm and states that, under mild assumptions including the Kurdyka–Łojasiewicz property and bounded iterates, the algorithm converges to a critical point of the nonconvex composite objective. On CIFAR-10 and ImageNet, it reports a $\|\delta\|_0 \le k$5 attack success rate together with significantly sparser and more structurally coherent perturbations than prior methods (Heshmati et al., 18 Oct 2025).

The explainability claim in these structured attacks is operational rather than rhetorical. GSE measures overlap with Adversarial Saliency Maps through an Interpretability Score and reports that, for the top $\|\delta\|_0 \le k$6 percentile of ASM pixels, GSE’s score exceeds $\|\delta\|_0 \le k$7. ATOS states that group-wise attacks produce contiguous perturbations, distinguish robust from non-robust features, and can generate counterfactual images whose modified regions correspond to robust features of the target class (Sadiku et al., 2023, Heshmati et al., 18 Oct 2025).

4. Architecture-aware and modality-specific extensions

A central assumption in many sparse attacks is that the attacked network architecture remains fixed during optimization. The dynamics-aware attack on 3D sparse convolution networks shows that this assumption can fail when the model uses input-dependent execution. In that setting, architecture changes induce a lagged gradient: the attack learned at the current step becomes ineffective because the architecture changes afterward. The proposed Leaded Gradient Method reformulates gradients so that they are aware of potential dynamic changes of network architectures and better “lead” the next step. On semantic segmentation and classification, it achieves about $\|\delta\|_0 \le k$8 lower mIoU averagely on the ScanNet and S3DIS datasets than dynamic-unaware methods and also outperforms recent point cloud attacks (Tao et al., 2021).

In spiking neural networks, the problem is different but closely related. Standard white-box attacks depend on spatio-temporal back-propagation and surrogate gradients, yet those surrogate gradients may be invisible for an inference-only model because they do not influence inference results. The PDSG method derives a potential-dependent surrogate gradient from a two-point zeroth-order approximation and arrives at a Gaussian surrogate,

$\|\delta\|_0 \le k$9

with $k$0 in experiments. For binary DVS inputs, the Sparse Dynamic Attack uses a generation–reduction paradigm: it first flips top-$k$1 contributing entries identified by STBP+PDSG and finite differences, then prunes the set with binary search. Reported results include $k$2 attack success rate on ImageNet for PDSG and $k$3 attack success rate for SDA on CIFAR10-DVS by modifying only $k$4 of the pixels (Lun et al., 5 Mar 2025).

Text attacks expose a third modality-specific difficulty: the feasible set is discrete. The block-sparse attack against transformer-based text classifiers handles this by alternating a gradient step in embedding space, a projection onto the set of at most $k$5 nonzero blocks, and a nearest-neighbor projection back to the vocabulary using cosine similarity. Because each block corresponds to one token embedding, block-sparsity means at most $k$6 token substitutions. On AG News, MNLI, and Yelp Reviews, the method reduces GPT-2 accuracy to less than $k$7 while maintaining semantic similarity above $k$8 (Sadrizadeh et al., 2022).

5. Empirical behavior and evaluation protocols

The evaluation of sparse attacks is multidimensional because sparsity, attack success, invisibility, structure, and runtime do not collapse into a single metric. GreedyFool distinguishes dynamic evaluation, namely mean and median $k$9 pixels needed to reach $\|\delta\|_\infty \le \epsilon$0 fooling, from static evaluation, namely the “$\|\delta\|_\infty \le \epsilon$1-pixel fooling rate” when allowed at most $\|\delta\|_\infty \le \epsilon$2 modified pixels. It also reports target attack success under a pixel budget and machine invisibility using SRM detection rate and binary CNN classifier accuracy. On ImageNet with $\|\delta\|_\infty \le \epsilon$3, GreedyFool reduces the median number of modified pixels from $\|\delta\|_\infty \le \epsilon$4 for SparseFool to $\|\delta\|_\infty \le \epsilon$5, raises the “100 pixels fooling rate” from $\|\delta\|_\infty \le \epsilon$6 to $\|\delta\|_\infty \le \epsilon$7, and improves targeted success at budget $\|\delta\|_\infty \le \epsilon$8 pixels from $\|\delta\|_\infty \le \epsilon$9 for PGD$[-\epsilon,\epsilon]$0 to $[-\epsilon,\epsilon]$1. It also lowers SRM detection from $[-\epsilon,\epsilon]$2 to $[-\epsilon,\epsilon]$3, and on CIFAR-10 runs in $[-\epsilon,\epsilon]$4 s per image versus $[-\epsilon,\epsilon]$5 s for SparseFool (Dong et al., 2020).

SAIF evaluates on Inception-v3 and ResNet-50 with attack success rate as the primary outcome. On untargeted Inception-v3 at $[-\epsilon,\epsilon]$6, $[-\epsilon,\epsilon]$7, it reports GreedyFool ASR $[-\epsilon,\epsilon]$8, Homotopy-Attack ASR $[-\epsilon,\epsilon]$9, and SAIF ASR $\ell_\infty$00; at $\ell_\infty$01, $\ell_\infty$02, it reports GreedyFool ASR $\ell_\infty$03, Homotopy-Attack ASR $\ell_\infty$04, and SAIF ASR $\ell_\infty$05. For targeted Inception-v3 at $\ell_\infty$06, $\ell_\infty$07, it reports GreedyFool ASR $\ell_\infty$08, Homotopy-Attack ASR $\ell_\infty$09, and SAIF ASR $\ell_\infty$10. The same paper also states that $\ell_\infty$11 and that the perturbation is almost invisible even at $\ell_\infty$12 because only $\ell_\infty$13 pixels are modified (Imtiaz et al., 2022).

LP-BFGS evaluates both attack ability and computation under different pixel budgets. On CIFAR-10 with ResNet-20 and untargeted $\ell_\infty$14, LP-BFGS+CW reaches ASR $\ell_\infty$15 at $\ell_\infty$16, $\ell_\infty$17 at $\ell_\infty$18, and $\ell_\infty$19 at $\ell_\infty$20. On ImageNet with ResNet-34 and $\ell_\infty$21, LP-BFGS+CE reaches ASR $\ell_\infty$22, while LP-BFGS+CW reaches ASR $\ell_\infty$23. The authors present the method as having comparable attack ability with reasonable computation compared with existing solutions (Zhang et al., 2022).

Group-wise methods report additional structure-sensitive metrics. GSE uses ACP, ANC, $\ell_\infty$24, and $\ell_\infty$25, and for untargeted attacks reports ASR $\ell_\infty$26 on ResNet20 for CIFAR-10 and on VGG19 and ResNet50 for ImageNet, with ACP $\ell_\infty$27 and time $\ell_\infty$28 s / $\ell_\infty$29 s / $\ell_\infty$30 s, respectively. In targeted settings it also reports ASR $\ell_\infty$31 across the same backbones, with competing methods requiring $\ell_\infty$32–$\ell_\infty$33 more pixels and $\ell_\infty$34–$\ell_\infty$35 the runtime. Text attacks, by contrast, use semantic similarity and token error rate; SNN attacks use sparsity ratio, mean and median $\ell_\infty$36, and event-level budgets such as $\ell_\infty$37 flips (Sadiku et al., 2023, Sadrizadeh et al., 2022, Lun et al., 5 Mar 2025).

6. Limitations, misconceptions, and open technical issues

A persistent technical issue is that exact $\ell_\infty$38 optimization is difficult. LP-BFGS states directly that direct optimization of an $\ell_\infty$39 constraint is combinatorial, while SAIF states that projection onto $\ell_\infty$40 is NP-hard and therefore replaces projection with a linear minimization oracle over a convex hull. GSE and ATOS instead introduce nonconvex surrogates—respectively a $\ell_\infty$41-quasinorm regularizer and the OSL$\ell_\infty$42 function—and therefore emphasize stationarity, critical points, or convergence of a reduced subproblem rather than global optimality (Zhang et al., 2022, Imtiaz et al., 2022, Sadiku et al., 2023, Heshmati et al., 18 Oct 2025).

Another misconception is that sparsity alone guarantees imperceptibility. The literature does not support that conclusion. GreedyFool introduces a learned per-pixel distortion map specifically so that high-distortion pixels receive lower priority; SAIF emphasizes low-magnitude perturbations at a small number of pixels; text attacks preserve semantics through discrete nearest-neighbor projection and a semantic-similarity threshold of approximately $\ell_\infty$43. In other words, support size and perceptual quality are related but distinct design targets (Dong et al., 2020, Imtiaz et al., 2022, Sadrizadeh et al., 2022).

A further limitation is gradient fidelity. The dynamics-aware 3D sparse convolution paper shows that gradients can become lagged when the network architecture changes with the input, and the SNN paper shows that surrogate gradients may be invisible in inference-only settings. These cases indicate that sparse attack performance depends not only on the sparsity model or optimizer, but also on whether the backward signal accurately reflects the victim model’s effective forward behavior. This suggests that architecture-aware and modality-aware gradient design is as important as support selection itself (Tao et al., 2021, Lun et al., 5 Mar 2025).