---
title: Gradient-Based Sparse Adversarial Attack
url: https://www.emergentmind.com/topics/gradient-based-sparse-adversarial-attack
type: topic
---

# Gradient-Based Sparse Adversarial Attack

Gradient-based sparse adversarial attacks are methods for constructing adversarial examples by using gradients, gradient surrogates, or related sensitivity information to alter only a small support of the input while inducing misclassification. In the image setting, representative formulations combine an $\ell_0$ sparsity budget with an $\ell_\infty$ magnitude bound; later work extends the same logic to group-wise image perturbations, dynamic 3D sparse convolution networks, spiking neural networks, and transformer-based text classifiers, where sparsity is imposed on pixels, overlapping groups, temporal events, or token blocks rather than on dense perturbation fields alone [2212.07495] [2311.17434] [2112.09428] [2203.05948].

## 1. Core optimization formulations

A canonical formulation seeks a perturbation $\delta$ that maximizes task loss while remaining both sparse and bounded in magnitude. SAIF writes the untargeted problem as
$$
\max_{\delta}\; D(\delta)
\quad \text{subject to} \quad
\|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k,
$$
with $D(\delta)=L(f(x+\delta),y)$, and also gives the equivalent generic minimization form
$$
\min_{\delta}\; L(f(x+\delta),y)
\quad \text{subject to} \quad
\|\delta\|_\infty \le \epsilon,\quad \|\delta\|_0 \le k.
$$
Here $\|\delta\|_0 \le k$ forces $k$-sparsity, while $\|\delta\|_\infty \le \epsilon$ bounds each pixel-wise change to $[-\epsilon,\epsilon]$ [2212.07495].

GreedyFool states the sparse objective in a complementary way:
$$
\min_{\delta}\|\delta\|_0
\quad
\text{s.t.}
\quad
\arg\max_c H(x+\delta)_c \neq y,
\quad
\|\delta\|_\infty \le \epsilon.
$$
Its adversarial loss is a C\&W-style margin loss,
$$
\mathcal{L}(x^{\mathrm{adv}},y)
=
\max\left\{
\max_{i\neq y} H(x^{\mathrm{adv}})_i - H(x^{\mathrm{adv}})_y,\;
-\kappa
\right\},
$$
where $H(\cdot)_i$ is the logit for class $i$ and $\kappa \ge 0$ is a confidence parameter [2010.13773].

In text, the same principle appears as block sparsity over token embeddings rather than coordinate sparsity over pixels. The block-sparse transformer attack optimizes
$$
\hat\delta
=
\Argmin_{\delta\in\mathbb{R}^{n\times d}}
L_{\mathrm{adv}}(\theta,e_x+\delta;y)
+
\alpha\sum_{i=1}^n \|\delta_i\|_2
\quad
\text{s.t.}
\quad
e_x+\delta \in E_{\mathcal V}^n,
$$
or, in hard form, restricts the number of nonzero blocks to at most $k$, so that only a few token substitutions are permitted [2203.05948].

## 2. Support selection and gradient-driven optimization

The practical difficulty is not merely optimizing perturbation magnitude, but discovering which coordinates should be active. A recurring pattern is to use gradients to rank coordinates and then to refine the perturbation on the selected support. GreedyFool explicitly follows this route. At iteration $t$, it computes the loss gradient $g_t=\nabla_{x_t^{\mathrm{adv}}}\mathcal{L}(x_t^{\mathrm{adv}},y)$, converts a learned distortion map $\varrho$ into a weight map $p$ using thresholds $\tau_2<\tau_1$, forms a masked weighted gradient
$$
g_t' = p \odot g_t \odot (1-m),
$$
and ranks pixels by $|g_t'|$. Its first stage grows the support by selecting the top-$k$ unselected pixel indices and updating only those coordinates; its second stage reduces the support by removing pixels with small perturbation magnitude whenever adversariality can be preserved. The paper attributes its gains over SparseFool to fresh-gradient selection, the distortion map, and the two-stage refine procedure [2010.13773].

SAIF replaces greedy growth with a Frank–Wolfe procedure over the convex hull of $k$-sparse $\pm\epsilon$ atoms. Its linear minimization oracle selects the $k$ indices with largest absolute gradient magnitude and sets
$$
s_t[i]=
\begin{cases}
-\epsilon\cdot \mathrm{sign}(g_i), & i\in \mathcal S_t,\\
0, & \text{otherwise},
\end{cases}
$$
where $\mathcal S_t$ is the top-$k$ index set. The update is
$$
\delta_{t+1}=\delta_t+\gamma_t(s_t-\delta_t).
$$
Under standard assumptions, the Frank–Wolfe gap satisfies a sublinear stationarity rate of $O(1/\sqrt{T})$ [2212.07495].

LP-BFGS uses a different decomposition. Instead of discovering the support online, it first computes Integrated Gradients attributions, selects the top-$K$ coordinates by $|\mathrm{IG}_i|$, and then optimizes only those variables with BFGS. If $f(\tilde w)=L(R(\tilde w),y)$, the search direction is $d^k=-H^k g^k$ with inverse-Hessian approximation $H^k$, followed by a Wolfe line search and the standard BFGS update. Because $K\ll CHW$, the method treats full-matrix BFGS as tractable even though storing $H^k$ costs $O(K^2)$ memory and updates cost $O(K^2)$ time per iteration [2210.15446].

| Method | Sparsity model | Core mechanism |
|---|---|---|
| GreedyFool [2010.13773] | Pixel-wise $\ell_0$ under $\ell_\infty$ budget | Distortion-aware gradient ranking with grow and reduce stages |
| SAIF [2212.07495] | $k$-sparse under $\ell_\infty$ bound | Frank–Wolfe LMO on top-$k$ gradient coordinates |
| LP-BFGS [2210.15446] | Exactly $K$ selected pixels | BFGS on Integrated-Gradients-selected variables |
| GSE [2311.17434] | Group-wise sparse patches | $p=\tfrac12$ proximal phase plus projected Nesterov refinement |
| ATOS [2510.16637] | Element-, pixel-, and group-wise sparsity | OSL$_0$ regularization with smooth $\ell_\infty$ control |

## 3. Structured sparsity and explainable perturbations

Sparse attacks need not be element-wise. GSE formulates group-wise sparse attacks through a two-phase algorithm. In Phase I it optimizes a quasinorm adversarial loss,
$$
\min_{\mathbf w}\;
\mathcal L(\mathbf x+\mathbf w,t)
+
\sum_{i,j,c}\lambda_{i,j,c}^{(k)} |w_{i,j,c}|^p,
\qquad p=\tfrac12,
$$
using the $1/2$-quasinorm proximal operator tailored for non-convex programming. In Phase II it freezes the discovered support subspace $V$ and solves
$$
\min_{\mathbf w\in V}\;
\mathcal L(\mathbf x+\mathbf w,t)+\mu\|\mathbf w\|_2
$$
with projected Nesterov’s accelerated gradient descent. The paper reports a remarkable increase in group-wise sparsity, namely $50.9\%$ on CIFAR-10 and $38.4\%$ on ImageNet in the average-case targeted setting, while also reporting a $100\%$ attack success rate, faster computation times, and improved explainability [2311.17434].

ATOS generalizes the same theme into a single differentiable framework for element-wise, pixel-wise, and group-wise perturbations. Its objective is
$$
\min_{\Delta}\;
CE(y_\delta,y_t)
+\lambda_s\, r_s(C(\Delta;\mathcal R))
+\lambda_\infty\, r_\infty(V(\Delta))
\quad
\text{s.t.}
\quad
X+\Delta \in [0,1]^{c\times w\times h}.
$$
The key regularizer is the Overlapping Smoothed $\ell_0$ function,
$$
r_s(x;\sigma)
=
\sum_{b=0}^{n_g-1}
\left[
1-\exp\left(
-\frac{1}{2\sigma^2}
\sum_{i=0}^{n_v-1} x_{sb+i}^2
\right)
\right],
$$
which approaches the true count of nonzero groups as $\sigma \to 0$ and behaves like a weighted $\ell_2^2$ penalty for large $\sigma$. ATOS couples this with a log-sum-exp approximation to the $\ell_\infty$ norm and states that, under mild assumptions including the Kurdyka–Łojasiewicz property and bounded iterates, the algorithm converges to a critical point of the nonconvex composite objective. On CIFAR-10 and ImageNet, it reports a $100\%$ attack success rate together with significantly sparser and more structurally coherent perturbations than prior methods [2510.16637].

The explainability claim in these structured attacks is operational rather than rhetorical. GSE measures overlap with Adversarial Saliency Maps through an Interpretability Score and reports that, for the top $10\%$ percentile of ASM pixels, GSE’s score exceeds $0.9$. ATOS states that group-wise attacks produce contiguous perturbations, distinguish robust from non-robust features, and can generate counterfactual images whose modified regions correspond to robust features of the target class [2311.17434] [2510.16637].

## 4. Architecture-aware and modality-specific extensions

A central assumption in many sparse attacks is that the attacked network architecture remains fixed during optimization. The dynamics-aware attack on 3D sparse convolution networks shows that this assumption can fail when the model uses input-dependent execution. In that setting, architecture changes induce a lagged gradient: the attack learned at the current step becomes ineffective because the architecture changes afterward. The proposed Leaded Gradient Method reformulates gradients so that they are aware of potential dynamic changes of network architectures and better “lead” the next step. On semantic segmentation and classification, it achieves about $20\%$ lower mIoU averagely on the ScanNet and S3DIS datasets than dynamic-unaware methods and also outperforms recent point cloud attacks [2112.09428].

In spiking neural networks, the problem is different but closely related. Standard white-box attacks depend on spatio-temporal back-propagation and surrogate gradients, yet those surrogate gradients may be invisible for an inference-only model because they do not influence inference results. The PDSG method derives a potential-dependent surrogate gradient from a two-point zeroth-order approximation and arrives at a Gaussian surrogate,
$$
\sigma_{\mathrm{PDSG}}(u)
=
\frac{1}{\sqrt{2\pi}\sigma}
\exp\!\left(
-\frac{(u-V_{\mathrm{th}}-b)^2}{2\sigma^2}
\right),
$$
with $b=0.5\sigma$ in experiments. For binary DVS inputs, the Sparse Dynamic Attack uses a generation–reduction paradigm: it first flips top-$k$ contributing entries identified by STBP+PDSG and finite differences, then prunes the set with binary search. Reported results include $100\%$ attack success rate on ImageNet for PDSG and $82\%$ attack success rate for SDA on CIFAR10-DVS by modifying only $0.24\%$ of the pixels [2503.03272].

Text attacks expose a third modality-specific difficulty: the feasible set is discrete. The block-sparse attack against transformer-based text classifiers handles this by alternating a gradient step in embedding space, a projection onto the set of at most $k$ nonzero blocks, and a nearest-neighbor projection back to the vocabulary using cosine similarity. Because each block corresponds to one token embedding, block-sparsity means at most $k$ token substitutions. On AG News, MNLI, and Yelp Reviews, the method reduces GPT-2 accuracy to less than $5\%$ while maintaining semantic similarity above $0.8$ [2203.05948].

## 5. Empirical behavior and evaluation protocols

The evaluation of sparse attacks is multidimensional because sparsity, attack success, invisibility, structure, and runtime do not collapse into a single metric. GreedyFool distinguishes dynamic evaluation, namely mean and median $\ell_0$ pixels needed to reach $100\%$ fooling, from static evaluation, namely the “$m$-pixel fooling rate” when allowed at most $m$ modified pixels. It also reports target attack success under a pixel budget and machine invisibility using SRM detection rate and binary CNN classifier accuracy. On ImageNet with $\epsilon=255$, GreedyFool reduces the median number of modified pixels from $80.5$ for SparseFool to $27$, raises the “100 pixels fooling rate” from $56.0\%$ to $82.9\%$, and improves targeted success at budget $200$ pixels from $5.56\%$ for PGD$_0$ to $15.52\%$. It also lowers SRM detection from $74.4\%$ to $61.5\%$, and on CIFAR-10 runs in $0.114$ s per image versus $0.291$ s for SparseFool [2010.13773].

SAIF evaluates on Inception-v3 and ResNet-50 with attack success rate as the primary outcome. On untargeted Inception-v3 at $\epsilon=255$, $k=600$, it reports GreedyFool ASR $\approx 19.4\%$, Homotopy-Attack ASR $\approx 90.97\%$, and SAIF ASR $=100.0\%$; at $\epsilon=10$, $k=2000$, it reports GreedyFool ASR $\approx 5.6\%$, Homotopy-Attack ASR $\approx 85.0\%$, and SAIF ASR $\approx 90.0\%$. For targeted Inception-v3 at $\epsilon=100$, $k=200$, it reports GreedyFool ASR $\approx 0.4\%$, Homotopy-Attack ASR $\approx 18.3\%$, and SAIF ASR $\approx 66.3\%$. The same paper also states that $\|\delta\|_2/\|x\|_2 \lesssim 0.01$ and that the perturbation is almost invisible even at $\epsilon=255$ because only $k\ll hwc$ pixels are modified [2212.07495].

LP-BFGS evaluates both attack ability and computation under different pixel budgets. On CIFAR-10 with ResNet-20 and untargeted $\kappa=0$, LP-BFGS+CW reaches ASR $59.6$ at $k=20$, $84.3$ at $k=40$, and $93.0$ at $k=60$. On ImageNet with ResNet-34 and $k=1000$, LP-BFGS+CE reaches ASR $97.6$, while LP-BFGS+CW reaches ASR $83.9$. The authors present the method as having comparable attack ability with reasonable computation compared with existing solutions [2210.15446].

Group-wise methods report additional structure-sensitive metrics. GSE uses ACP, ANC, $\ell_2$, and $d_{2,0}$, and for untargeted attacks reports ASR $100\%$ on ResNet20 for CIFAR-10 and on VGG19 and ResNet50 for ImageNet, with ACP $3.6\%/1.5\%/1.9\%$ and time $0.39$ s / $38.9$ s / $23.8$ s, respectively. In targeted settings it also reports ASR $100\%$ across the same backbones, with competing methods requiring $2$–$5\times$ more pixels and $2$–$4\times$ the runtime. Text attacks, by contrast, use semantic similarity and token error rate; SNN attacks use sparsity ratio, mean and median $\ell_0$, and event-level budgets such as $\|\delta\|_0<800$ flips [2311.17434] [2203.05948] [2503.03272].

## 6. Limitations, misconceptions, and open technical issues

A persistent technical issue is that exact $\ell_0$ optimization is difficult. LP-BFGS states directly that direct optimization of an $\ell_0$ constraint is combinatorial, while SAIF states that projection onto $\{\delta:\|\delta\|_0\le k,\|\delta\|_\infty\le\epsilon\}$ is NP-hard and therefore replaces projection with a linear minimization oracle over a convex hull. GSE and ATOS instead introduce nonconvex surrogates—respectively a $1/2$-quasinorm regularizer and the OSL$_0$ function—and therefore emphasize stationarity, critical points, or convergence of a reduced subproblem rather than global optimality [2210.15446] [2212.07495] [2311.17434] [2510.16637].

Another misconception is that sparsity alone guarantees imperceptibility. The literature does not support that conclusion. GreedyFool introduces a learned per-pixel distortion map specifically so that high-distortion pixels receive lower priority; SAIF emphasizes low-magnitude perturbations at a small number of pixels; text attacks preserve semantics through discrete nearest-neighbor projection and a semantic-similarity threshold of approximately $0.8$. In other words, support size and perceptual quality are related but distinct design targets [2010.13773] [2212.07495] [2203.05948].

A further limitation is gradient fidelity. The dynamics-aware 3D sparse convolution paper shows that gradients can become lagged when the network architecture changes with the input, and the SNN paper shows that surrogate gradients may be invisible in inference-only settings. These cases indicate that sparse attack performance depends not only on the sparsity model or optimizer, but also on whether the backward signal accurately reflects the victim model’s effective forward behavior. This suggests that architecture-aware and modality-aware gradient design is as important as support selection itself [2112.09428] [2503.03272].

Source: https://www.emergentmind.com/topics/gradient-based-sparse-adversarial-attack