System and method for detecting cycles in projected gradient descent for adversarial attack

Patent metadata

Field	Value
Publication number	US-2026087362-A1
Application number	US-202418891749-A
Country	US
Kind code	A1
Filing date	Sep 20, 2024
Priority date	Sep 20, 2024
Publication date	Mar 26, 2026
Grant date	—

Abstract

Provided are systems, methods, and computer program products for detecting cycles in adversarial attack of a data element including memory configured to include storage locations to store data elements and perturbation data and a processor configured with an adversarial attack module. The processor is configured with program code that, when executed, will cause the processor to iteratively execute generating a perturbed data element by applying a data perturbation with a projected gradient descent algorithm on at least one data element, extracting the data perturbation from the perturbed data element as perturbation data, determining whether the perturbation data is present in the memory, and when the perturbation data is not present in the memory, storing the perturbation data in the memory, and terminating the iterative execution upon confirming that the perturbation data is present in the memory.

First claim

What is claimed is:

1 . A computing system for detecting cycles in adversarial attack of a data element, the computing system comprising:
memory configured to include storage locations to store data elements and perturbation data; and a processor configured with an adversarial attack module, the processor configured with program code that, when executed, will cause the processor to iteratively execute: generating a perturbed data element by applying a data perturbation with a projected gradient descent algorithm on at least one data element; extracting the data perturbation from the perturbed data element as perturbation data; determining whether the perturbation data is present in the memory, and when the perturbation data is not present in the memory, storing the perturbation data in the memory; and terminating the iterative execution upon confirming that the perturbation data is present in the memory.

2 . The computing system of claim 1 , wherein the iterative execution includes a maximum iteration value, such that the processor will automatically terminate the iterative execution when the maximum iteration value of the iterative execution is performed by the processor.

3 . The computing system of claim 1 , wherein the program code will cause the processor to iteratively execute:
inputting the perturbed data element to at least one trained machine learning model to generate an output data label; comparing the output data label to a predetermined data label associated with the perturbed data element to determine whether the output data label matches the predetermined data label; and terminating the iterative execution upon confirming that the output data label does not match the predetermined data label associated with the perturbed data element.

4 . The computing system of claim 1 , wherein the projected gradient descent algorithm is defined by:

δ

(
i
)

=

𝒫
β

(

δ

(

i
-
1

)

+

α
⁢

sign
⁢

(

∇
X

(

ℒ
⁢

(

f
⁢

(

X
+

δ

(

i
-
1

)

)

,
y

)

)

)

,

where δ is the data associated with perturbations, i is an iteration counter, is a projection function where ={δ: ∥δ∥ ∞ ≤∈}, ∈ is a radius, α is a step size, □ x is a gradient of X and sign is a sign of the gradient, X is the at least one data element or the perturbed data element, y is the predetermined data label, and is a differentiable loss function such that (f(X), y) is loss of the at least one machine learning model, where y is the at least one machine learning model.

5 . The computing system of claim 4 , wherein the step size a is a fixed step size.

6 . The computing system of claim 1 , wherein the program code will cause the processor to evaluate a measure of model robustness for the at least one machine learning model based on the perturbation data stored in the memory.

7 . The computing system of claim 1 , wherein the perturbation data stored in the memory are stored as a hash of a tensor representing the perturbation data.

8 . A computing system for detecting cycles in adversarial attack of a data element, the computing system comprising:
memory configured to include storage locations to store data elements and perturbation data; and a processor configured with an adversarial attack module, the processor configured with program code that, when executed, will cause the processor to iteratively execute: generating a perturbed data element by applying a data perturbation with a projected gradient descent algorithm on at least one data element, the perturbed data element having a predetermined data label; inputting the perturbed data element to at least one trained machine learning model to generate an output data label; comparing the output data label to the predetermined data label; and terminating iterative execution upon confirming that the output data label does not match the predetermined data label.

9 . The computing system of claim 8 , wherein the iterative execution includes a maximum iteration value, such that the processor will automatically terminate the iterative execution when the maximum iteration value of the iterative execution is performed by the processor.

10 . The computing system of claim 8 , wherein the program code will cause the processor to iteratively execute:
extracting the data perturbation from the perturbed data element as perturbation data; determining whether the perturbation data is present in the memory, and when the perturbation data is not present in the memory, storing the perturbation data in the memory; and terminating the iterative execution upon confirming that the perturbation data is present in the memory.

11 . The computing system of claim 8 , wherein the projected gradient descent algorithm is defined by:

δ

(
i
)

Assignees

• Booz Allen Hamilton Inc

Inventors

• Doldo Philip
• Everett Derek
• Khanna Amol
• Nguyen Andre T
• Raff Edward

Classifications

• G06N3/094 Primary

  Adversarial learning · CPC title