Fast Adversarial Attacks with Gradient Prediction

Technical Summary: Fast Adversarial Attacks with Gradient Prediction

Problem Statement
Generating adversarial examples at scale is a fundamental requirement for robustness evaluation, adversarial training, and red-teaming. However, even "fast" single-step attacks like the Fast Gradient Sign Method (FGSM) are throughput-limited by the computational cost of the backward pass required to compute input gradients. For large-scale models, particularly Large Language Models (LLMs), this backward pass dominates the cost of adversarial data generation, creating a bottleneck in robustness pipelines constrained by wall-clock time and accelerator availability. Existing methods to reduce this cost (e.g., recycling gradients or restricting backpropagation to early layers) still fundamentally rely on backpropagation.

Methodology
The authors propose a family of attacks that eliminates the backward pass entirely at attack time by predicting the input gradient direction from forward-pass hidden states using a lightweight linear regression model.

• Core Mechanism: The method fits a linear regressor (with a bias term) on a small training set to map hidden state vectors $h_\theta(x)$ to input gradients $\nabla_x S_\theta(x, t)$, where $S$ is an attack score (e.g., a target logit). The attack then proceeds using the predicted gradient $\hat{g}$ in an FGSM-style update: $x_{adv} = x + \epsilon \text{sgn}(\hat{g})$.
• Theoretical Foundation: The approach is motivated by the Neural Tangent Kernel (NTK) and Gaussian Process (GP) views of neural networks. In the infinite-width limit, the joint distribution of hidden states and input gradients is Gaussian. Under specific conditions—specifically, the use of stationary kernels and constant mean functions (achieved via idealized sine-cosine embeddings)—the conditional expectation of the gradient given the hidden state is an affine function independent of the input $x$. This theoretically justifies the use of a single, input-independent linear map to predict gradients.
• Practical Implementation:
  • Embedding Choice: While proofs utilize idealized sine-cosine embeddings to ensure stationarity, the method is applied to practical models using learned token embeddings. The authors note that real-world positional encodings (e.g., RoPE) share similar trigonometric rotation structures.
  • Training: The predictor is trained on a small dataset of (hidden state, normalized gradient) pairs. To improve stability and generalization, the authors employ coordinate-wise standardization of hidden states, normalize gradient targets to unit norm (focusing the predictor on direction rather than magnitude), and use ridge regression.
  • Efficiency: During inference, the method requires only a forward pass (often using an early-exit hidden state) and a linear matrix-vector multiplication, avoiding any backpropagation.

Key Contributions

1. Gradient Prediction Framework: Introduction of a method that replaces the expensive backward pass with a learned linear predictor, enabling adversarial generation using only forward computations.
2. Theoretical Justification: A proof that in the NTK regime with stationary kernels, the mapping from hidden states to input gradients is exactly affine and input-independent.
3. Throughput Optimization: Demonstration that this approach significantly increases the number of adversarial examples generated per unit time, making robustness screening feasible in inference-only or resource-constrained settings.

Experimental Results
The authors evaluated their method (referred to as GPR-FGSM or GCG-GPR) against exact-gradient baselines (FGSM, PGD, GCG) on three LLMs (Llama-2-7B, Qwen2.5-3B, Qwen3-4B) using the HarmBench and JailbreakBench datasets.

• Embedding-Level Attacks: In continuous embedding perturbation tasks, the GPR variants achieved a 532% increase in throughput (e.g., for FGSM on Qwen3-4B) compared to exact-gradient attacks. While Attack Success Rates (ASR) were generally lower than exact-gradient methods, they maintained a substantial fraction of the performance (e.g., 6.8% vs 12.6% ASR for FGSM on Qwen3-4B) while being an order of magnitude faster. The method shifted the Pareto frontier, offering high-throughput options for one-shot attacks.
• Token-Level Attacks: For discrete prompt attacks using the Greedy Coordinate Gradient (GCG) method, replacing the backward-computed gradient with the predicted gradient increased perturbation throughput by 1.5–3× and successful-attack throughput by 2–2.4×. Crucially, the ASR remained statistically indistinguishable from the exact-gradient baseline in most settings, indicating that the predicted gradient is sufficient to identify promising token candidates for the subsequent exact forward-pass evaluation.
• Sensitivity Analysis: Experiments mixing predicted and exact gradients revealed that one-shot FGSM is robust to significant gradient noise as long as the coordinate-wise sign agreement crosses a specific threshold. Pure GPR sometimes fell just below this threshold on difficult benchmarks (e.g., JailbreakBench with Qwen3-4B), but a small admixture of exact gradient restored performance.

Significance and Claims
The paper claims that gradient prediction offers a simple and general route to significantly faster adversarial generation under realistic constraints. The primary significance lies in enabling robustness evaluation and red-teaming at scales previously limited by backward-pass costs. The authors emphasize that this work does not introduce new attack capabilities or make attacks more powerful in terms of success rate; rather, it improves the efficiency of existing methods. This allows for broader screening of model robustness, including in deployment scenarios where backpropagation is impractical (e.g., inference-only environments). The authors conclude that the regularity of representation-gradient relationships in modern networks is sufficient to exploit for fast adversarial generation, even outside the strict infinite-width theoretical regime.