Fast Adversarial Attacks with Gradient Prediction

The gist The authors introduce a family of attacks that eliminates the backward pass by predicting input gradients from forward-pass hidden states via a lightweight linear regression, which recovers much of FGSM’s attack performance while using only a small fraction of the time, corresponding to a 532% increase in throughput

Introduction and Motivation

Adversarial examples expose small, structured perturbations that can reliably change a model’s prediction Beyond their diagnostic value, adversarial inputs are a practical tool for robustness evaluation and for training procedures that explicitly optimize against worst-case perturbations A recurring operational obstacle is throughput, as modern robustness pipelines are often constrained by wall-clock time and accelerator availability Even “one-step” attacks inherit a fundamental bottleneck because FGSM uses a single update but still requires an input gradient of a chosen attack score For large networks, this typically means an additional backward pass per example, which can dominate the cost of adversarial data generation The key idea is to predict the input gradient from quantities already produced during the forward pass: a hidden state (representation) vector Concretely, they fit a lightweight linear regressor that maps hidden states to input gradients and then perform an FGSM-style update using the predicted gradient

Theoretical Foundation

The theoretical analysis is conducted in the idealized Neural Tangent Kernel (NTK) regime Under Gaussian conditioning for gradients, the conditional mean is affine: E[G H] = µG + ΣGHΣ−1 HH(H − µH) In the NTK specialization, joint Gaussianity of (H(x), G(x)) follows from the GP derivative rule rather than being an extra Gaussianity assumption Lemma 1 supplies stationarity for a trigonometric embedding, and Lemma 2 gives its constant cross-covariances Proposition 1 derives the formula for the affine predictor, showing that E[G(x) H(x)] = AH(x) + b, where A and b are independent of x This predictor recovers G(x) almost surely precisely when Cov(G(x), G(x)) − ΣGHΣ−1 HHΣ⊤ GH = 0

Methodology and Training

The core method involves fitting a linear predictor on a small training set to approximate the gradient: ∇xSθ(x, t) ≈ A hθ(x) + b The predictor is learned for a specified model, layer, objective, and prompt-target distribution For embedding-level attacks, the GPR predictor is a single linear map from a layer-L hidden state to the per-token unit-normalized gradient gˆt = gt/∥gt∥2 of the target logit with respect to the input embedding at token t The predictor training involves running a full forward/backward pass and recording layer-L input hidden states paired with gˆt, and then taking K FGSM augmentation steps in input-embedding space, recomputing the forward/backward at each step and recording the resulting (h, gˆ) pairs The predictor is trained using a single weighted ridge regression with fixed λ=1, solved via an eigendecomposition

Experimental Results

The experiments evaluate methods on Llama 2 (released in 2023), Qwen 2.5 (released in 2024), and Qwen 3 (released in 2025) against JailbreakBench and HarmBench Table 1 reports results on model-specific non-trivial subsets of the HarmBench test split, showing that GPR has higher successful-attack-throughput point estimates than the corresponding exact-gradient method in each reported HarmBench comparison Figure 1 plots ASR against successful-attack throughput across all attack variants and models, showing that GPR enables a new part of the Pareto frontier, with the largest gains for the cheap one-shot attacks (FGSM, RS-FGSM, FGM)

Token-Level Attacks

For token-level attacks using Greedy Coordinate Gradient (GCG), GCG-GPR replaces the backward-computed gradient in (7) with a predicted gradient from an intermediate hidden representation The method keeps the GCG loss and greedy candidate evaluation unchanged, but replaces the exact GCG candidate score with ∆b r,v = (Ev − Ear)⊤ gbr, Cbr = TopKv∈[V] This makes GCG-GPR a drop-in acceleration of GCG’s candidate-generation step

Conclusion

The method produces FGSM-style perturbations using only forward computation, substantially improving adversarial throughput under realistic wallclock constraints The authors suggest that representation-gradient relationships in modern networks are regular enough to exploit for fast adversarial generation.

Ethics and Limitations

The work lowers the computational cost of adversarial generation, but it may also lower the cost of searching for harmful outputs or bypassing safeguards Predictors are trained for a particular model, layer, objective, and prompt-target distribution; model updates or distribution changes may require retraining the predictor Embedding perturbations are not directly deployable token attacks. The theory is a conditionalmean characterization under idealized assumptions, not an exact-gradient guarantee for real-world transformers. Predictors are trained for a particular model, layer, objective, and prompt-target distribution; model updates or distribution changes may require retraining the predictor The cost of such training must be amortized. The release is intended to support reproducible safety research. Large language models were used during the preparation of this work in the following ways, including as coding assistants and for research ideation The authors take full responsibility for the content of the paper.

References

Maksym Andriushchenko and Nicolas Flammarion Understanding and improving fast adversarial training In Annual Conference on Neural Information Processing Systems 2020 Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion George J Pappas Florian Tramer et al Jailbreakbench An open robustness benchmark for jailbreaking large language models Advances in Neural Information Processing Systems 37:55005–55029 2024 Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi and Cho-Jui Hsieh Zoo Zeroth order optimization based black-box attacks to deep neural networks without training substitute models In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security AISec ’17 2017 Wojciech Marian Czarnecki Grzegorz Swirszcz Max Jaderberg Simon Osindero Oriol Vinyals Alex Graves David Silver and Koray Kavukcuoglu Understanding synthetic gradients and decoupled neural interfaces In International Conference on Machine Learning pp. 904–912 PMLR 2017 Ian J. Goodfellow Jonathon Shlens and Christian Szegedy Explaining and harnessing adversarial examples In Yoshua Bengio and Yann LeCun (eds.

1. Bold prediction of input gradients via hidden states: The system can eliminate the backward pass for adversarial example generation by fitting a lightweight linear regressor that maps hidden states to input gradients, increasing throughput by 532% while recovering much of FGSM's attack performance.

2. Exact affine conditional mean characterization in NTK regime: For idealized models, the method derives an exact affine conditional gradient means where the prediction is E[G H] = AH(x) + b, providing a theoretically optimal predictor for generating perturbations.

3. Enhanced token-level attack efficiency: The system can accelerate discrete prompt attacks by using GCG-GPR, which replaces the backward-computed suffix gradient with a predicted gradient from an intermediate hidden representation, yielding 2–2.4× higher successful-attack throughput compared to exact GCG in some regimes.

4. Robustness evaluation at scale: This enables a family of attacks that eliminates the backward pass by predicting the input gradient, making adversarial generation feasible under realistic wall-clock constraints for large language models and other architectures.

Generating adversarial examples at scale is a core primitive for robustness evaluation, adversarial training, and red-teaming, yet even "fast" attacks such as FGSM remain throughput-limited by the cost of a backward pass. We introduce a family of attacks that eliminates the backward pass by predicting the input gradient from forward-pass hidden states via a lightweight linear regression. Theoretically, we derive exact affine conditional gradient means, showing optimality in the (idealized) NTK regime. Empirically, our methods work when applied to practical finite-width models; we recover much of FGSM's attack performance while using only a small fraction of the time, corresponding to a 532% increase in throughput. These results suggest gradient prediction as a simple and general route to significantly faster adversarial generation under realistic wall-clock constraints.