# US 2026/0087362 A1 · System and method for detecting cycles in projected gradient descent for adversarial attack

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2026/0087362 A1
- Document ID: US20260087362A1
- Status: Published application
- Kind: A1
- Application number: 18/891,749
- Filed: 2024-09-20
- Published: 2026-03-26
- Earliest claimed: 2024-09-20
- Assignees: Booz Allen Hamilton Inc.
- Applicants: Booz Allen Hamilton Inc.
- Inventors: Philip Doldo; Derek Everett; Amol Khanna; Andre T. Nguyen; Edward Raff
- Web page: https://patentgrep.com/patent/US20260087362A1

## CPC

- G06N 3/094: Adversarial learning
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Provided are systems, methods, and computer program products for detecting cycles in adversarial attack of a data element including memory configured to include storage locations to store data elements and perturbation data and a processor configured with an adversarial attack module. The processor is configured with program code that, when executed, will cause the processor to iteratively execute generating a perturbed data element by applying a data perturbation with a projected gradient descent algorithm on at least one data element, extracting the data perturbation from the perturbed data element as perturbation data, determining whether the perturbation data is present in the memory, and when the perturbation data is not present in the memory, storing the perturbation data in the memory, and terminating the iterative execution upon confirming that the perturbation data is present in the memory.

## Claims

### Claim 1

A computing system for detecting cycles in adversarial attack of a data element, the computing system comprising:
memory configured to include storage locations to store data elements and perturbation data; and
a processor configured with an adversarial attack module, the processor configured with program code that, when executed, will cause the processor to iteratively execute:
generating a perturbed data element by applying a data perturbation with a projected gradient descent algorithm on at least one data element;
extracting the data perturbation from the perturbed data element as perturbation data;
determining whether the perturbation data is present in the memory, and when the perturbation data is not present in the memory, storing the perturbation data in the memory; and
terminating the iterative execution upon confirming that the perturbation data is present in the memory.

### Claim 2 (depends on 1)

The computing system of claim 1, wherein the iterative execution includes a maximum iteration value, such that the processor will automatically terminate the iterative execution when the maximum iteration value of the iterative execution is performed by the processor.

### Claim 3 (depends on 1)

The computing system of claim 1, wherein the program code will cause the processor to iteratively execute:
inputting the perturbed data element to at least one trained machine learning model to generate an output data label;
comparing the output data label to a predetermined data label associated with the perturbed data element to determine whether the output data label matches the predetermined data label; and
terminating the iterative execution upon confirming that the output data label does not match the predetermined data label associated with the perturbed data element.

### Claim 4 (depends on 1)

The computing system of claim 1, wherein the projected gradient descent algorithm is defined by:
δ
(
i
)
=
𝒫
β
(
δ
(
i
-
1
)
+
α
⁢
sign
⁢
(
∇
X
(
ℒ
⁢
(
f
⁢
(
X
+
δ
(
i
-
1
)
)
,
y
)
)
)
,
where δ is the data associated with perturbations, i is an iteration counter, is a projection function where ={δ: ∥δ∥∞≤∈}, ∈ is a radius, α is a step size, □x is a gradient of X and sign is a sign of the gradient, X is the at least one data element or the perturbed data element, y is the predetermined data label, and is a differentiable loss function such that (f(X), y) is loss of the at least one machine learning model, where y is the at least one machine learning model.

### Claim 5 (depends on 4)

The computing system of claim 4, wherein the step size a is a fixed step size.

### Claim 6 (depends on 1)

The computing system of claim 1, wherein the program code will cause the processor to evaluate a measure of model robustness for the at least one machine learning model based on the perturbation data stored in the memory.

### Claim 7 (depends on 1)

The computing system of claim 1, wherein the perturbation data stored in the memory are stored as a hash of a tensor representing the perturbation data.

### Claim 8

A computing system for detecting cycles in adversarial attack of a data element, the computing system comprising:
memory configured to include storage locations to store data elements and perturbation data; and
a processor configured with an adversarial attack module, the processor configured with program code that, when executed, will cause the processor to iteratively execute:
generating a perturbed data element by applying a data perturbation with a projected gradient descent algorithm on at least one data element, the perturbed data element having a predetermined data label;
inputting the perturbed data element to at least one trained machine learning model to generate an output data label;
comparing the output data label to the predetermined data label; and
terminating iterative execution upon confirming that the output data label does not match the predetermined data label.

### Claim 9 (depends on 8)

The computing system of claim 8, wherein the iterative execution includes a maximum iteration value, such that the processor will automatically terminate the iterative execution when the maximum iteration value of the iterative execution is performed by the processor.

### Claim 10 (depends on 8)

The computing system of claim 8, wherein the program code will cause the processor to iteratively execute:
extracting the data perturbation from the perturbed data element as perturbation data;
determining whether the perturbation data is present in the memory, and when the perturbation data is not present in the memory, storing the perturbation data in the memory; and
terminating the iterative execution upon confirming that the perturbation data is present in the memory.

### Claim 11 (depends on 8)

The computing system of claim 8, wherein the projected gradient descent algorithm is defined by:
δ
(
i
)
=
𝒫
β
(
δ
(
i
-
1
)
+
α
⁢
sign
⁢
(
∇
X
(
ℒ
⁢
(
f
⁢
(
X
+
δ
(
i
-
1
)
)
,
y
)
)
)
,
where δ is the data associated with perturbations, i is an iteration counter, is a projection function where ={δ: ∥δ∥∞≤∈}, ∈ is a radius, α is a step size, ∇x is a gradient of X and sign is a sign of the gradient, X is the at least one data element or the perturbed data element, y is the predetermined data label, and is a differentiable loss function such that (f(X), y) is loss of the at least one machine learning model, where y is the at least one machine learning model.

### Claim 12 (depends on 11)

The computing system of claim 11, wherein the step size a is a fixed step size.

### Claim 13 (depends on 10)

The computing system of claim 10, wherein the program code will cause the processor to evaluate a measure of model robustness for the at least one machine learning model based on the perturbation data stored in the memory.

### Claim 14 (depends on 10)

The computing system of claim 10, wherein the perturbation data stored in the memory are stored as a hash of a tensor representing the perturbation data.

### Claim 15

A computer-implemented method for detecting cycles in adversarial attack of a data element, the method comprising:
iteratively executing:
generating, with at least one processor, a perturbed data element by applying a projected gradient descent algorithm to at least one data element, wherein the projected gradient descent algorithm attacks the at least one data element by applying a data perturbation to the at least one data element;
inputting the perturbed data element, the perturbed data element having a predetermined data label, to at least one trained machine learning model to generate an output data label;
comparing, with the at least one processor, the output data label with the predetermined data label;
extracting the data perturbation from the perturbed data element as perturbation data;
reading, with the at least one processor, data entries of perturbation data in the memory;
wherein, when the perturbation data is not stored in the memory and the output data label matches the predetermined data label:
storing, with the at least one processor, the perturbation data in the memory; and
continuing, with the at least one processor, the iterative execution; or
wherein, when the perturbation data is stored in the memory or the output data label does not match the predetermined data label:
determining a cycle has occurred and terminating, with the at least one processor, the iterative execution.

### Claim 16 (depends on 15)

The method of claim 15, wherein the iterative execution includes a maximum iteration value, such that the at least one processor will automatically terminate the iterative execution when a number of iterations is performed by the at least one processor reaches the maximum iteration value.

### Claim 17 (depends on 15)

The method of claim 15, wherein the projected gradient descent algorithm is defined by:
δ
(
i
)
=
𝒫
β
(
δ
(
i
-
1
)
+
α
⁢
sign
⁢
(
∇
X
(
ℒ
⁢
(
f
⁢
(
X
+
δ
(
i
-
1
)
)
,
y
)
)
)
,
where δ is the data associated with perturbations, i is an iteration counter, is a projection function where ={δ: ∥δ∥∞≤∈}, ∈ is a radius, α is a step size, ∇x is a gradient of X and sign is a sign of the gradient, X is the at least one data element or the perturbed data element, y is the predetermined data label, and is a differentiable loss function such that (f(X), y) is loss of the at least one machine learning model, where y is the at least one machine learning model.

### Claim 18 (depends on 17)

The method of claim 17, wherein the step size a is a fixed step size.

### Claim 19 (depends on 15)

The method of claim 15, including evaluating, with the at least one processor, a measure of model robustness for the at least one machine learning model based on the perturbation data stored in the memory.

### Claim 20 (depends on 15)

The method of claim 15, wherein the perturbation data stored in the memory are stored as a hash of a tensor representing the perturbation data.