Boundary Projected Gradient Descent Attack (BPDA)

How BPDA works in adversarial machine learning

Boundary Projected Gradient Descent Attack, or BPDA, is used against models that insert a non-differentiable defence into the inference path. Instead of stopping at that obstacle, the attacker substitutes a differentiable approximation for the blocked step and continues gradient-based optimisation toward the decision boundary.

The key idea is not to “break” the defence directly, but to make the optimisation problem tractable again. That makes BPDA especially relevant when a system relies on preprocessing, quantisation, rounding, or other operations that disrupt backpropagation while still leaving the model behaviour exploitable.

Why non-differentiable defences fail against BPDA

BPDA targets a common defensive assumption: if gradients are hidden or blocked, the model is harder to attack. In practice, many such defences only obscure the path to the gradient, rather than removing the underlying vulnerability. The attacker replaces the hard-to-differentiate component with a smooth surrogate, then estimates gradients through that substitute.

This matters because the attack can preserve the exact input-output surface enough to remain effective while bypassing the specific mechanism intended to frustrate optimisation. A defence that is secure only because it interrupts autodiff is often brittle once an attacker can approximate its effect.

For a broader threat-model perspective on adversarial AI techniques, MITRE ATLAS adversarial AI threat matrix is a useful reference for mapping BPDA-style behaviour to recognized AI attack patterns.

Where BPDA fits in attack chains

BPDA is usually part of a larger adversarial workflow, not the entire attack. It helps the attacker search over inputs, estimate loss gradients, and iteratively refine perturbations until the sample crosses the model’s decision boundary. The practical consequence is that a system can appear robust during simple testing, then fail once an adaptive adversary applies an optimisation-based method.

That is why BPDA is often discussed alongside other evasion techniques. The defence may still reduce casual attacks or low-effort probing, but it does not necessarily withstand a motivated attacker with access to a surrogate model, query access, or enough knowledge to reconstruct a usable approximation.

Practitioners should treat this as a signal to evaluate the full attack surface, not only the front-end defence layer. NIST AI Risk Management Framework is helpful for framing adversarial robustness as a lifecycle risk, not just a model-design concern.

Defensive implications for model testing and evaluation

BPDA is a reminder that robustness claims need adaptive testing. If a model’s security depends on a preprocessing stage, a non-differentiable transform, or gradient obfuscation, the evaluation should ask whether an attacker could approximate that stage and recover useful gradients anyway. If the answer is yes, the defence may be weaker than it appears.

Good evaluation focuses on the model as deployed, including the exact inference pipeline and any surrounding controls that affect attack feasibility. That includes considering whether the model can be probed repeatedly, whether the defence can be approximated externally, and whether the resulting perturbations have real-world effect once they leave the lab setting.

Independent assurance over AI systems is also becoming more formalised. ISO/IEC 42001:2023 AI Management System Standard provides a governance lens for documenting and reviewing AI risk controls, while NIST AI Risk Management Framework supports structured assessment of robustness and abuse resistance.

Risk and Threat Considerations

BPDA is dangerous because it can defeat defences that rely on non-differentiability rather than true robustness. A model may look hardened during routine testing, yet still be vulnerable to an adaptive adversary who can approximate the blocked step and optimise through it.

Failure mechanism: The defence masks gradients but does not remove the underlying decision surface, so the attacker substitutes a smooth surrogate and continues gradient-based search.

Impact: The model may accept adversarial inputs that cross the boundary, reducing confidence in the defence and increasing the chance of evasion, misclassification, or downstream abuse.

Practitioner Guidance

What to watch for: If a robustness claim depends on non-differentiability, treat that as a warning sign rather than a conclusion. Validate the defence against adaptive evaluation, not just naïve attacks, and check whether the same result holds when the blocked step is approximated.

Practitioner note: BPDA is most important as a test of defensive realism. If your control only works because the attacker has not yet approximated it, the control is probably not strong enough for production use.

Related resources from NHI Mgmt Group

• Gradient Descent
• Orthogonal Projected Gradient Descent
• How should security teams reduce risk when authentication is no longer the main attack boundary?
• How does a gradient-based attack work?