ML Security PapersAngular Gradient Sign Method: Uncovering Vulnerabilities in Hyperbolic Networks
Minsoo Jo 1, Dongyoon Yang 2, Taesup Kim 1
Published on arXiv
2511.12985
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
AGSM reduces Poincaré ResNet-32 top-1 accuracy on CIFAR-100 to 13.93%, outperforming FGSM (19.67%) by exploiting angular perturbations in hyperbolic space.
AGSM (Angular Gradient Sign Method)
Novel technique introduced
Adversarial examples in neural networks have been extensively studied in Euclidean geometry, but recent advances in \textit{hyperbolic networks} call for a reevaluation of attack strategies in non-Euclidean geometries. Existing methods such as FGSM and PGD apply perturbations without regard to the underlying hyperbolic structure, potentially leading to inefficient or geometrically inconsistent attacks. In this work, we propose a novel adversarial attack that explicitly leverages the geometric properties of hyperbolic space. Specifically, we compute the gradient of the loss function in the tangent space of hyperbolic space, decompose it into a radial (depth) component and an angular (semantic) component, and apply perturbation derived solely from the angular direction. Our method generates adversarial examples by focusing perturbations in semantically sensitive directions encoded in angular movement within the hyperbolic geometry. Empirical results on image classification, cross-modal retrieval tasks and network architectures demonstrate that our attack achieves higher fooling rates than conventional adversarial attacks, while producing high-impact perturbations with deeper insights into vulnerabilities of hyperbolic embeddings. This work highlights the importance of geometry-aware adversarial strategies in curved representation spaces and provides a principled framework for attacking hierarchical embeddings.
Key Contributions
- Identifies that conventional adversarial attacks (FGSM, PGD) are geometry-agnostic and suboptimal for hyperbolic networks, with radial perturbations having near-zero impact on accuracy while angular perturbations are semantically destructive.
- Proposes AGSM (Angular Gradient Sign Method), which decomposes the loss gradient in hyperbolic tangent space into radial and angular components and applies perturbations exclusively along the angular (semantic) direction.
- Empirically demonstrates that AGSM achieves higher fooling rates than FGSM and PGD on both hyperbolic image classification (CIFAR-100) and cross-modal retrieval tasks.
🛡️ Threat Analysis
AGSM is a gradient-based adversarial example attack at inference time, crafting inputs that cause misclassification in hyperbolic networks by exploiting the angular component of the loss gradient in tangent space — a direct extension of FGSM/PGD adapted for non-Euclidean geometry.