claudini/claudini/methods/original/sm_gcg

name, full_name, reference, paper_url

name	full_name	reference	paper_url
SM-GCG	Spatial Momentum GCG	gu2025smgcg	https://doi.org/10.3390/electronics14193967

SM-GCG — Spatial Momentum GCG

Paper: Gu et al., "SM-GCG: Spatial Momentum Greedy Coordinate Gradient for Robust Jailbreak Attacks on Large Language Models" (2025) Links: DOI \cite{gu2025smgcg}

Algorithm

Two modifications over GCG:

1. Spatial momentum: Instead of computing the gradient at a single point, SM-GCG averages gradients across multiple transformed versions of the input in four spaces (text-space synonym replacement is omitted):

   • Candidate space (6 samples): gradients at previous-step candidates (loss-guided)
   • Token space (6 samples): 2 cyclic shifts (±1) + 4 random token replacements
   • One-hot space (7 samples): Gaussian noise (var=0.0001) on one-hot vectors
   • Embedding space (7 samples): Gaussian noise (var=0.0001) on embedding vectors

   Final gradient: g = α·∇L(x) + Σ λ_i·G_i(x_transformed) where α=0.25 and each spatial sample gets weight (1-α)/n_spatial.

2. Temporal momentum (MAC-style EMA): m_t = μ·m_{t-1} + (1-μ)·g_t with μ=0.4. Candidates sampled from m_t.

Key Hyperparameters

• search_width (B): number of candidates per step (default: 512)
• topk (K): top-k tokens per position from gradient (default: 256)
• n_replace: tokens replaced per candidate (default: 1)
• mu: temporal momentum coefficient (default: 0.4)
• alpha: original gradient weight (default: 0.25)
• noise_variance: Gaussian noise variance for one-hot/embedding spaces (default: 0.0001)

Notes

• Text-space transformations (synonym replacement) from the paper are omitted as they are irrelevant for random-target optimization.
• All spatial gradient samples are computed in a single batched forward+backward pass for efficiency.
• FLOP cost per step: ~27x a single GCG gradient + 512 candidate evaluations.