Gradient descent attack on PDF: no subtractions allowed (I'm not sure I am on the correct site, if not do not hesitate to move this question.)
I'm currently reading the following paper:  Evasion Attacks Against Machine Learning
at Test Time and I'm not sure to understand how they apply their gradient descent on the PDF files.
But first, a bit of context. 
The aim is to detect malicious PDF files by the objects contained by the file (the objects are retrieved via PDFid). The features are the number of occurrences of an object in the file. They are fed to an SVM, and classification is done.
An attacker might forge adversarial files by operating a gradient descent on a malicious file, adding objects to the file until it is classified as benign.

Now, in our context, the authors clearly state that no object should be removed :

In our feature representation, this is equivalent to allowing only feature increments, i.e., requiring $\mathbf{x}^0 \leq \mathbf{x}$ as an additional constraint in the optimization problem given by Eq. 2.

where the Eq. 2 is given on page 6.
Then, the algorithm is as follow:
do
    dF = a unit vector aligned with the gradient
    x^m = x^{m-1} - step_size * dF

    if dist(x^m, x^0) > dist_max then
        project x^m onto the feasible region 
    endif

until the difference between two consecutive dF is low enough

return x^m

But how do I adapt it to forbid object removal?
When - step_size * dF has negative parts, it implies that elements should be removed. If I just discard negative components of - step_size * dF by setting them to 0, I am at risk of infinite loop (when all components are negative).
 A: This algorithm is called 'projected gradient descent'. It's a way of solving optimization problems with constraints. It works by performing a gradient descent step, then projecting the current point onto the feasible region, which is the region of parameter space where the constraints are satisfied. The projection is performed by finding the point in the feasible region that's closest to the current point.
The constraint given in equation 3 is $d(x, x^0) \le d_{max}$ (i.e. the distance between the new point and the initial point must not exceed $d_{max}$). The feasible region is a ball centered at $x_0$ with radius $d_{max}$, where the type of ball depends on the distance metric used (e.g. $\ell_2$ ball/hypersphere for Euclidean distance, $\ell_1$ ball for Manhattan distance, etc.).
They then give an additional constraint, that no elements be removed: $x \ge x_0$. The feasible region is the intersection of half-spaces; each element of the new point much be greater than or equal to the corresponding element of the original point.
This additional constraint is incorporated into the optimization algorithm by modifying the feasible region. The new feasible region is the intersection of the feasible regions for each of the individual constraints, so any point in this region satisfies all constraints. You would have to modify your projection step to work for the new feasible region, and modify your if statement (which checks whether the current point is in the feasible region).
