Boosting Adversarial Attacks with Momentum

1. Introduction

• Adversarial examples are small, human-imperceptible perturbations that can induce inaccurate predictions and support robustness assessment before deployment.They also provide varied training data for DNN algorithms [5, 10].Source: §1 · p. 1
• Black-box attacks are difficult because existing methods trade off white-box attack strength against transferability, while query-based alternatives require impractical access and queries.This motivates attacks that work without knowing the target model’s architecture or parameters and without querying it.Source: §1 · p. 2
• Momentum iterative methods accumulate loss gradients across iterations to stabilize update directions and escape poor local maxima.The method is designed to improve adversarial-example success rates in both white-box and black-box settings.Source: §1 · p. 2
• Momentum-based attacks outperform one-step and vanilla iterative methods in black-box attacks while retaining near-100% white-box success.MI-FGSM achieves more than twice I-FGSM’s success rates in most black-box attack cases.Source: §1 · p. 2
• Ensemble attacks fuse information from multiple models to improve transferability, making adversarial examples more likely to fool other black-box models.The paper studies ensemble approaches because examples that fool multiple models are more likely to transfer [12].Source: §1 · p. 2
• The paper reports that ensemble-adversarially trained models with strong defenses remain vulnerable to its black-box attacks.This finding raises security concerns and motivates using the attacks to benchmark model and defense robustness.Source: §1 · p. 2

2. Backgrounds

• An adversarial example stays within an allowed Lp perturbation bound but causes a classifier to misclassify an input or output a specified target label.Non-targeted attacks require f(x*) ≠ y, whereas targeted attacks require f(x*) = y* with y* ≠ y.Source: §2 · p. 2

2.1. Attack methods

• FGSM applies one gradient-sign step under an L∞ constraint, while FGM generalizes the approach to an L2 constraint.Both methods use the gradient of the loss with respect to the input.Source: §2.1 · p. 2
• Iterative methods repeatedly apply fast gradient updates with a small step size, producing stronger white-box attacks but typically worse transferability.The perturbation can be clipped into the ε-neighborhood or use α = ε/T over T iterations [10].Source: §2.1 · p. 3
• Optimization-based methods directly optimize distance and misclassification, but they lack a guarantee that the perturbation satisfies the required L∞ or L2 bound and have poor black-box efficacy.Box-constrained L-BFGS is one example of this class [23].Source: §2.1 · p. 3

2.2. Defense methods

• Adversarial training injects adversarial examples into training to improve robustness, while ensemble adversarial training adds samples generated by held-out models.The ensemble variant is described as robust against one-step and black-box attacks.Source: §2.2 · p. 3

3. Methodology

• The methodology’s core algorithm iteratively updates an adversarial example under an L∞ constraint using perturbation size ϵ, iteration count T, and decay factor µ.The algorithm initializes the accumulated gradient to zero and returns the final iterate after T updates.Source: §3 · p. 3

3.1. Momentum iterative fast gradient sign method

• Momentum accumulates normalized gradients across iterations to stabilize update directions, escape poor local maxima, and retain attack strength while improving transferability.MI-FGSM reduces to iterative FGSM when the decay factor µ is 0; each update uses the sign of the accumulated gradient with step size α.Source: §3.1 · pp. 3–4
• The method addresses iterative FGSM’s tendency to overfit a source model by preserving transferability as iterations increase while remaining a strong white-box attack.FGSM can underfit when distortion is large, whereas iterative FGSM can overfit and become less transferable.Source: §3.1 · pp. 3–4

3.2. Attacking ensemble of models

• Ensemble attacks combine multiple models because examples adversarial to several models are more likely to transfer to other black-box models.The paper compares fusion in logits, predictions, and loss, with the ensemble weights constrained to be nonnegative and sum to one.Source: §3.2 · p. 4
• Ensemble-in-logits fuses model logits before computing softmax cross-entropy loss, aggregating detailed outputs to expose shared vulnerabilities.Logits are the inputs to softmax, and the resulting loss drives the momentum iterative update.Source: §3.2 · p. 4

3.3. Extensions

• The momentum framework generalizes to L2-bounded and targeted attacks by replacing the current gradient with the accumulated gradient from previous steps.For L2 attacks, α = ϵ/T; targeted attacks minimize the loss for the chosen target class.Source: §3.3 · pp. 4–5

4.2. Attacking a single model

• MI-FGSM maintains near-100% white-box success and achieves more than twice I-FGSM’s success rates in most black-box cases.Source: §4.2 · p. 5

4.2.1 Decay factor µ

• At µ = 1.0, MI-FGSM reaches the maximum black-box success rate in the tested decay-factor sweep.The sweep attacks Inc-v3 with ϵ = 16 and 10 iterations while varying µ from 0.0 to 2.0.Source: §4.2.1 · p. 6, Figure 2 · p. 6

4.2.2 The number of iterations

• As iterations increase, I-FGSM’s black-box success declines whereas MI-FGSM remains high, alleviating the white-box-versus-transferability trade-off.Source: §4.2.2 · p. 6, Figure 3 · p. 6

4.2.3 Update directions

• MI-FGSM produces more stable update directions than I-FGSM, reflected by higher cosine similarity between successive perturbations.The authors attribute improved transferability to escaping exceptional decision regions associated with poor local maxima.Source: §4.2.3 · p. 6, Figure 4 · p. 6

4.2.4 The size of perturbation

• For black-box attacks, MI-FGSM’s success rate grows faster with perturbation size, allowing a smaller perturbation for a required success rate.Source: §4.2.4 · p. 7, Figure 5 · p. 7

4.3.1 Comparison of ensemble methods

• Ensemble-in-logits consistently outperforms ensemble-in-predictions and ensemble-in-loss across tested white-box and black-box attacks.Source: §4.3.1 · p. 7, Table 2 · p. 7
• MI-FGSM attacking an ensemble of Inc-v4, IncRes-v2, and Res-152 fools hold-out Inc-v3 with an 87.9% success rate.The result demonstrates high transferability against normally trained models.Source: §4.3.1 · p. 7

4.3.2 Attacking adversarially trained models

• Ensemble momentum attacks fool the adversarially trained Inc-v3ens4 model with more than 40% of adversarial examples in the black-box setting.Source: §4.3.2 · p. 8, Table 3 · p. 8

• The paper treats adversarial-example generation as training on models and adversarial-example transferability as generalization to other models.Source: §5 · p. 8

6. Conclusion

• Momentum-based iterative methods effectively fool both white-box and black-box models.Source: §6 · p. 8
• Ensemble attacks using fused logits improve transferability and can fool models trained with ensemble adversarial training.Source: §6 · p. 8

Appendix

• Supplementary experiments consistently demonstrate the effectiveness of momentum-based methods for L2-bounded non-targeted and targeted attacks.Source: Appendix · p. 10

A. Non-targeted attacks based on L2 norm bound

• L2 distance measures the Euclidean separation between an adversarial example and its corresponding real example.Source: A. Non-targeted attacks based on L2… · p. 10
• The distance measure depends on the input dimension N.Source: A. Non-targeted attacks based on L2… · p. 10
• Table 4 reports non-targeted L2-bounded attack success rates against an ensemble of white-box models and a hold-out black-box target.Source: Table 4 · p. 10

A.1. Attacking a single model

• The experiment evaluates FGM, I-FGM, and MI-FGM across seven networks, using 10 iterations for the iterative methods and decay factor 1.0 for MI-FGM.Source: §A.1 · p. 10
• MI-FGM achieves a near 100% success rate on white-box models, matching I-FGM.Source: §A.1 · p. 10
• MI-FGM significantly outperforms FGM and I-FGM in black-box attacks.Source: §A.1 · p. 10

A.2. Attacking an ensemble of models

• The experiment attacks an ensemble of six models while holding one model out as the black-box target, using equal ensemble weights.Source: §A.2 · p. 10
• MI-FGM fools adversarially trained models with about 60% success rates in black-box attacks.Source: §A.2 · p. 10
• MI-FGM achieves much higher black-box success than the other tested methods, indicating good transferability.Source: §A.2 · p. 10
• Iterative methods achieve near 100% success on the ensemble of white-box models.Source: §A.2 · p. 10

B.1. L∞norm bound

• MI-FGSM achieves success rates close to 100% on white-box models and above 10% on normally trained black-box models, whereas FGSM can hardly attack either ensemble.The evaluation uses targeted success rate, defined as the percentage of adversarial examples classified as the target label.Source: §B.1 · p. 10, Table 6 · p. 11
• Targeted adversarial examples are generated for an ensemble of six models while one model is held out as the black-box target.The table reports success rates against both the white-box ensemble and the hold-out black-box model.Source: §B.1 · p. 10, Table 6 · p. 11
• MI-FGSM cannot effectively generate targeted adversarial examples against adversarially trained models, leaving this an open issue for future research.Source: §B.1 · p. 11

B.2. L2 norm bound

• The L2-norm experiments use Inc-v3, Inc-v4, IncRes-v2, Res-152, Inc-v3ens3, Inc-v3ens4, and IncRes-v2ens models.One model is held out while the other six are attacked as an equally weighted ensemble using FGM, I-FGM, or MI-FGM.Source: §B.2 · p. 11
• The L2-norm evaluation uses 20 iterations for I-FGM and MI-FGM and a decay factor of 1.0 for MI-FGM.Source: §B.2 · p. 11
• MI-FGM easily fools the white-box ensemble but cannot effectively fool adversarially trained models in targeted black-box attacks.The success rates are reported for both the white-box ensemble and the hold-out black-box target model.Source: Table 7 · p. 11, §B.2 · p. 12