[Paper Review] Boosting Adversarial Transferability through Enhanced Momentum

Xiaosen Wang, Jiadong Lin+3 more|arXiv (Cornell University)|Mar 19, 2021

Adversarial Robustness in Machine LearningComputer Science35 references27 citations

TL;DR

The authors propose EMI-FGSM, an enhanced momentum iterative FGSM that also samples gradients around the current point to improve adversarial transferability, achieving large gains over prior momentum-based methods and strong performance with input transformations and ensemble attacks.

ABSTRACT

Deep learning models are known to be vulnerable to adversarial examples crafted by adding human-imperceptible perturbations on benign images. Many existing adversarial attack methods have achieved great white-box attack performance, but exhibit low transferability when attacking other models. Various momentum iterative gradient-based methods are shown to be effective to improve the adversarial transferability. In what follows, we propose an enhanced momentum iterative gradient-based method to further enhance the adversarial transferability. Specifically, instead of only accumulating the gradient during the iterative process, we additionally accumulate the average gradient of the data points sampled in the gradient direction of the previous iteration so as to stabilize the update direction and escape from poor local maxima. Extensive experiments on the standard ImageNet dataset demonstrate that our method could improve the adversarial transferability of momentum-based methods by a large margin of 11.1% on average. Moreover, by incorporating with various input transformation methods, the adversarial transferability could be further improved significantly. We also attack several extra advanced defense models under the ensemble-model setting, and the enhancements are remarkable with at least 7.8% on average.

Motivation & Objective

• Motivate and address the limited transferability of white-box adversarial attacks against unseen models.
• Develop an enhanced momentum-based attack that aggregates gradients from neighboring samples to stabilize updates.
• Integrate the enhanced momentum with input transformations and ensemble-model strategies to boost transferability.
• Demonstrate effectiveness on ImageNet, including against advanced defense models, and analyze parameter choices.

Proposed method

• Introduce EMI-FGSM, which accumulates the gradient over iterations and also aggregates gradients from N sampled nearby data points in the previous iteration's gradient direction.
• Define bar{x}_t^{adv}[i] = x_t^{adv} + c_i * bar{g}_{t-1} and compute bar{g}_t as the average of gradients at these bar{x}_t^{adv}[i].
• Update the momentum as g_t = mu * g_{t-1} + bar{g}_t / ||bar{g}_t||_1 and apply x_{t+1}^{adv} = x_t^{adv} + alpha * sign(g_t).
• Propose EMI-DTS by combining EMI-FGSM with input transformation ensembles (DIM, TIM, SIM, and their combination DTS).
• Explore sampling strategies (linear, uniform, Gaussian) and ablate parameters such as sampling interval eta and sample count N.

Experimental results

Research questions

• RQ1 How can gradient-based adversarial attacks be made more transferable across models beyond existing momentum-based methods?
• RQ2 Does sampling multiple nearby data points in the gradient direction of the previous iteration improve transferability?
• RQ3 Can EMI-FGSM be effectively integrated with input transformations and ensemble-model attacks to boost black-box performance against defenses?

Key findings

• EMI-FGSM outperforms MI-FGSM and NI-FGSM in both white-box and black-box settings, with average transferability gains around 11.1% over NI-FGSM.
• EMI-FGSM combined with input transformations (DIM, TIM, SIM) and ensemble-model attacks yields substantial transferability gains, including high white-box and black-box performance.
• EMI-DTS achieves an average attack success rate of 86.6% against seven advanced defense models under ensemble-model setting, improving prior methods by 7.8%.
• Compared to PI-FGSM, EMI-FGSM provides noticeably higher transferability by 10.5–12.5% on normally trained models and 4.4–5.4% on adversarially trained models.
• Ablation studies show linear sampling performs slightly best; typical settings include N=11 samples and eta=7.