[Paper Review] Discovering Adversarial Examples with Momentum

Yinpeng Dong, Fangzhou Liao+3 more|arXiv (Cornell University)|Oct 17, 2017

Adversarial Robustness in Machine Learning17 references63 citations

TL;DR

This paper proposes momentum-based iterative adversarial attack methods that stabilize gradient updates and escape local maxima, significantly improving transferability and success rates in black-box attacks. The approach achieves state-of-the-art performance, winning first place in both NIPS 2017 non-targeted and targeted adversarial attack competitions.

ABSTRACT

Deep neural networks are vulnerable to adversarial examples, which poses security concerns on these algorithms due to the potentially severe consequences. Adversarial attacks serve as an important surrogate to evaluate the robustness of deep learning models before they are deployed. However, most of existing adversarial attacks can only fool a black-box model with a low success rate. To address this issue, we propose a broad class of momentum-based iterative algorithms to boost adversarial attacks. By integrating the momentum term into the iterative process for attacks, our methods can stabilize update directions and escape from poor local maxima during the iterations, resulting in more transferable adversarial examples. To further improve the success rates for black-box attacks, we apply momentum iterative algorithms to an ensemble of models, and show that the adversarially trained models with a strong defense ability are also vulnerable to our black-box attacks. We hope that the proposed methods will serve as a benchmark for evaluating the robustness of various deep models and defense methods. With this method, we won the first places in NIPS 2017 Non-targeted Adversarial Attack and Targeted Adversarial Attack competitions.

Motivation & Objective

• To address the low success rate of existing adversarial attacks on black-box models.
• To improve the transferability of adversarial examples across different models.
• To develop a robust benchmark for evaluating deep learning model robustness.
• To demonstrate that even adversarially trained models remain vulnerable to the proposed attacks.

Proposed method

• Integrates a momentum term into the iterative adversarial attack process to stabilize and smooth gradient updates.
• Uses a running average of past gradients with momentum to guide the perturbation direction and avoid local maxima.
• Applies the momentum-based attack to an ensemble of models to enhance transferability in black-box settings.
• Employs iterative optimization with momentum to generate adversarial examples that generalize across diverse architectures.
• Leverages the momentum term to improve convergence and robustness during the attack process.
• Combines the momentum method with ensemble-based attacks to maximize transfer success across unknown models.

Experimental results

Research questions

• RQ1 Can momentum improve the success rate of adversarial attacks in black-box settings?
• RQ2 Does the momentum-based iterative method enhance the transferability of adversarial examples?
• RQ3 Are adversarially trained models still vulnerable to momentum-based attacks?
• RQ4 Can ensemble-based momentum attacks outperform single-model attacks in transferability?
• RQ5 How does the momentum method compare to existing iterative attack methods in terms of robustness and transferability?

Key findings

• The momentum-based attack method significantly increases the success rate of black-box adversarial attacks compared to non-momentum baselines.
• The method achieves state-of-the-art performance, winning first place in both the NIPS 2017 non-targeted and targeted adversarial attack competitions.
• Adversarial examples generated with the momentum method exhibit higher transferability across diverse models.
• Even models trained with strong adversarial defense mechanisms remain vulnerable to the proposed momentum-based attacks.
• The integration of momentum stabilizes the attack trajectory and reduces oscillations, leading to more reliable and consistent perturbations.
• Ensemble-based momentum attacks further improve transfer success, demonstrating the method's effectiveness in real-world black-box scenarios.