Research map / Adversarial robustness and security / Black-box and transfer attacks
On the Convergence of an Adaptive Momentum Method for Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AdaMSI-FGM, an adversarial attack that replaces sign operations with adaptive (second-moment) step sizes and uses a gradient-based adaptive heavy-ball momentum without monotonicity, with a data-dependent O(sqrt T) regret bound for convex functions.
Problem
Sign-based adversarial attacks (FGSM, MI-FGSM, PGD) lack convergence guarantees: momentum theory requires monotonic schedules that differ from practice, and sign-based methods can fail to converge to the optimum in convex settings.
Approach
Combine a heavy-ball momentum whose coefficient is adaptively computed from consecutive gradient L1 norms (no monotonicity assumption) with an AdaGrad-style adaptive step size that replaces the sign function, yielding a convergent attack with a data-dependent regret bound.
Key results
- On eight torchvision models, AdaMSI-FGM achieves 2% to 17.8% higher black-box attack success rates than PGD and AutoAttack (e.g., ResNet34 source to VGG target 58.2% vs 43.8% for PGD).
- Against adversarially trained Inc-v3ens3 from Inc-v3 source, AdaMSI-FGM reaches 13.2% vs 12.8% for MI-FGSM and 16.4% vs 11.0% from IncRes-v2 source to IncRes-v2ens.
- Combining DI with AdaMSI-FGM (DI+Ours) substantially raises transfer ASR, e.g., ResNet34 to VGG from 53.8% (DI) to 62.8%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace PGD with AdaMSI-FGM | ResNet34-source transfer attack · ImageNet validation, ResNet→EfficientNet | ASR (%): 36.6 -> 51.2 | Helped |
| Replace MI-FGSM with AdaMSI-FGM | Inception v3-source attack · ImageNet validation, transfer to Inc-v3ens3 | ASR (%): 13.7 -> 15.1 | Helped |
| Combine DI-FGSM with AdaMSI-FGM | ResNet34-source transfer attack · ImageNet validation, ResNet→EfficientNet | ASR (%): 44.2 -> 57.8 | Helped |
| Replace sign-based BIM with AdaMSI-FGM | ResNet34 attack optimization · ImageNet validation, loss versus iterations | loss | Helped |
Surprising findings
- On Inc-v3 source against IncRes-v2 target, the proposed method is lower than MI-FGSM (53.1% vs 59.2%), showing it does not uniformly dominate baselines.
Limitations
- Experiments use only 500 ImageNet images and a single RTX 3060 GPU, with a small set of source/target models.
- Convergence guarantee is for convex settings and the non-convex deep network setting is not theoretically covered.
- Momentum hyperparameter lambda and step-size choices are set empirically, with lambda=0.6 chosen without a full sensitivity study.
Experimental setup
Datasets: ImageNet (ILSVRC 2012 validation subset, 500 images)
Benchmarks: ImageNet
Metrics: attack success rate
Baselines: PGD AutoAttack MI-FGSM NI-FGSM BIM DI-FGSM
Builds on: MI-FGSM Adam Heavy-Ball method NI-FGSM DI-FGSM
Closest papers by meaning
- Boosting Adversarial Attacks With Momentum (CVPR 2018 · similarity 0.91)
- The Power of Decaying Steps: Enhancing Attack Stability and Transferability for Sign-based Optimizers (CVPR 2026 · similarity 0.88)
- Adversarial Initialization with Universal Adversarial Perturbation: A New Approach to Fast Adversarial Training (AAAI 2024 · similarity 0.86)
- SignSGD with Federated Defense: Harnessing Adversarial Attacks through Gradient Sign Decoding (ICML 2024 · similarity 0.85)
- Parameter-free Algorithms for the Stochastically Extended Adversarial Model (NeurIPS 2025 · similarity 0.85)
- LRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogate (AAAI 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.