Scholarlink

<p>Deep neural networks are vulnerable to adversarial attacks, where carefully inputs can lead to misclassification. Black-box attacks, in which the attacker has limited knowledge of the target model, are particularly challenging. This paper introduces WinA-FGSM, a novel black-box adversarial attack method based on the Win-AdamW optimizer. WinA-FGM leverages an adaptive algorithm with acceleration mechanism, incorporating Nesterov’s momentum and second-order moment estimation. This enables the attack to accumulate historical gradient information, enhancing transferability across different models. Extensive experiments on ImageNet demonstrate that WinA-FGM achieves significantly higher black-box success rates compared to existing gradient-based attacks. When combined with data augmentation techniques, WinA-FGM achieves impressive success rates of 89.9%, 60.9%, 84.7% on Convolutional networks, Transformer-based models and Lightweight models, respectively. When attack under ensemble model setting, the success rate of our method is 88.3%, 60.2%, 81.9%, respectively.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Enhancing the black-box transferability with Win-AdamW

  • 期刊论文

  • 发表日期：

    2025年7月18日

查看全文
  • Leiji Lu,
  • Hongxia Yu,
  • Jun Chen,
  • Lei Bao

摘要

Deep neural networks are vulnerable to adversarial attacks, where carefully inputs can lead to misclassification. Black-box attacks, in which the attacker has limited knowledge of the target model, are particularly challenging. This paper introduces WinA-FGSM, a novel black-box adversarial attack method based on the Win-AdamW optimizer. WinA-FGM leverages an adaptive algorithm with acceleration mechanism, incorporating Nesterov’s momentum and second-order moment estimation. This enables the attack to accumulate historical gradient information, enhancing transferability across different models. Extensive experiments on ImageNet demonstrate that WinA-FGM achieves significantly higher black-box success rates compared to existing gradient-based attacks. When combined with data augmentation techniques, WinA-FGM achieves impressive success rates of 89.9%, 60.9%, 84.7% on Convolutional networks, Transformer-based models and Lightweight models, respectively. When attack under ensemble model setting, the success rate of our method is 88.3%, 60.2%, 81.9%, respectively.