Adversarial examples are inputs generated by applying imperceptible perturbations to benign data, which can mislead deep neural networks. They have been widely used to evaluate the safety and robustness of machine learning models. In recent years, momentum-based iterative attack methods have received considerable attention due to their strong transferability in black-box scenarios. However, existing methods typically employ a fixed momentum coefficient, which struggles to balance the need for exploration in the early stage of the attack and convergence in the later stage, thereby limiting further improvements in attack performance. To address this issue, we propose a Dynamic Momentum Decay (DMD) mechanism, which adaptively adjusts the momentum coefficient based on the magnitude of perturbation changes between iterations. The mechanism maintains strong exploration in the early stage while gradually enhancing stability in the later stage, achieving a more effective momentum control strategy. DMD can be seamlessly integrated into various existing momentum-based attack frameworks without introducing additional model structures or computational overhead. Experiments on both naturally trained and adversarially trained models demonstrate that incorporating DMD consistently improves the black-box performance of multiple attack methods, validating its generality and effectiveness.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

DMD: Boosting Adversarial Transferability via Dynamic Momentum Decay

  • Haolang Feng,
  • Yuling Chen,
  • Hui Dou,
  • Rou Zhou,
  • Long Chen

摘要

Adversarial examples are inputs generated by applying imperceptible perturbations to benign data, which can mislead deep neural networks. They have been widely used to evaluate the safety and robustness of machine learning models. In recent years, momentum-based iterative attack methods have received considerable attention due to their strong transferability in black-box scenarios. However, existing methods typically employ a fixed momentum coefficient, which struggles to balance the need for exploration in the early stage of the attack and convergence in the later stage, thereby limiting further improvements in attack performance. To address this issue, we propose a Dynamic Momentum Decay (DMD) mechanism, which adaptively adjusts the momentum coefficient based on the magnitude of perturbation changes between iterations. The mechanism maintains strong exploration in the early stage while gradually enhancing stability in the later stage, achieving a more effective momentum control strategy. DMD can be seamlessly integrated into various existing momentum-based attack frameworks without introducing additional model structures or computational overhead. Experiments on both naturally trained and adversarially trained models demonstrate that incorporating DMD consistently improves the black-box performance of multiple attack methods, validating its generality and effectiveness.