RECORD
Enhancing Transferability of Adversarial Examples with Spatial Momentum
Computer Vision and Pattern Recognition · Submitted 25 Mar 2022
abstract compiled · 2026-09-23 · no language-model review
The authors' main claim Extensive experiments show that our method indeed further enhances adversarial transferability.
The compiled record
The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.
Open the compiled record
The abstract, sentence by sentence
Many adversarial attack methods achieve satisfactory attack success rates under the white-box setting, but they usually show poor transferability when attacking other DNN models. Momentum-based attack is one effective method to improve transferability. It integrates the momentum term into the iterative process, which can stabilize the update directions by adding the gradients' temporal correlation for each pixel. We argue that only this temporal momentum is not enough, the gradients from the spatial domain within an image, i.e. gradients from the context pixels centered on the target pixel are also important to the stabilization. For that, we propose a novel method named Spatial Momentum Iterative FGSM attack (SMI-FGSM), which introduces the mechanism of momentum accumulation from temporal domain to spatial domain by considering the context information from different regions within the image. SMI-FGSM is then integrated with temporal momentum to simultaneously stabilize the gradients' update direction from both the temporal and spatial domains. Extensive experiments show that our method indeed further enhances adversarial transferability. It achieves the best transferability success rate for multiple mainstream undefended and defended models, which outperforms the state-of-the-art attack methods by a large margin of 10\% on average.
background contribution method result interpretation main claim
| # | sentence | role | the authors' own work | states the main conclusion | strength |
|---|---|---|---|---|---|
| s0 | Many adversarial attack methods achieve satisfactory attack success rates under the white-box setting, but they usually show poor transferability when attacking other DNN models. | background 0.91 | 0.06 | 0.03 | asserted 0.98 |
| s1 | Momentum-based attack is one effective method to improve transferability. | background 1.00 | 0.05 | 0.05 | asserted 1.00 |
| s2 | It integrates the momentum term into the iterative process, which can stabilize the update directions by adding the gradients' temporal correlation for each pixel. | background 0.95 | 0.07 | 0.03 | asserted 0.99 |
| s3 | We argue that only this temporal momentum is not enough, the gradients from the spatial domain within an image, i.e. gradients from the context pixels centered on the target pixel are also important to the stabilization. | gap 0.97 | 0.27 | 0.19 | asserted 0.76 |
| s4 | For that, we propose a novel method named Spatial Momentum Iterative FGSM attack (SMI-FGSM), which introduces the mechanism of momentum accumulation from temporal domain to spatial domain by considering the context information from different regions within the image. | contribution 0.74 | 0.87 | 0.11 | asserted 0.99 |
| s5 | SMI-FGSM is then integrated with temporal momentum to simultaneously stabilize the gradients' update direction from both the temporal and spatial domains. | method 0.93 | 0.74 | 0.09 | asserted 0.99 |
| s6 | Extensive experiments show that our method indeed further enhances adversarial transferability. | result 0.99 | 0.95 | 0.60 | asserted 1.00 |
| s7 | It achieves the best transferability success rate for multiple mainstream undefended and defended models, which outperforms the state-of-the-art attack methods by a large margin of 10\% on average. | result 1.00 | 0.94 | 0.58 | asserted 1.00 |
What was examined, and what was not
- arXiv listing abstract v2
- full text
- figures and tables
- references and citing sentences
- relations to other papers
- P abstract
- S sections
- T body sentences
- C citations
- R cross-paper relations
The paper
Original abstract
Many adversarial attack methods achieve satisfactory attack success rates under the white-box setting, but they usually show poor transferability when attacking other DNN models. Momentum-based attack is one effective method to improve transferability. It integrates the momentum term into the iterative process, which can stabilize the update directions by adding the gradients' temporal correlation for each pixel. We argue that only this temporal momentum is not enough, the gradients from the spatial domain within an image, i.e. gradients from the context pixels centered on the target pixel are also important to the stabilization. For that, we propose a novel method named Spatial Momentum Iterative FGSM attack (SMI-FGSM), which introduces the mechanism of momentum accumulation from temporal domain to spatial domain by considering the context information from different regions within the image. SMI-FGSM is then integrated with temporal momentum to simultaneously stabilize the gradients' update direction from both the temporal and spatial domains. Extensive experiments show that our method indeed further enhances adversarial transferability. It achieves the best transferability success rate for multiple mainstream undefended and defended models, which outperforms the state-of-the-art attack methods by a large margin of 10\% on average.
Human review
How the literature uses it
What this paper does with the arXiv papers it cites
What it cites · 6 sentences without a confident label
Uses the method or tool of 1 paper
-
In addition, three input transformation based defense strategies, including FD [ref] , BIT [ref] , and NRP [ref] , are used to purify adversarial images.
Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks · Experimental Settings · 0.92
Cites as background 6 papers
-
Among the above methods to improve transferability, the momentum-based iterative attack (MI-FGSM) [ref] shows good performance and has many variants [ref] .
Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks · Introduction · 0.83
-
Recently, A series of methods have been proposed to address this issue, such as momentum-based iterative attack [ref] , variance tuning iterative gradient-based method [ref] , diverse inputs [ref] , translation-invariant [ref] , and multi-model ensemble attack [ref] .
Delving into Transferable Adversarial Examples and Black-box Attacks · Introduction · 0.85
-
In the past years, many methods have been proposed to generate adversarial examples, such as fast gradient sign method [ref] and its iterative variant [ref] , projected gradient descent method [ref] , and so on.
Towards Deep Learning Models Resistant to Adversarial Attacks · Introduction · 0.92
Discussion
Know something about this paper? Leave a comment, or highlight any passage above to comment on it.