MoCo-EA: Exploiting Adversarial Mode Connectivity for Efficient Evolutionary Attacks

Binghui Wang; Can Chen; Gang Luo; Hyo Seo Kim; Ren Wang; Yue Duan

REVIEW 1 major objections 2 minor 36 references

MoCo-EA: Exploiting Adversarial Mode Connectivity for Efficient Evolutionary Attacks

T0 review · 1 major / 2 minor · reviewed 2026-05-20 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Adversarial perturbations connect along continuous paths where intermediate points often transfer better than the endpoints themselves.

desk verdict MoCo-EA replaces discrete crossover with Bézier curve optimization in evolutionary attacks by invoking mode connectivity, but the evidence for intermediates staying adversarial without extra optimization remains indirect. read the letter →

arxiv 2605.18919 v1 pith:DDB6YQND submitted 2026-05-18 cs.CR cs.AIcs.LG

Hyo Seo Kim , Gang Luo , Can Chen , Binghui Wang , Yue Duan , Ren Wang This is my paper · ORCID

classification cs.CRcs.AIcs.LG

keywords adversarialattacksevolutionaryalgorithmsmodeconnectivityBéziercurvestransferabilityblack-boxqueryefficiencymanifoldstructure

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper establishes that successful adversarial perturbations lie on connected manifolds rather than as isolated points. It replaces discrete genetic crossover in evolutionary attacks with a Bézier curve operator that searches along the continuous path between parent perturbations. This geometric exploitation yields higher transferability, faster convergence, and fewer queries to the target model. Readers would care because the approach makes black-box attacks more practical while reframing how we think about the structure of adversarial space.

What carries the argument

Bézier crossover operator that optimizes perturbations along a continuous curve between parent perturbations to exploit mode connectivity.

What would settle it

Select pairs of successful adversarial perturbations, compute intermediate points along the Bézier curve connecting them, and measure whether those points show lower attack success or transferability than the endpoints.

Watch

Extended reading notes

Core claim

The paper claims that successful adversarial perturbations exhibit mode connectivity, so intermediate points along optimized continuous paths achieve higher transferability than the endpoint perturbations. By introducing a Bézier crossover operator that optimizes perturbations along a continuous curve between parents instead of discrete interpolation, the evolutionary algorithm exploits this structure to produce stronger attacks with reduced query requirements and quicker convergence.

Load-bearing premise

Adversarial examples lie on connected manifolds where intermediate points maintain and often enhance attack effectiveness.

Editorial extensions

If this is right

Evolutionary attacks converge in fewer generations and require fewer queries to the target model.
The generated adversarial examples transfer more effectively to unseen models.
Adversarial space is better modeled as having manifold structure with useful intermediate points rather than discrete isolated successes.
Defense research can target the connecting paths instead of single perturbation points.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Defenses might improve by sampling or disrupting likely paths between known adversarial examples rather than isolated points.
The connectivity insight could extend to other black-box optimization problems where discrete recombination wastes useful intermediate structure.
Hybrid methods that combine path optimization with limited gradient information may further reduce query budgets on complex models.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

read the letter

The main thing to know is that this paper swaps the usual discrete crossover step in evolutionary adversarial attacks for a Bézier curve operator that searches along a continuous path between two parent perturbations. They tie this to the claim that adversarial examples lie on connected manifolds, so points in between often work better for transferability and efficiency than the endpoints alone. The reported results show faster convergence and fewer queries than standard genetic operations. That is the concrete advance here. What the work does well is to name a real practical problem—discrete interpolation tends to break the adversarial property—and offer a geometric alternative that keeps the search in a smoother space. The three findings listed in the abstract give a coherent story: successful perturbations exhibit connectivity, optimized intermediates transfer better, and the method improves on query count and runtime. This framing challenges the isolated-point picture of adversarial examples in a way that could matter for black-box robustness testing. The soft spot is the direct support for the connectivity assumption itself. The argument needs intermediate points on the raw Bézier curve to remain effective before any auxiliary optimization occurs. The abstract states the outcome but does not describe loss or success-rate measurements along the unoptimized path for t between 0 and 1. If those raw intermediates frequently leave the adversarial region, the gains would trace more to the path-optimization step than to any intrinsic manifold structure. That distinction affects how much weight the geometric claim should carry. This paper is for people who build or evaluate query-efficient adversarial attacks and for those interested in continuous representations of perturbation space. A reader already working with evolutionary methods or mode connectivity ideas would get the most out of it. I would send it for peer review. The efficiency claims are worth checking against stronger baselines, and the idea is simple enough that referees can focus on whether the connectivity evidence holds up under closer inspection.

Referee Report

1 major / 2 minor

Summary. The manuscript introduces MoCo-EA, an evolutionary algorithm for black-box adversarial attacks that replaces discrete crossover with a Bézier curve operator. It claims that successful adversarial perturbations exhibit mode connectivity on connected manifolds, that intermediate points along optimized paths achieve higher transferability than the endpoints, and that the Bézier crossover yields faster convergence and fewer queries than traditional genetic operations.

Significance. If the geometric claims are substantiated, the work reframes adversarial space as having exploitable connectivity rather than isolated points and supplies a practical efficiency gain for gradient-free attacks. This could inform both stronger attack generation and defenses that account for manifold structure.

major comments (1)

[Abstract and §4] Abstract and §4 (Mode Connectivity Experiments): the claim that 'adversarial examples lie on connected manifolds where intermediate points maintain and often enhance attack effectiveness' lacks direct supporting measurements. No loss or attack-success curves are shown for the raw Bézier path (t ∈ (0,1)) prior to auxiliary optimization; without these, it remains possible that reported transferability gains arise from the path-optimization step rather than intrinsic connectivity, weakening the justification for replacing discrete crossover.

minor comments (2)

[§5] The experimental section should include ablation tables that isolate the contribution of the Bézier operator from the rest of the evolutionary loop, with statistical significance reported across runs.
[§3] Notation for the Bézier curve parameterization and the auxiliary optimization objective should be stated explicitly with equations.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We are grateful to the referee for the thorough review and valuable suggestions. The major comment highlights an important aspect of our experimental validation, which we address in detail below. We have prepared revisions to incorporate additional supporting evidence as outlined in our response.

read point-by-point responses

Referee: [Abstract and §4] Abstract and §4 (Mode Connectivity Experiments): the claim that 'adversarial examples lie on connected manifolds where intermediate points maintain and often enhance attack effectiveness' lacks direct supporting measurements. No loss or attack-success curves are shown for the raw Bézier path (t ∈ (0,1)) prior to auxiliary optimization; without these, it remains possible that reported transferability gains arise from the path-optimization step rather than intrinsic connectivity, weakening the justification for replacing discrete crossover.

Authors: We thank the referee for pointing out this potential gap in our presentation of the mode connectivity results. Upon review, we confirm that the experiments in Section 4 primarily report on the performance after optimizing the Bézier curve parameters to find effective paths. To directly substantiate the intrinsic connectivity of adversarial perturbations, we will revise the manuscript to include new experimental results: specifically, attack success rate and loss curves for raw (unoptimized) Bézier interpolations between pairs of parent adversarial examples, for t ranging from 0 to 1. These curves will demonstrate that a significant portion of intermediate points along the raw paths are successful adversarial examples, supporting our claim that the connectivity is a property of the adversarial manifold rather than solely resulting from the auxiliary optimization. This revision will be added to Section 4 and referenced in the abstract if necessary. We believe this will fully address the concern and strengthen the justification for our Bézier crossover approach. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

Derivation self-contained; mode connectivity treated as empirical premise, not derived by construction

full rationale

The paper states its key insight directly as an assumption about adversarial manifolds and then reports experimental outcomes from Bézier path optimization. No equations, fitted parameters, or self-citations are presented in the provided text that would reduce the central claims (mode connectivity, improved transferability of intermediates, or superiority of Bézier crossover) to tautological redefinitions or inputs. The findings are framed as demonstrations rather than predictions forced by prior definitions within the work itself. This matches the default expectation of no significant circularity.

Assumptions & free parameters 0 free parameters · 1 assumptions · 0 invented entities

The central claims rest primarily on the domain assumption of mode connectivity in adversarial space; no free parameters or invented entities are explicitly introduced in the abstract.

assumptions (1)

domain assumption Adversarial examples lie on connected manifolds where intermediate points maintain and often enhance attack effectiveness
Stated directly as the key insight enabling the Bézier crossover replacement for discrete operations.

how reviews work

0 comments

Cite this review

Pith. "Pith review of MoCo-EA: Exploiting Adversarial Mode Connectivity for Efficient Evolutionary Attacks." pith.science (2026). https://pith.science/paper/DDB6YQND

@misc{pith2026260518919,
  author       = {Pith},
  title        = {Pith review of: MoCo-EA: Exploiting Adversarial Mode Connectivity for Efficient Evolutionary Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DDB6YQND}},
  note         = {Machine review of arXiv:2605.18919}
}

read the original abstract

Evolutionary algorithms for adversarial attacks leverage population-based search to discover perturbations without gradient information, but suffer from inefficient crossover operations that destroy adversarial properties through discrete interpolation. We introduce Mode Connectivity Evolutionary Attack (MoCo-EA), which replaces traditional crossover with a novel B\'ezier crossover operator that optimizes perturbations along a continuous B\'ezier curve between parent perturbations. Our key insight is that adversarial examples lie on connected manifolds where intermediate points maintain and often enhance attack effectiveness. We demonstrate three findings: (1) Successful adversarial perturbations exhibit mode connectivity; (2) Intermediate points along optimized paths achieve higher transferability than endpoints; (3) B\'ezier crossover dramatically outperforms discrete genetic operations while reducing convergence time and query requirements. By exploiting the geometric structure of adversarial space through path optimization, MoCo-EA provides an efficient and reliable method. Our work challenges the traditional view of adversarial examples as isolated points and opens new directions for both attack generation and defense research.

Figures

Figures reproduced from arXiv: 2605.18919 by the authors.

**Figure 1.** Overview of MoCo-EA. C&W attacks target different ℓp norms (Carlini & Wagner, 2017), while AutoAttack provides a robust ensemble for evaluation (Croce & Hein, 2020). Stronger transferbased variants incorporate momentum (Dong et al., 2018), input diversity (Xie et al., 2019), and translation invariance (Dong et al., 2019). However, most gradient-based methods operate locally around a single example and do not expl… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 36 canonical work pages

[1]

Alzantot, M., Sharma, Y., Chakraborty, S., Zhang, H., Hsieh, C.-J., and Srivastava, M. B. Genattack: Practical black-box attacks with gradient-free optimization. In Genetic and Evolutionary Computation Conference (GECCO), pp.\ 111--119, 2019

work page 2019
[2]

Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

Athalye, A., Carlini, N., and Wagner, D. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning (ICML), pp.\ 274--283, 2018

work page 2018
[3]

Decision-based adversarial attacks: Reliable attacks against black-box machine learning models

Brendel, W., Rauber, J., and Bethge, M. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In International Conference on Learning Representations (ICLR), 2018

work page 2018
[4]

and Wagner, D

Carlini, N. and Wagner, D. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy (SP), pp.\ 39--57, 2017

work page 2017
[5]

Poba-ga: Perturbation optimized black-box adversarial attacks via genetic algorithm

Chen, J., Su, M., Shen, S., Xiong, H., and Zheng, H. Poba-ga: Perturbation optimized black-box adversarial attacks via genetic algorithm. In Computers & Security, pp.\ 89--106, 2019

work page 2019
[6]

I., and Wainwright, M

Chen, J., Jordan, M. I., and Wainwright, M. J. Hopskipjumpattack: A query-efficient decision-based attack. In IEEE Symposium on Security and Privacy (SP), pp.\ 1277--1294. IEEE, 2020

work page 2020
[7]

Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models

Chen, P.-Y., Zhang, H., Sharma, Y., Yi, J., and Hsieh, C.-J. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM workshop on artificial intelligence and security, pp.\ 15--26, 2017

work page 2017
[8]

C., Roxo, T., Proen c a, H., and Inacio, P

Costa, J. C., Roxo, T., Proen c a, H., and Inacio, P. R. M. How deep learning sees the world: A survey on adversarial attacks & defenses. IEEE Access, 12: 0 61113--61136, 2024

work page 2024

Show all 36 references

[9]

and Hein, M

Croce, F. and Hein, M. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International Conference on Machine Learning (ICML), pp.\ 2206--2216, 2020

2020
[10]

Imagenet: A large-scale hierarchical image database

Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2009

2009
[11]

Boosting adversarial attacks with momentum

Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., and Li, J. Boosting adversarial attacks with momentum. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 9185--9193, 2018

2018
[12]

Evading defenses to transferable adversarial examples by translation-invariant attacks

Dong, Y., Pang, T., Su, H., and Zhu, J. Evading defenses to transferable adversarial examples by translation-invariant attacks. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 4312--4321, 2019

2019
[13]

An image is worth 16x16 words: Transformers for image recognition at scale

Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., and Houlsby, N. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on...

2021
[14]

Essentially no barriers in neural network energy landscape

Draxler, F., Veschgini, K., Salmhofer, M., and Hamprecht, F. Essentially no barriers in neural network energy landscape. In International Conference on Machine Learning (ICML), 2018

2018
[15]

Robustness (python library), 2019

Engstrom, L., Ilyas, A., Salman, H., Santurkar, S., and Tsipras, D. Robustness (python library), 2019. URL https://github.com/MadryLab/robustness

2019
[16]

Freeman, C. D. and Bruna, J. Topology and geometry of half-rectified network optimization. In International Conference on Learning Representations (ICLR), 2017

2017
[17]

P., and Wilson, A

Garipov, T., Izmailov, P., Podoprikhin, D., Vetrov, D. P., and Wilson, A. G. Loss surfaces, mode connectivity, and fast ensembling of dnns. In Advances in Neural Information Processing Systems (NeurIPS), 2018

2018
[18]

J., Shlens, J., and Szegedy, C

Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR), 2015

2015
[19]

Deep residual learning for image recognition

He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 770--778, 2016

2016
[20]

Kingma, D. P. and Ba, J. Adam: A method for stochastic optimization. In International Conference on Learning Representations (ICLR), 2015

2015
[21]

Learning multiple layers of features from tiny images

Krizhevsky, A. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009

2009
[22]

Li, W., Deka, D., Wang, R., and Paternina, M. R. A. Physics-constrained adversarial training for neural networks in stochastic power grids. IEEE Transactions on Artificial Intelligence, 5 0 (3): 0 1121--1131, 2023

2023
[23]

Practical evaluation of adversarial robustness via adaptive auto attack

Liu, Y., Cheng, Y., Gao, L., Liu, X., Zhang, Q., and Song, J. Practical evaluation of adversarial robustness via adaptive auto attack. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 15105--15114, 2022

2022
[24]

Towards deep learning models resistant to adversarial attacks

Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR), 2018

2018
[25]

Boosting the transferability of adversarial attacks with reverse adversarial perturbation

Qin, Z., Fan, Y., Liu, Y., Shen, L., Zhang, Y., Wang, J., and Wu, B. Boosting the transferability of adversarial attacks with reverse adversarial perturbation. In Advances in Neural Information Processing Systems (NeurIPS), pp.\ 29845--29858, 2022

2022
[26]

Revisiting mode connectivity in neural networks with bezier surface

Ren, J., Chen, P.-Y., and Wang, R. Revisiting mode connectivity in neural networks with bezier surface. In The Thirteenth International Conference on Learning Representations, 2025

2025
[27]

and Wang, R

Shi, Y. and Wang, R. Exploring nonlinear pathway in parameter space for machine unlearning. Forty-third International Conference on Machine Learning, 2026

2026
[28]

V., and Sakurai, K

Su, J., Vargas, D. V., and Sakurai, K. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation, 23 0 (5): 0 828--841, 2019

2019
[29]

Input space mode connectivity in deep neural networks

Vrabel, J., Shem-Ur, O., Oz, Y., and Krueger, D. Input space mode connectivity in deep neural networks. In International Conference on Learning Representations (ICLR), 2025

2025
[30]

On fast adversarial robustness adaptation in model-agnostic meta-learning

Wang, R., Xu, K., Liu, S., Chen, P.-Y., Weng, T.-W., Gan, C., and Wang, M. On fast adversarial robustness adaptation in model-agnostic meta-learning. In International Conference on Learning Representations, 2021

2021
[31]

M., Stansbury, C

Wang, R., Chen, T., Lindsly, S. M., Stansbury, C. M., Rehemtulla, A., Rajapakse, I., and Hero, A. O. Rails: A robust adversarial immune-inspired learning system. IEEE Access, 10: 0 22061--22078, 2022 a

2022
[32]

Wang, R., Chen, T., Yao, P., Liu, S., Rajapakse, I., and Hero, A. O. Ask: Adversarial soft k-nearest neighbor attack and defense. IEEE Access, 10: 0 103074--103088, 2022 b

2022
[33]

Exploring diversified adversarial robustness in neural networks via robust mode connectivity

Wang, R., Li, Y., and Liu, S. Exploring diversified adversarial robustness in neural networks via robust mode connectivity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 2346--2352, 2023

2023
[34]

Deep adversarial defense against multilevel-lp attacks

Wang, R., Li, Y., and Hero, A. Deep adversarial defense against multilevel-lp attacks. IEEE International Workshop on Machine Learning for Signal Processing (MLSP), 2024

2024
[35]

Xie, C., Zhang, Z., Zhou, Y., Bai, S., Wang, J., Ren, Z., and Yuille, A. L. Improving transferability of adversarial examples with input diversity. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 2730--2739, 2019

2019
[36]

Optimizing robustness and accuracy in mixture of experts: A dual-model approach

Zhang, X., Xu, K., Hu, Z., and Wang, R. Optimizing robustness and accuracy in mixture of experts: A dual-model approach. In Forty-second International Conference on Machine Learning, 2025

2025

Pith tools

Reviewed May 20, 2026 · model on record in the stance chip above.

[1] [1]

Alzantot, M., Sharma, Y., Chakraborty, S., Zhang, H., Hsieh, C.-J., and Srivastava, M. B. Genattack: Practical black-box attacks with gradient-free optimization. In Genetic and Evolutionary Computation Conference (GECCO), pp.\ 111--119, 2019

work page 2019

[2] [2]

Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

Athalye, A., Carlini, N., and Wagner, D. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning (ICML), pp.\ 274--283, 2018

work page 2018

[3] [3]

Decision-based adversarial attacks: Reliable attacks against black-box machine learning models

Brendel, W., Rauber, J., and Bethge, M. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In International Conference on Learning Representations (ICLR), 2018

work page 2018

[4] [4]

and Wagner, D

Carlini, N. and Wagner, D. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy (SP), pp.\ 39--57, 2017

work page 2017

[5] [5]

Poba-ga: Perturbation optimized black-box adversarial attacks via genetic algorithm

Chen, J., Su, M., Shen, S., Xiong, H., and Zheng, H. Poba-ga: Perturbation optimized black-box adversarial attacks via genetic algorithm. In Computers & Security, pp.\ 89--106, 2019

work page 2019

[6] [6]

I., and Wainwright, M

Chen, J., Jordan, M. I., and Wainwright, M. J. Hopskipjumpattack: A query-efficient decision-based attack. In IEEE Symposium on Security and Privacy (SP), pp.\ 1277--1294. IEEE, 2020

work page 2020

[7] [7]

Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models

Chen, P.-Y., Zhang, H., Sharma, Y., Yi, J., and Hsieh, C.-J. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM workshop on artificial intelligence and security, pp.\ 15--26, 2017

work page 2017

[8] [8]

C., Roxo, T., Proen c a, H., and Inacio, P

Costa, J. C., Roxo, T., Proen c a, H., and Inacio, P. R. M. How deep learning sees the world: A survey on adversarial attacks & defenses. IEEE Access, 12: 0 61113--61136, 2024

work page 2024