Boosting Adversarial Attacks with Momentum
Yinpeng Dong1, Fangzhou Liao1, Tianyu Pang1, Hang Su1, Jun Zhu1, Xiaolin Hu1, Jianguo Li2
1Department of Computer Science and Technology, Tsinghua University, 2Intel Labs China

Motivation

q Adversarial attacks:o Identify the robustness of deep learning models.
o Provide more varied training data (i.e., adversarial training).

Perturbations

q Attacking a single model

1. FGSM: more transferable adversarial examples; low success rates for the white-box
models. (Reason: linear assumption may not hold for large distortion; “underfit”the model.)Inc-v3

2. I-FGSM: high success rates for white-box models; poor transferability. (Reason:drop into poor local maxima; “overfit” the model.)Inc-v4100

The Success rates when attacking
Inc-v3, Inc-v4, IncRes-v2 and Res152 by I-FGSM with different
number of iterations. The adversarial
examples are generated for Inc-v3.

IncRes-v2

Inc-v3 vs. I-FGSM
Inc-v4 vs. I-FGSM
IncRes-v2 vs. I-FGSM
Res-152 vs. I-FGSM

Adversarial Images
80

Success Rate (%)

Real Images

q The trade-off between the attack ability and transferability

Res-1526040

123456

78910

Number of Iterations

Alps: 94.39%

Dog: 99.99%

Inc-v3Inc-v4

IncRes-v2

Res-152

Inc-v3ens3

Inc-v3ens4

IncRes-v2ens

FGSM
I-FGSM
MI-FGSMFGSM
I-FGSM
MI-FGSMFGSM
I-FGSM
MI-FGSMFGSM
I-FGSM
MI-FGSM

72.3⇤

28.2
22.8
48.8
61.0⇤
99.9⇤
99.9⇤
28.1
20.8
62.1
28.2
22.7
48.9

26.2
19.9
48.0
26.6
24.7
54.9
55.3⇤
99.6⇤
99.5⇤
27.5
21.2
44.7

25.3
16.2
35.6
27.2
19.3
46.3
25.8
22.8
50.6
72.9⇤
98.6⇤
98.5⇤11.3
7.5
15.1
13.7
7.8
19.8
13.1
8.9
26.1
14.6
9.3
22.1

10.9
6.4
15.2
11.9
6.8
17.4
12.1
7.8
20.9
13.2
8.9
21.7

4.8
4.1
7.8
6.2
4.9
9.6
7.5
5.8
15.7
7.5
6.2
12.9

100.0⇤
100.0⇤
32.7
35.8
65.6
32.6
37.8
69.8
35.0
26.7
53.6

Inc-v3 vs. MI-FGSM
Inc-v3 vs. I-FGSM
Inc-v4 vs. MI-FGSM
Inc-v4 vs. I-FGSM
IncRes-v2 vs. MI-FGSM
IncRes-v2 vs. I-FGSM
Res-152 vs. MI-FGSM
Res-152 vs. I-FGSM

and the targeted80MI-FGM with an L2 norm bound is

200AttackTableq
1. Thesuccess rates studies(%) of non-targeted adversarial attacks against seven models we study. The adversarial examples are crafted forAblation
Inc-v3, Inc-v4, IncRes-v2
and Res-152 respectively using FGSM, I-FGSM andMI-FGSM. ⇤ indicates the white-box attacks.
100
100Success Rate (%)

q Adversarial examples are crafted by adding small, human-imperceptible
noises to legitimate examples, but make a model output attacker-desired
inaccurate predictions.

Experimentsx⇤t+1 = x⇤t60↵·gt+1.
kgt+1 k2(13)40Therefore, we introduce
a broad class of momentum iterative methods for attacks in various settings, whose effec20
tiveness is demonstrated in Sec. 4.

q Optimization with Momentum (Polyak, 1964)

Inc-v3 vs. MI-FGSM
Res-152 vs. MI-FGSM
Inc-v3 vs. I-FGSM
Res-152 vs. I-FGSM
Inc-v3 vs. FGSM
Res-152 vs. FGSM

90

results
80 based on L1 norm bound for non-targeted attacks,
and 70leave the results based on L2 norm bound and targetedattacks
in the supplementary material. The findings in this60paper
50 are general across different attack settings.
Success Rate (%)

Introduction

40

4.2.30Attacking a single model

20 report in Table 1 the success rates of attacks against
We10the models
we consider. The adversarial examples are gen00
erated 1 for4 Inc-v3,
Inc-v4,respec4
5
6
78910
7 10 13
16 19 InvRes-v2
22 25 28 31and34 Res-152
37 40
4. Experiments 1 2 3 Numberof Iterations
The size of perturbation 0
tively using FGSM, iterative FGSM (I-FGSM) and MIInq
thisAttackingsection, we conduct
extensive experimentsonFGSM attack methods. The success rates are the misclassian ensembleof models
the ImageNet dataset [19] to validate the effectiveness offication rates of the corresponding models with adversarial
the proposed methods. We first specify the experimenimages asI-FGSM
inputs. The maximum perturbation
FGSM
MI-FGSM ✏ is set to 16
Ensemblemethodtal settings in Sec. 4.1.
Then
we report
theresultsforall experiments,
pixel value in[0, 255]. TheEnsemble
Hold-out amongEnsemble
Hold-out withEnsemble
Hold-out
attacking a single model Logitsin Sec. 4.2 and 55.7
an ensemble 45.7
ofnumberand MI-FGSM,
and
99.7of iterations
72.1is 10 for I-FGSM
99.6
87.9
q Momentum Iterative Fast Gradient Sign Method (MI-FGSM)
models in-Inc-v3
Sec. 4.3. Our
methods won 52.3
both the NIPS
the decayis 1.0, which willin Sec. 4.2.1.
Predictions
42.7
95.1 factor µ 62.7
97.1 be studied
83.3
2017
Non-targeted
andTargeted∗∗∗∗
Loss Adversarial
50.5Attack com42.2
93.8
63.1
97.0
81.9
From the table, we can observe that MI-FGSM remains
𝑥= = 𝑥, 𝑥>?@ = clip(𝑥> + α ⋅ sign 𝛻& 𝐽 𝑥> , 𝑦 )Logits introduced56.1
99.8 white-box
61.0adversary 99.5
petitions, with the configurationsin Sec. 4.4. 39.9
as a strong
like I-FGSM 81.2
since it can at-Inc-v4
Predictions
50.9
36.5
95.5
52.4
97.1
77.4
tack a white-box model with a near 100% success rate. On
Momentum
Loss
49.3
36.2
93.9
50.2
96.1
72.5
4.1. Setup
the other hand, it can be seen that I-FGSM reduces the sucLogits
57.2
38.8
99.5
54.4
99.5
76.5
cessrates
forblack-box
attacks
thanone-step
FGSM. ButWe
study
sevenmodels,fourofwhich
arenormally-IncRes-v2
Predictions
52.1
35.8
97.1
46.9
98.0
73.9𝑥=∗ = 𝑥, 𝑔= = 0
by integrating
momentum,
our MI-FGSM
outperforms
bothtrained models—InceptionLoss
v3 (Inc-v3) [22],v450.7Inception 35.2
96.2
45.9
97.4
70.8
∗
𝛻& 𝐽 𝑥> , 𝑦
FGSM
It
53.5 Resnet v235.9
99.6and I-FGSM
43.5in black-box
99.6 attacks significantly.
69.6(Inc-v4), Inception ResnetLogits
v2 (IncRes-v2) [21],𝑔>?@ = 𝜇 ⋅ 𝑔> +-Res-152
Predictions
51.9 are trained
34.6
99.9more than 41.0
obtains
2 times of the99.8
success rates67.0
than I-FGSM
152 (Res-152)[7] and theother three of which
𝛻& 𝐽 𝑥>∗ , 𝑦 @Loss50.4, Inc-v3 34.1
98.2black-box 40.1
98.8
65.2
in mostattack cases, demonstrating
the effectiveby ensemble adversarial training—Inc-v3
ens3
ens4 ,∗∗
𝑥>?@ = clip(𝑥> + 𝛼 ⋅ sign 𝑔>?@ )ness ensembleof the proposed
algorithm.
twoforadversarial
Table IncRes-v2
2. The successrates
non-targeted
attacks of threemethods.
We reportWe
theshow
results
an ensemble ofWe(%)
willofsimply
call theadversarial
last three models
ens [24].
in Fig. 1 generated
for Inc-v3.
white-box
models and atrained
hold-out
black-box
targetambiguity.
model. We study fourimages
models—Inc-v3,Inc-v4, IncRes-v2
and Res-152. In each row, “-”
as “adversariallymodels”
without
where 𝑔> gathers the gradients of the first t iterations.
It should bethat althoughmethodgreatlyby
im-FGSM,indicates It
theis nameof the hold-out
model
the adversarial
examples are generated
fornotedthe ensembleof the ourotherthree models
less meaningful
to study
theandsuccessrates of attacks
qWe
proposeabroadclassof
momentum-based
iterative
methodsforq Attacking an ensemble of models
proves theothersuccess
rates for black-box attacks, it is still inefI-FGSM
andmodels
MI-FGSM
respectively.
Ensemble
logits correctly.
consistently outperformmethods.
if thecannot
classify theoriginalinimage
fective forattacking adversarially trained models (e.g., less
Therefore,generating
we randomly choose
images belonging
tomore1000
transferable
adversarial
examples.
o The adversarial examples generated for multiple models are more transferable
100than16%Infor
IncRes-v2) inattack
the black-box
manner.
Laterwith athe 1000 categories from the ILSVRCInc-v3
2012validation set,vs. MI-FGSM
faster.
otherwords,ensto
a black-box
model
Res-152
vs.
MI-FGSMqWe
proposetoattackanensembleofmodels
whoselogits
arefused.
90
weshow thatensemble-based
approaches
improve(Liu et al., 2017).
which
are all correctly classified by them.
Inc-v3 vs. I-FGSM
required
successrate, MI-FGSM
can usegreatly
a smallerperturbaRes-152
vs. I-FGSM to onethe results in Sec. 4.3. Next, we study several aspects ofmethods
80In our experiments, we compare ourInc-v3 vs. FGSM
tion, which
is more visually indistinguishable for humans.
o We propose to attack multiple models whose logits are fused together andq
Ourmethodwon
thefirstin
bothoftheRes-152
vs. FGSMplaces
MI-FGSMthatare different from vanilla iterative methods,
step
gradient-basedmethodsanditerativemethods.
Since70
then use MI-FGSM to attack the ensemble model.
to further andexplain why it performs well in practice.
optimization-based
methods
cannot explicitly
control theNIPS 2017
Non-target
Adversarial
Attack60
4.3.
Attackingan ensemble of modelsO
distance between the adversarial examples and the corre4.2.1
Decayfactorµ50Targeted
Attackcompetitions.
𝑙 𝑥 = L 𝑤N 𝑙N (𝑥)sponding
real examples,Adversarial
they are not directlycomparable
toIn this section, we show the experimental results of atNP@
40 but they have similar properties with iterative methours,The
decay factor µ plays a key role for improving the sucq Code available at:tacking an ensemble of models. We first compare the three
30 as discussed in Sec. 2.1. For clarity, we only report theods
cess rates of attacks. If µ = 0, momentum-based iterativeq Extension: MI-FGSM can be extended to targeted attacks and Lo Accelerate gradient descento Escape from poor local minima and maxima
o Stabilize update directions of stochastic gradient descent

Methodology

Crab: 100.00%

q Generating adversarial examples:o Constrained optimization problem:
argmax 𝐽 𝑥 ∗ , 𝑦𝑠. 𝑡. 𝑥 ∗ − 𝑥 1 ≤ 𝜖&∗o Fast gradient sign method (FGSM, Goodfellow et al., 2015):𝑥 ∗ = 𝑥 + 𝜖 ⋅ sign(𝛻& 𝐽(𝑥, 𝑦))o Iterative fast gradient sign method (I-FGSM, Kurakin et al., 2016):∗𝑥=∗ = 𝑥, 𝑥>?@= clip(𝑥>∗ + α ⋅ sign 𝛻& 𝐽 𝑥>∗ , 𝑦 )o Optimization-based method (Carlini and Wagner, 2017):
argmin 𝜆 ⋅ 𝑑 𝑥 ∗ , 𝑥 − 𝐽(𝑥 ∗ , 𝑦)&∗q Transferabilityo The adversarial examples generated for one model can also fool anothermodel (Liu et al., 2017).
o Black-box attacks: how to generate more efficient adversarial examples for ablack-box model (challenge).

Conclusion

Success Rate (%)

Puffer: 97.99%

norm bound attacks

20100RESEARCH POSTER PRESENTATION DESIGN © 2015

www.PosterPresentations.com

ensemble methods introduced in Sec. 3.2, and then demonstrate that the adversarially trained models are vulnerable toour black-box attacks.

2147101316

19222528

The size of perturbation 031343740

4.3.1

Comparison of ensemble methods