Improving the Transferability of Adversarial Attacks through Experienced Precise Nesterov Momentum
Authors: Hao Wu
Jinwei Wang
Jiawei Zhang
Bin Ma
Xiangyang Luo
wang yu
Venue: Submitted to ICLR 2023 (2023)
Keywords: adversarial attacks
transferability
black-box
momentum

Abstract: Deep Neural Networks are vulnerable to adversarial attacks, which makes adversarial attacks serve as a method to evaluate the robustness of DNNs. However, adversarial attacks have high white-box attack success rates but poor transferability, making black-box attacks impracticable in the real world. Momentum-based attacks were proposed to accelerate optimization to improve transferability. Nevertheless, conventional momentum-based attacks accelerate optimization inefficiently during early iterations since the initial value of momentum is zero, which leads to unsatisfactory transferability. Therefore, we propose Experienced Momentum (EM), which is the pre-trained momentum. Initializing the momentum to EM can help accelerate optimization during the early iterations. Moreover, the pre-update of conventional Nesterov momentum based attacks is rough, prompting us to propose Precise Nesterov momentum (PN). PN refines the pre-update by considering the gradient of the current data point. Finally, we integrate EM with PN as Experienced Precise Nesterov momentum (EPN) to further improve transferability. Extensive experiments against normally trained and defense models demonstrate that our EPN is more effective than conventional momentum in the improvement of transferability. Specifically, the attack success rates of our EPN-based attacks are $\sim$11.9% and $\sim$13.1% higher than conventional momentum-based attacks on average against normally trained and defense models, respectively.

Under review as a conference paper at ICLR 2023
IMPROVING THE TRANSFERABILITY OF ADVERSARIAL ATTACKS THROUGH EXPERIENCED PRECISE NESTEROV MOMENTUM
Anonymous authors Paper under double-blind review
ABSTRACT
Deep Neural Networks are vulnerable to adversarial attacks, which makes adver- sarial attacks serve as method to evaluate the robustness of DNNs. However, adversarial attacks have high white-box attack success rates but poor transfer- ability, making black-box attacks impracticable in the real world. Momentum- based attacks were proposed to accelerate optimization to improve transferabil- ity. Nevertheless, conventional momentum-basee based attacks accelerate optimization inefficiently during early iterations since the initial value of momentum is zero, which leads unsatisfactory transferability. Therefore, we propose Experienced Momentum (EM), which is the pre-trained momentum. Initializing the momen- EM can help accelerate optimization during the early iterations. More- over, the pre-update of conventional Nesterov momentum based attacks is rough, prompting us propose Precise Nesterov momentum (PN). PN refines the pre- update by considering the gradient of the current data point. Finally, we inte- grate EM with PN as Experienced Precise Nesterov momentum (EPN) to further improve transferability. Extensive experiments against normally trained and de- fense models demonstrate that our EPN is more effective than conventional mo- mentum in the improvement of transferability. Specifically, the attack success rates of our EPN-based attacks are ~ 1.9% and 13..11 % higher than conventional momentum baased attacks average against normally trained and defense mod- els, respectively.
INTRODUCTION
Deep neural networks (DNNs) Krizhevsky et al. 2012: Szegedy et al. 2015 He et al. 2016 lofle
& Szegedy 2013) have been widely applied in computer vision, e.g., autonomous driving (Franchi al. 2022 Hao al. 2019 Cococcioni al. 2018), facial recognition (Chrysos al. 2020 Ghenescu et al. 2018). and medical image analysis (Akselrod-Ballin et al. |016]] Ding et al. 2017
Liu 2019). However, (Sregedy al. (2013) found that applying certain imperceptible perturba- tions to images can make DNNs misclassify, and they refer to such perturbed images as adversarial examples (AEs). Adversarial examples pose a huge threat the security of DNNs, which attaches extensive attention from researchers.
Adversarial attacks can be categorized into white-box attacks and black-box attacks. Typically, iter- ative gradient- based (Kurakin et al. 2016 Madry et al. 2017) and optimization- based attacks (Car- lini & Wagner 2017) have high white-box but low black-box attack success rates, which means that such two attacks are impracticable in the real world. Transferabilityy which means adversarial examples crafted on the source model remain effective on other models, makes black-box attacks feasible. Furthermore, iterative gradient-based attacks have the ad advantages of low computational cost and fast generation speed, thus improving the transferability of iterative gradient- baseed attacks has become hotspot in the field of adversarial attacks.
Many methods have been proposed to improve the transferability of iterative gradient-basee based at- tacks. These methods can be classified into three branches: improving optimization algorithms, input transformations, and disrupting feature space. For example, MI-FGSM (Dong et al.) 2018), NI-FGSM (Lin al. 2019), and VM(N)I-FGSM (Wang & He. 2021) improve gradient ascent (or

---

Under review as a conference paper at ICLR 2023
Traephoe-1
Larg::
XI-FOSM
Figure 1: Comparison of conventional Polyak momentum and experienced Polyak momentum. Ad- versarial examples are crafted on the source model (Inception-v3) and used to attack the target model (VGG16). Our Experienced MI-FGSM (EMI-FGSM) which integrates EM into MI-FGSM, causes misclassification with higher loss and confidence than MI-FGSM, thus EMI-FGSM can mislead the attention of the target model better than MI-FGSM.
descent) algorithm to escape from saddle points and poor local extrema to improve transferabil- ity: DIM (Xie et al., 2019). TIM (Dong et al.) 2019), and SIM (Lin al.) 2019) craft adversarial examples set of models derived by input transformations transferability; NRDM (Naseer et al. 2018). FDA (aaneshan et al. 2019), and FIA (Wang et al. 2021 disrupt deep features of DNNs to craft highly transferable adversarial examples.
prevent overfitting and improve
Those mentioned above adversarial attacks mostly adopt the momentum (Polyak) 1964 Nesterov 1983) to accelerate optimization. However, such momentum based adversarial attacks (e.g., M(N)I- FGSM, VM(N)I-FGSM, and FIA) have the problem of initializing the momentum to zero, resulting in inefficient acceleration due momentum accumulating few gradients during the first few itera- tions. Therefore, we propose Experienced Momentum (EM), which is the pre-trained momentum. Before the iterations. the momentum is initialized EM instead of zero, leading to better acceler- ation in the first few iterations. The comparison of conventional Polyak momentum (Polyak 1964) and experienced Polyak momentum shown in Fig. [ To prevent overfitting on the source model, we train EM on set of models derived by Random Channels Swapping (RCS). EM and RCS are detailed Sec.
Furthermore, adversarial attacks (e.g., NI-FGSM and VNI-FGSM) based on Nesterov momentum (i.e., Nesterov Accelerated Gradient, NAG (Nesterov) 1983)) have the disadvantage that the pre- update is rough. Specifically, during each iteration, the parameters are first pre-updated along the momentum to obtain the pre-update point, which is an estimation of the next position. Then the pre- update is modified by the gradient of the pre-update point. Such looking-ahead property of Nesterov momentum makes parameters escape from saddle points and poor local extrema easier and faster, resulting in improving transferability. However, pre-updating only along the momentum is rough, and the estimation of the next position of the parameters is imprecise. Therefore, we propose Precise Nesterov momentum (PN), which not only retains the looking-ahead property but also refines the pre-update by adopting the gradient of the current data point. To improve transferability further, we integrate EM with PN Experienced Precise Nesterov momentum (EPN), PN and EPN are detailed in Sec. 3.2
Overall, we make the following contributions:
We propose Experienced Momentum (EM), which is trained set of models derived by Random Channels Swapping (RCS). Initializing the momentum to EM can accelerate optimization effectively during the early iterations to improve transferability.
2

---

Under review as a conference paper at ICLR 2023
We propose Precise Nesterov momentum (PN), which adopts the gradient of the current data point to refine the pre-update to escape from saddle points and poor local extrema eas- ier and faster. We also integrate EM with PN as Experienced Precise Nesterov momentum (EPN) to improve transferability further.
Extensive experiments normally trained and defense models demonstrate that our EPN is more effective than conventional momentum for improving transferability.
RELATED WORK
2.1 TRANSFERABLE ADVERSARIAL ATTACKS
Since adversarial examples were discovered by SSegedy et al. (2013), many methods (Goodfellow al. 2014 Kurakin et al. 2016; Carlini Wagner 2017) have been proposed craft adversarial examples to demonstrate the vulnerability of DNNs. We focus on the transferability of iterative gradient-based attacks and review related works from three branches: improving optimization algo- rithms, input transformations, and disrupting feature space.
Improving optimization algorithms. Dong al. (2018) integrated Polyak momentum (Polyak) 1964) into I-FGSM (Kurakin et al. (016) to accelerate gradient ascent (or descent) to improve transferability. Inspired by the fact that Nesterov momentum (Nesterov) 1983 is superior to Polyak momentum, Lin et al. (2019) integrated Nesterov momentum into I-FGSM to improve transferability further. Wang & He (2021) used the gradient variance of the previous iteration to tune the current gradient to stabilize the update direction and escape from saddle points and poor local extrema.
Input transformations. The nature of input transformations is crafting adversarial examples on a set of derived models to prevent overfitting. Xie et al. (2019) performed random resizing and padding with probability to derive models. Dong et al. (2019) convolved the gradient to approximate translating input. Lin et al. 2019) scaled the input with the scale factor 1/2* derive set of models.
Disrupting feature space. Naseer et al. (2018) created maximum distortions in the feature space to craft adversarial examples, based on the intuition that features DNNs are highly generalizable. Ganeshan et al. al.) (2019) highly corrupted deep features by disrupting features each layer of DNNs to improve transferability. WWang et al. (202T) described feature importance with the aggregate gradient and disrupted important object-aware features achieve stronger transferability.
2.2
ADVERSARIAL TRAINING
Adversarial training common defense measure can validate transferability further. Adversarial training increases robustness by adding adversarial examples to the training data. Goodfellow al. (014) showed that adversarially trained models are more robust. However, Kurakin et al. (2016) pointed out that adversarial training is not robust iterative attacks. Moreover, Joreooer,,Tramrr Tramèr et al. (011))
showed that adversarially trained models are still vulnerable to simple white-box and black-box at- tacks. Therefore, they proposed ensemble adversarial training adding adversarial examples crafted from other models to the training data.
3 METHODOLOGY
Given a target model f((:: 0'), where is an input, and 6' the parameters of f', Let J(: y) be loss function, where is the ground-truth label of the input A non-targeted adversarial example adde satisfies ['(x;; 0') * ('(xadv; 0') under the constraint denotes the LP norm, and p generally 0. 2, oc. In this paper, focus on p Note that our methods can be generalized to t = 0, 1, casily. Crafting non-targeted adversarial examples can be described as solving the following optimization problem:
||æ-de æ=I, e, where
arg max J( :0'), y), s.1. adv
a: S.
(1)
In this paper, focus non targeted attacks. Our proposed methods can be easily transformed into targeted attacks by replacing the above objective function with Jf 0'), y.y" )) where y denotes the target label.
3

---

Under review as a conference paper at ICLR 2023
Pre-perturb
Derived Model
Gradient Accumulator
Model
X
Gradicnt
Backpropagation
Figure Illustration of training EM during each iteration.
Many gradient-basee methods have been proposed to solve Eq. 1 e.g., FGSM (Goodfellow et al. 2014). I-FGSM (Kurakin et al., 2016), and PGD (Madry et al. 2017). However, the parameters 0' of the target model f is inaccessible for black-box attacks, resulting in the inability to solve Eq. directly. Therefore, the target model f" is usually replaced with model (i.e., the source model) with accessible parameters 0, and then adversarial examples are crafted on the source model f to attack the target model f'. To achieve effeettive black-box attacks, adversarial examples crafted on the source model f are required to have high transferability. Therefore, we propose Experienced Momentum (EM, detailed in Sec. 3.T and Precise Nesterov momentum (PN, detailed in Sec. (.2) to improve transferability. EM and PN can be naturally combined Experienced Precise Nesterov
momentum (EPN, detailed in Sec. 3.2 to further improve transferability.
3.1 EXPERIENCED MOMENTUM
Momentum-basse attacks initialize momentum to zero, resulting in inefficient acceleration during the first few iterations. Therefore, we propose Experienced Momentum (EM), which is the pre- trained momentum. Setting the initial momentum EM can accelerate the optimization during the early iterations. To prevent overfitting of EM and improve transferability further, we train EM on set of models derived by Random Channels Swapping (RCS). RCS derives models by randomly swapping the channels of the input image, which is equivalent to randomly swapping the "block" dimensions of the original model, leading to various decision boundaries of derived models. There- fore, training EM on derived models can prevent overfitting. The specific procedure for training EM as follows.
First of all, we perform RCS on the input image Specifically, we denote the input image as an RGB triplet (R, G, B), and then the input image x through RCS can be denoted as S(x), where S(x) E {(R, G, B), (R, B, G), (G, R, B), (G, B, Rt,, (B, R, G), (B, G, R)}. S(.) denotes RCS. Secondly, S(x) is fed into the source model f to derive f(S(-), ()).).)). y). Thirdly, we pre-perturb the input image on the derived model f(S(-), y) by iterative gradient-based attacks prevent overfitting. As shown in Fig. 2 we accumulate gradients to training EM during each iteration. Fi- nally, we follow the above procedure repeatedly make the EM more generalizable. After training EM, we set the initial value of momentum to EM to accelerate the early iterations.
3.2 PRECISE NESTEROV MOMENTUM
Nesterov momentum based Attack (e.g., NI-FGSM (Lin al. 2019 and VNI-FGSM (Wang & He 202T)) only pre-update along the momentum roughly, resulting in the imprecision of the pre-update point that the estimate of the next iterative position. Against this disadvantage, we propose Precise Nesterov momentum (PN), which considers the gradient of the current data point in the pre-update to make the pre-update precise. Specifically, during each iteration, the pre-update is performed along the gradient of the current data point and momentum successively to obtain the pre-update point, and then we use the gradient of the pre-update point to modify the pre-up, We integrate PN into I-FGSM PNI-FGSM. The t-th iteration of PNI-FGSM can be formalized as follows:
andv (z (0)
modd xg +a.
updv (f v] + p. 9:-1
(2)
4

---

Under review as a conference paper at ICLR 2023
Algorithm 1:
Experienced Precise Nesterov momentum I-FGSM (EPNI-FGSMI
Input source model with parameters and loss function J. An original image with ground-truth label
Input : The maximum perturbation 6, the number of iterations T, and the decay factor μr
Input : The epochs of pretraining epocks.
Output: An adversarial example æadv.
s/r; ge t O:
for n - 1 to epochs do
11 < x: :
for 1 +- 1 to T do
dedv - zgdv +
spdo (o )0)),, + gezp
Vapdo (f(aa 0).1
np + V (T((S( )00 8
Vadd (((pp)))))))))))))
dtfl + Clip(nne) { (2ndo + sign(g
end end
2dde f- n: 90 g-g "
11 for t 4- to do
Update Ie and atf1 by Eq. 13 end
12
4
14 return adv t- addo
Table 1: The abbreviations used in the paper.
Abbreviation
Explanation
D(T)I-MI-FGS
the combination of D(T)IM and MI-FGSM
SI-NI-FGSM
the combination of SIM and NI-FGSM
D(T,S) EPNI-FGSM
the combination of D(T,S)IM and EPNI-FGSM
VT-M(N) F-SM
i... VM(NII-FGSM
VT-EPNI- FGSM
the combination of Variance Tuning (VT) Wang & He 2021 and EPNI-FGSM
FI-MI-FGSM
ie.. FIA
FL-EPNI-FOSM
the combination of Feature Importance-uware (FI) Wang
2021 and EPNI-FGSM
a [ff nod 0),
aadv J ( ;0).
gt
IV adv J( (xxad .0, p. 14-1--1
(3)
V me [f ()
ands
L+t Clip( {agdu +a sign(g:))
where Jt denotes the momentum, go = 0. and μ denotes the decay factor.
We combine EM and PN as Experienced Precise Nesterov momentum (EPN) to further improve transferability. The algorithm of EPNI-FGSM, which integrates EPN into I-FGSM, summarized
agga J(f(aad) ().))
Algorithm Partieularly, if
EPNI-FGSM degrades Experienced
IV agddu ( M)ll
aaga (f(S(())"))))) ()0),)
MI-FGSM (EMI-FGSM). If NI-FGSM (ENI-FGSM). If epochs = O, EPNI-FGSM degrades to PNI-FGSM.
0, EPNI-FGSM degrades to Experienced
1V addo (S (0)
4 EXPERIMENTS
We conduct extensive experiments normally trained and defense models to validate that EPN is more efficient than conventional momentum. We first present the experimental settings in Sec.
Then, report the results for attacking normally trained and defense models in Sec. 4.2 and
5

---

Under review as a conference paper at ICLR 2023
Table 2: The attack success rates (%) of adversarial examples crafted on source models against normally trained target models. "*" indicates the model being white-box attacked. "Avg" means the average attack success rate.
Modcb
Attoda
1v3
R101
R152
1201
Aag.
MIFGSM
51.5
108.1
49.5
62.5
44.0
65.4
45.4
19.5
70-9
52.1
54.4
53.9
52.3
45.2
-1.3
18.5
16.5
48-1
NLROSM
64.3
109.0"
59.5
53.0
53.0
49.7
52.7
45.4
45.8
60.5
02.6
63.6
62.9
51.9
43.3
45.4
48.4
$1.8
ERNEFGSM (Dars)
79.7
100.0"
74.9
08.7
63.9
65.5
67.6
59.9
69.4
70.5
73.8
74.3
72.3
68.3
65.7
63.6
64.5
78.3
PGSM
70.5
62.0
56.7
65.1
TIMI- FGSM
41.8
00.2
37.9
31.5
46.4
47.6
44.9
41.9
39.6
54.9
56.7
56.2
58.3
47.9
45.5
43.5
41.3
4R.2
S1 HUNEFOGR FGSS
714
101
72.7
02.8
67.5
67.3
58.0
61.5
62.1
70L0
72.8
73.8
71.9
70.7
65.4
64.3
65.9
706
IN3
EPNI FGSM (Ours)
68.7
100.0*
96.0
78.5
91.3
$3.4
99.5
$3.8
$4.3
96.1
94.9
$1.9
83.4
S1- SHIINI--EMM OOroo
98.2
103.1"
85.1
88.1
81.3
74.2
$0.6
84.4
$2.6
81.5
50.9
$1.7
81.5
VT MI POSM
70.5
108.1"
05.7
66.9
63.7
63.6
06.1
00.0
55.6
65.0
05.2
66.7
66.7
05.8
03.8
65.0
03.6
67.1
VIHEPNT- FTSSM (Chen)
109.1"
79.8
K0.0
FI NE PGSSE
55.5
52.17
85.4
$1.8
79.4
3011
10.5
76.3
74.5
$1.0
82.7
K2.7
83.3
$1.3
75.8
71.3
71.8
$1.4
EPNT FOSM (Ours)
90.0
$1.9
90.4
79.6
76.5
15.5
83.5
$1.7
MI-RGSM
45.4
65.0
45.4
09.67
450
39.2
41.3
33.9
32.7
40.9
53.2
51.4
506
39.6
35.3
35.0
32.0
45.2
NE- NEFSSMM
00.0
65.6
-5.5
100.1"
40.A
16.7
45.1
31.9
11.9
15.5
54.3
51.
11.3
17.8
17.8
71.8
11.3
45.1
FINT-ITESM (Dars)
68.1
65.3
65.4
199J1*
55.2
53.8
$5.5
41.9
63.8
00.8
06.6
65.3
54.7
56.7
49.9
48.1
68.5
MI POSM
63.2
60.3
96
54.2
50.
55.7
51.0
59.3
64.7
57.0
53.8
51.5
53.6
59.5
MI PGSM
41.5
60.5
42.0
17. 0P
47.1
47.6
47.3
43.9
43.8
15.9
56.7
55.5
$3.9
45.3
45.3
46.9
41.9
$3.5
FOSM
14.7
61.7
75.1
59 31
05.4
65.9
59.7
05.4
64.7
68.9
71.6
71.8
15.0
72.1
65.7
67.3
68.0
73.0
IRY2
33.2
71.1
FOSN-EEIMMOOO (Ours)
98.9
93.1
95.6
100.0*
79.1
81.3
85.5
79.6
82.9
$3.3
65.5
96.0
$6.1
96.3
83.6
$1.5
$4.5
85.8
VI-MII-GGM
61.2
06.5
51.8
57.
5611
51A
54.
51.1
61.
64.4
64.0
99.8
55.4
54:2
35.1
61.5
VEEESNI-FISM (Ourr)
$1.0
82.1
83.1
100.0*
71.7
72.4
15.4
70.
17.3
90.4
79.9
75.3
71.3
734
11.9
71.9
79.5
TE PI-S--GG
16.1
76
67.
60.0
19.7
06.3
61.5
22.4
71.2
714
70.7
68:3
63.0
71.5
MI RORM
68.5
51.4
53.5
09.6
$1.0
53.
95.1
94.5
196.0
72.7
74.1
72.5
12.5
96.5
$3.0
$2.5
$4.0
71.1
NEFOSM
25.7
66.1
58.0
51.7
$6.0
50.7
96.7
06.9
198.8"
76.1
71.4
72.0
76.2
$1.4
85.1
$5.5
35.7
$0.4
EPNI-FOSM (Oues)
91.5
98.8
79.2
948
96.2
96.7
100.9"
$8.7
89.5
$9.6
96.5
96.5
97.6
96.7
91.0
DEMB--FOSM
$1.5
32.9
75.5
72.1
91.5
918
45.0
96.5
106.0"
$4.0
54.1
85.5
$4.6
90.7
940
41.7
94.1
$5.5
TE-MIIKSM
57.4
51.5
50.1
41.4
700
75.0
81.5
108.0
65.4
63.0
64.1
64.0
75.1
71.5
7007
6k.1
61.
SL SUNI-FORM
45.1
71.2
09.5
59.6
920
05.5
01.5
188.8"
82.1
81.0
51.9
$1.9
93.6
01.3
01.
PGSM (Oers)
80.3
75.2
91.4
05.5
100.0
51.7
89.2
55.7
ST EPNI FCSM (Ours)
05.3
91.4
85.2
56.
96.7
97.6
96.6
19.0
106.0
96.3
91.2
92.2
$0.5
95.0
95.2
93.1
95.2
94.7
VT FOSM
03.5
109.8"
13.6
84.4
NI
03.7
93.5
54.
VT SEEPPT-POR PPSM- (Oaes)
95.4
92.1
89.7
96.9
97.9
98.3
99.5
99.8
196.9
93.6
93.5
98.7
94.4
99.4
95.7
99.4
95.8
96.9
FL PU-I-FOSM PLEEPNT-RR
93.3
38.6
85.1
93.5
91.5
93.9
93.0
95.0
MI ROSM
76,0
29.2
63.8
43.8
800
733
75.0
63.7
55.7
94.7
93.3
99.81
99.2
71.0
69.5
65.3
64.9
71.4
FOSM
78.5
61.6
09.5
47.5
81.3
76.1
75.0
67.0
02.4
56.8
05.2
09.90
591
75.1
72.1
05.4
66.0
76.4
(Oees)
93.5
30.3
91.5
10.0
90.0
77.6
99.0
196.
100.0
91.3
87.3
65.8
87.0
SE FGSM
$1.4
75.6
27.5
59.5
$1.5
$3.9
16.2
73.8
69.7
95.3
93.5
190.0
99.4
35.0
81.5
75.2
77.5
$3.8
ML PGSM
00.5
51.1
48.5
33.4
21.2
65.4
50.3
53.5
45.4
15.1
12.9
19.2
$1.4
64.9
55.0
54.3
53.4
64.6
POSM
99.8
$1.8
$1.9
EPNI FGSM (Oars)
50.6
9539
94.1
85.5
196.-
100.0
TH-UPSE-172M (Dur))
$7.5
25.6
55.1
56.4
$4.2
K2.7
75.9
755
05.8
05.2
198.1-
85.7
73.5
71.4
$1.0
SS-IPIICCMM (Qurs))
06.1
39.1
01.5
$01
41.6
91.2
92.5
16.4
54.5
09-4
198.0
198.1"
100LD
95.6
91.6
41.0
91.2
91.3
VIENI FOSM
05.8
76.9
656
91.1
K7.5
60.3
81.1
76.1
99.9
59.4
85.4
67.5
11.9
VTRIIN--IISM (Oher)
05.6
105.
91.4
$1.1
96.1
94.4
96.0
99.4
80.8
99.4
99.9
99.9P
09.0
95.6
03.7
43.3
91.2
91.8
FOSM
96.7
95.9
198.0
Sec. 4.3 respectively. Finally, we provide ablation studies in Sec. abbreviations used in the paper.
4.4 Table 0
introduces the
4.1 EXPERIMENTAL SETTINGS
Dataset. We follow the previous works (Dong et al. 2019: Wang et al. from the NIPS17 Adversarial Attacks and Defenses Competition. This dataset contains 1000 images with size 299 x 299.
2021 to use the DEV dataset
Target Models. Seventeen normally trained models, i.e., GoogLeNet (Iv1) (Szegedy et al. 2015).
Inception-v3 (Iv3) (Szegedy et al. 2016)), Inception-v4 (Iv4), Inception-ResNet-22 (IRv2) (Szegedy et al. 2017). R8 (R18), ResNet-34 (R34), ResNet-50 (R50), Res (R101), ResNet- 152 (R (2)) (He et al. 2016). VGGI1 (V11), VGG13 (V13), VGG16 (V16), VGG19 (V19) (Si-)
monyan & Zisserman 2014). DenseNet- 121 (D121), DenseNet-169 (D169), DenseNet-201 (D201),
and 1en (D161) (Huang et al.) 2017). Ten defense models (i.e., adversarially trained models), i.e., Add-Inception--ae (Iv3adv). ). Ens- Seae--ncettioon-eeee Resnet-v2 (IRv2ens) Tramer et al. (017)).
Adv-EfficientNeet-b0 (EbO,nv) to Adv- div-EfficientNet-b77 (Eb7
Baselines. For fair comparison of our EPN and conventional momentum, we replace conventional
momentum with EPN in momentum-based attacks, i.e., MI-FGSM (Dong et al.] 2018). NI-
6

---

Under review as a conference paper at ICLR 2023
Table 3: The attack success rates (%) of adversarial examples crafted on source models against defense models. "Avg" means the average attack success rate.
Models
1r3
IRv2.za
Ebil.t
Eb2
Eb
EbS,.v
Eb6,tc
Eb7,ac
Avg
MI-RGIM
25.4
11.5
20.7
26.5
28.1
18.8
16.9
17.5
14.8
15.2
20.4
NLPGSM
25.4
11.6
34.1
31.0
31.2
22.2
18.6
18.6
16.0
16.5
22.5
EPNE-OOSM (Ours)
32.4
14.3
49.0
45.0
45.4
31.1
23.9
25.7
22.4
22.3
31.2
DI-MI-FGSSM
33.0
19.3
46.6
42.9
42.4
31.3
27.4
26.7
22.9
24.4
31.7
TI-MI-PGSM
29.9
21.5
35.2
32.6
34.9
27.88
29:3
28.2
24.5
26.6
29.1
SI-NI-PGSM
37.4
23.2
Iv3
DI-EPNI-PGSM (Ours)
41.5
25.2
65.0
65.5
64.7
45.3
39.1
41.6
36.7
35.6
46.0
TLEPPI-FGSM (Ours)
54.1
41.2
60.7
58.2
$7.0
16.6
46,7
45.3
43.4
44,2
49.7
SI-EPNI-POSSE (Ours)
47.4
28.4
66.3
64.7
63.1
46.7
41.8
42.1
37.9
37.3
47.6
VE-I-FOSM FGSM
36.8
25.1
46.3
29.4
VT-NI-FGSM
39.1
26.4
54.0
50.6
49.5
36.6
31.0
32.7
30.3
28.5
37.9
VT-EPNI-FOSSE (Ours)
43.1
26.5
63.2
618
60.6
46.9
41.1
39.7
38.2
36.8
45.8
FI-M FGSM
55.3
38.0
68.2
67.8
64.9
53.6
50.0
19.3
46.6
45.1
53.9
F1-EPNI-PGSM (Ours)
39.9
73.3
55.6
MI-FGSM
27.3
15.5
25.2
22.8
24.3
17.0
13.8
14.6
12.1
13.2
18.6
NI-RISM
25.9
14.9
24.8
23.1
23.6
17.8
14.1
14.9
12.8
13.7
18.6
XPNI-RGSM (Ours)
33.5
15.9
36.3
32.4
34.9
20.7
20.4
17.6
25.3
33.1
34.7
38.1
35.8
37.9
27.1
23.2
22.0
20.88
28.7
TI-MI-FGSS
38.1
32.2
39.0
36.7
39.4
30.2
33.8
31.4
29.2
29.7
34.0
SI MI-N--GSM
37.0
33.0
50.8
48.2
46.9
35.7
32.0
78.7
26.9
27.5
36.7
DI-EPNI-FGSM
29.7
40.1
TI-EPN--FSMM (Ours)
58.3
52,9
60.5
58.3
56.6
49.7
50.9
47.0
48.0
46.5
52.9
SPEE EEEE----SMM (Ours)
45.6
41.5
68.9
64.3
66.8
50.2
42.6
43.5
39.7
40.1
50.3
VI-MI-FGSM
38.8
36.4
42.3
38.9
41.2
31.2
28.4
26.4
25.4
25.4
33.4
VEENI-FGMM
10.5
11.1
26.6
VT-EPNI-FGSM (Ours)
48.2
36.6
$9.5
55.3
54.1
43.0
38.8
38.0
36.9
35.3
44.6
FGSM-
54.5
40.1
57.4
56.7
56.3
45.7
40.9
39.7
38.2
37.4
46.7
FI-EPNI FGSM (Ours)
53.3
47.1
39.6
56.8
$7.9
47.0
43.3
42.1
40.6
38.6
48.6
FLFG
36.5
27.8
43.6
47.3
26.5
NLPGSM
40.1
29.4
49.8
47.3
47.8
33.2
29.1
23.77
25.2
25.4
35.5
EPNI-GGMM FGSM (Ours)
$3.1
43.1
71.9
68.1
70.5
50.2
41.0
41.0
37.5
40.2
$1.7
DI-MI-FGSM
$7.6
51.7
72.6
68.3
71.2
54.7
47.1
44.7
44.2
44.3
55.6
TI-MI-FGSM
46
41.1
50.7
46.4
50.1
41
43.2
41.0
36.2
38.7
43.6
SI M-NI-PGSM
$1.7
43.4
62.8
$7.3
61.2
43.4
39.3
36.0
35.4
33.8
46.4
R152
DI-EPNI-FCEE (Ours)
78.3
73.1
91.6
89.9
90.6
75.7
67.3
64.9
62.6
64.3
75.8
T1-HPNI-HISM (Ours)
72.2
67.4
66.3
SI-EPNI-FOSM (Ours)
67.5
59.3
79.4
78.5
81.1
61.8
53.7
51.5
48.8
50.3
63.2
VT-MI-FOSS
59.1
52.6
69.6
61.9
69.3
55.1
48.8
16.1
43.6
11.6
55.4
VIENI-FGSM
61.6
55.5
73.6
68.2
72.1
56.1
50.6
48.7
45.5
47.9
58.0
FGSM (Ours)
72.6
71.6
FI FGSM
76.4
66.9
$1.1
79.5
82.6
67.5
62.1
60.3
56.6
56.4
68.9
FL TL-EPNI-FGSM (Ours)
81.0
73.3
88.5
87.0
88.6
76.3
70.9
70.1
66.4
66.4
76,9
MI-FGSM
33.0
20.3
48.8
41.8
41.3
25.1
21.5
21.7
19.0
29.4
22.5
27.7
22.7
18.9
PINI- (Ours)
46.7
29.0
71.2
68.7
63.5
41.5
31.3
31.5
28.5
28.7
43.8
DI-MI-FGSM
44.9
31.6
62.4
55.9
56.9
37.5
32.0
30.9
27.8
28.1
40.8
T1-M--FGSM
38.9
29.4
44.3
38.0
41.4
31.5
28.5
28.2
34.3
SI-NI-PGSM
50.0
33.5
61.4
56.4
54.4
36.5
29.9
30.0
27.2
26.
40.6
V16
DI-EPNI-KGSM (Ours)
61.2
44.7
80.3
77.9
788.
52.2
43.5
42.6
40.2
38.8
56.9
TI- EPNI-FGSM (Ours)
61.8
49.9
68.6
65.2
63.7
19.2
50.3
47.7
47.6
46.1
55.0
SI-EPNI-POSM (Ours)
75.4
41.9
VI-MI-FGIM
49.4
35.4
65.3
58.7
58.6
39.7
34.3
33.6
29.2
32.2
43.6
VT-NI-FGSM
19.3
37.5
67.3
60.2
60.9
40.7
35.1
34.0
29.8
32.0
44.7
SEPNI-FGSM (Ours)
61.4
47.6
82.9
77.8
77.8
58.9
48.8
47.0
46.5
47.0
59.6
FI-MI- FOSM
14.6
74.1
13.5
55.1
FI FI-EPNI-PGSM (Ours)
64.7
44.8
85.1
81.3
80.8
$8.6
46.2
49.1
42.5
42.4
59.6
FGSM (Lin et al.
2019). DI-MI-FGSM (Xie et al. 2019). TI-MI-FGSM (Dong et al., 2019) SI-NI-
FGSM (Lin al. 2019) ST-MI-FGSM (Wang & He (02T). YT-NI-FGSM (Wang 20 and
FI-MI-FGSM (Wang et al. 2021). Then we compare the transferability of conventional momentum- based attacks and our EPN based attacks.
Hyperparameters. In all experiments, we follow the official default settings for hyperparameters. Specifically, the maximum perturbation = 16, the number of iterations T' = 10, the step size = c/T = 1.6, and the decay factor μ 1.0. For DIM (Xie et al. 2019), the probability p is set to 0.5. For TIM (Dong et al.) 2019), the size of the Gaussian kernel is set to 15x15. For SIM (Lin et al, 2019), J. the number of scale copies m is set to 5. For VT-MI-FGSM (Wang & He 2021) and VT-NI- FGSM (Wang & He| (221)), the number of sampled examples N is set to 20, and the parameter 3 for the upper bound of the neighborhood is set 1.5. For FI-MI-FGSM (Wang al. (02T). the drop

---

Under review as a conference paper at ICLR 2023
100
2113
Figure 3: The average attack success rates (%) of the adversarial examples crafted on source models against normally trained models (except the source model) and defense models for vari- ous μ.
Figure 4: The average attack success rates (%) of the adversarial examples crafted on source models against normally trained models (except the source model) and defense models for vari- ous epochs.
probability Pa is set to 0.3 when attacking normally trained models and 0.1 when attacking defense models, the ensemble number N is set to 30 in aggregate gradient, and the intermediate layer is set to Mixed_5b for Iv3, Conv_4e for IRv2, Comv3_3 33 for V16 as well as the last layer of the second block for R152. For our EM-based attacks, epochs is set to 5.
4.2 ATTACK NORMALLY TRAINED MODELS
To validate that EPN-based attacks have higher transferability than conventional momentum- based attacks, we choose Iv3, IRv2, R152, and V16 as the source model, respectively, and attack normally trained target models via our EPN-based methods and baseline methods. The attack success rates are shown in Table The results show that the attack success rates of our EPN-based methods are ~1..9% higher than baseline methods on average, particular, our EPN-based attacks have the best transferability against normally trained target models when the source model is R R152. Specifically, the attack success rates of EPNI-FGSM, DI-EPNI-FGSM, VT-EPNI-FGSM, and FI-EPNI-FGSM are 92.0%, 97.2%, 96.0%, and 96.0%, respectively, on average. Therefore, the experiments demon- strate that our EPN improves transferability more effectively than conventional momentum against. normally trained models.
4.3 ATTACK DEFENSE MODELS
To further compare the transferability, we also use defense models as the target models, and the source models still Iv3, IRv2, Ri52, and V16. We craft adversarial examples on the source model via our EPN-based methods and baseline methods to attack defense models. The attack success rates are shown in Table 3 The results show that the attack success rates of our EPN- based methods are 13.11% higher than baseline methods on average. Adversarial examples crafted on R152 still show the best transferability against defense models. Specifically, the attack success rates of EPNI-FGSM, DI-EPNI-FGSM, VT-EPNI-FGSM, and FI-EPNI-FGSM are 51.7%, 75.8%. 73.6%, and 76.9% respectively, on average. The results of experiments indicate that our EPN is still more effective than conventional momentum against defense models.
4.4 ABLATION STUDY
We conduct ablation studies for EPNI-FGSM. We investigate the impacts of two hyperparameters (i.e., the decay factor μ and the epochs of pretraining epochs) on the transferability of EPNI-FGSM
in Sec. 4.4.1 We further study the impacts of EM and PN on transferability in Sec. 4.4.2
4.4.1 IMPACTS OF μ AND epochs
The source models are set to Iv3, IRv2, R152, and V16. We use EPNI-FGSM to craft adversar- ial examples to attack normally trained models and defense models, respectively. We investigate the impacts of μ and epochs on the transferability of EPNI-FGSM by counting the average attack success rates against normally trained models (except the source model) and defense models.
The decay factor p. The decay factor μ plays a vital role for momentum. If μ = 0, the momentum- based attacks degrade to vanilla iterative gradient-basee bassed attacks. If < p the previous gradients
8

---

attacks have the same settings as Under review as a conference paper at ICLR 2023
18-3 810
Figure 5: The average attack success rates (%) of the adversarial examples crafted on source models against normally trained models and defense models via NI-FGSM, ENI-FGSM, PNI-FGSM, and EPNI-FGSM.
accumulated in the momentum decay exponentially. If 1, the momentum simply adds up all previous gradients. If μ. 1. the previous gradients accumulated in the momentum grow exponen- and set μ from 0.0 to 2.0 with a step size of 0.1. The average attack
tially. We pre-set epochs success rates shown in Fig. When μ < 1.0, the average attack success rates show upward trend, and when j 2 1.0, the average attack success rates show a downward trend. Therefore, we set μ = 1.0 for EPNI-FGSM achieve the best transferability.
The epochs of pretraining epochs. epochs affects the amount of gradient accumulated in EM. We pre-set μ 1.0 and set epochs from 0 10 with a step size of The average attack success rates are shown in Fig. 4 As epochs increases, the average attack success rates increase and gradually converge. Since the larger epochs, the higher the computational cost, we set epochs 5 for EPNI- FGSM to strike a balance between computational cost and transfcrability.
In summary, we set the decay factor μ 1.0 and the epochs of pretraining epochs for EPNI- FGSM. Similarly, such two hyperparameters of other EPNI-FGSM.
4.4.2 IMPACTS OF EM AND PN
The source models are the same as 4.4. To investigate the impacts of EM and PN, we craft adversarial examples source models via ENI-FGSM (only with EM), PNI-FGSM (only with PN), and EPNI-FGSM (with EM and PN), respectively. In addition, we also use MI-FGSM and NI-FGSM (without EM and PN) as baselines. For ENI-FGSM, the epochs of pretraining epochs set to 5. For ENI-FGSM and PNI-FGSM, the decay factor fi is set to 1.0. The average attack success rates of the adversarial examples against normally trained models and defense models shown in Fig. 5 The average attack success rates of ENI-FGSM are higher than MI-FGSM and NI- FGSM, demonstrating that EM improves transferability more than conventional momentum. The same is true for PN. Besides, the average attack success rates of EPNI-FGSM are higher than that of ENI-FGSM and PNI-FGSM, demonstrating that the combination of EM and PN can further improve transferability.
CONCLUSION
In this work, we proposed Experienced Momentum (EM) and Precise Nesterov momentum (PN) to boost transferability. Specifically, EM is trained on set of derived models by Random Chan- nels Swapping (RCS), and then conventional momentum initialized EM, which can accel- erate optimization to escape from saddle points and poor local extrema during early iterations to improve transferability. Additionally, we adopted the current gradient to refine the pre-update of conventional Nesterov momentum, called PN. Then, naturally combined EM and PN as EPN to improve transferability further. Extensive experiments demonstrate that EPN-based attacks have higher transferability than conventional momentum-basse attacks. However, our methods still adopt a fixed learning rate or step size that is crucial for the optimizer. Therefore, we will explore the impact of learning rate step size transferability in future work.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Ayelet Akselrod-Balle Barro,,,aalii,,,,, Leonid Karlinsky, Sharon Alpert, Sharbell Hasoul, Rami Ben-Ari, and Ella Barkan. A region based convolutional network for tumor detection and classification in breast manmography. In Deep learning and data labeling for medical applications, pp. 197-205.
Springer, 2016.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pp. 39-57. IEFE, 2017.
Grigorios G Chrysos, Stylianos Moschoglou, Giorgos Bouritsas, Yannis Panagakis, Jiankang Deng. and Stefanos Zafeiriou. P-nets: Deep polynomial neural networks. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 7325-7335, 2020.
Marco Cococcioni, Emanuele Ruffaldi, and Sergio Saponara. Exploiting posit arithmetic for deep neural networks autonomous driving applications. In 2018 International Conference of Elec- frical and Electronic Technologies for Automotive, pp. 1 1-6. IEEE, 2018.
Jia Ding, Aoxue Li, Zhiqiang Hu, and Liwei Wang. Accurate pulmonary nodule detection in com- puted tomography images using deep convolutional neural networks. In International Conference on Medical Image Computing and Computer- Assisted Intervention, pp. 559-567. Springer, 2017.
Yinpeng Dong. Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 9185-9193, 2018.
Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversar- ial examples by translation-invarian attacks. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 2312-4321,22
Gianni Franchi, Xuanlong Yu, Andrei Bursuc, Rémi Kazmierczak, Séverine Dubuisson, Emanuel Aldea, and David Filliat. Muad: Multiple uncertainties for autonomous driving benchmark for multiple uncertainty types and tasks. arXiv preprint arXiv:2203.01437. 2022.
Aditya Ganeshan, Vivek BS, and Venkatesh Babu. Fda: Feature disruptive attack. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 8069-8079, 2019.
Veta Ghenescu, Roxana Elena Mihaescu, Serban- Cerban-Vasile Carata, Marian Traian Ghenescu, Eduard Bamoviciu, and Mihai Chindea. Face detection and recognition based on general purpose dnn ob- ject detector. 2018 International Symposium on Electronics and Telecommunications (ISETC), pp. 1-4. IEFF, 2018.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6577 2014.
Cong Hao, Yao Chen, Xinheng Liu, Atif Sarwari, Daryl Sew, Ashutosh Dhar, Bryan Wu, Dongdong Fu, Jinjun Xiong, Wen-mei Hwu, al. Nais: Neural architecture and implementation search and its applications in autonomous driving. In 2019 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), pp. 1-8. IEEE, 2019.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4700-4708, 2017.
Sergey loffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In International conference machine learning, pp. 448-456. PMLR, 2015.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey Hinton. Imagenet classification with deep convo- lutional neural networks. Advances in neural information processing systems, 25, 2012.
10

---

Under review as a conference paper at ICLR 2023
Alexey Kurakin, Ian Goodfellow, Samy Bengio, et al. Adversarial examples in the physical world, 2016.
Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv preprint arXiv:1908. 06281, 2019.
Tianjiao Liu, Qianqian Guo, Chunfeng Lian, Xuhua Ren, Shujun Liang, Jing Yu, Lijuan Niu, Wei- dong Sun, and Dinggang Shen. Automated detection and classification of thyroid nodules in ultrasound images using sannicalkkowledge-eee guided convolutional neural networks. Medical im- age analysis, 58: 101555, 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017.
Muzammal Naseer, Salman Khan, Shafin Rahman, and Fatih Porikli. Task-generalizable adver- sarial attack based on perceptual metric. arXiv preprint 0rXiv:1811.09000 2018.
Yurii Nesterov. A method for unconstrained convex minimization problem with the rate of conver- gence o(1/1)). 1983.
Boris T Polyak. Some methods of speeding up the convergence of iteration methods. Ussr compu- tational mathematics and mathematical physics, 4(5):1-17, 1964.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint 1rXiv:1409.1555 2014.
Christian Szegedy, Wojeiech Zaremba, Hya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Du- mitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1-9, 2015.
Christian Szegedy. Vincent Vanhoucke, Sergey loffe, Jon Shlens, and Zbigniew Wojna. Rethink- ing the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 28 18-8-2 2016.
Christian Szegedy, Sergey loffe, Vincent Vanhoucke, and Alexander A Alemi. Inception-v4, inception-resnet and the impact of residual connections on learning. In Thirty-foss AAAI con- ference artificial intelligence, 2017.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint 2017.
Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- fion, pp. 1924-1933, 2021.
Zhibo Wang, Hengchang Guo, Zhifei Zhang, Wenxin Liu, Zhan Qin, and Kui Ren. Feature importance-awwe aware transferable adversarial attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 7639-7648, 2021.
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2730-2739, 2019.
11


Reviews:
[{"review_id": "ng8Kq80ZicJ", "reviewer": "Reviewer_u7X7", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes two methods, Experienced Momentum (EM) and Precise Nesterov momentum (PN), to improve the transferability of adversarial attacks. Specifically, the proposed method starts with a few iterations to accumulate the gradient, and uses it as the initial momentum. PN considers the gradient of the current data point in the pre-update of Nesterov momentum to make the pre-update precise. The combination of EM and PN boosts the transferability of conventional momentum based adversarial attacks.", "summary_of_the_review": "The experimental results are impressive, but lack of strong theoretical support.", "strength_and_weaknesses": "Strengths: \n-\tExtensive experiments show that EPN significantly improves the transferability of various momentum based adversarial attacks. \nWeaknesses:\n-\tThe approach is not tested on ensembles of models. Neither does it be tested on advanced defense models other than AT, such as Randomized Smoothing (RS), Neural Representation Purifier (NRP).\n-\tAblation experiments to verify the effectiveness of RCS are missing in the paper.\n-\tEM requires a few iterations first. NI doubles the time it takes to compute the gradient. The efficiency of the algorithm needs to be discussed more in this paper.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "ijr2NIRNRk", "reviewer": "Reviewer_aDJy", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "In this paper, the authors modify the momentum term by two novel methods to improve transferability of adversarial examples. ", "summary_of_the_review": "The performance of this work is quite promising. The main weakness is the lacking of explanation and at least I am not convinced why those modification can help adversarial transferbility. Thus, I will give a borderline score and am willing to change it during rebuttal. ", "strength_and_weaknesses": "+ the performance in experiments are quite good compared to existing  MI-FGSM.\n\n- the necessity of predicting of accurate momentum is lacking. Accurate momentum is helping optimization, but why it can lead better adversarial transferbility?\n\n- the proposed method is claimed to have advantages over standard  Polyak momentum and Nestrov momentum, then I am wondering how about the performance on DNN training tasks?\n\n- momentum is an estimation for second-order information, without comparing with Hessian, it is hard to say which estimation is more accurate, i.e., I do not like the title saying precise momentum. \n\n- following the idea that \"accurate\" momentum can help, then can we expect that some second-order method can further improve the transferbility?", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "hMWAucy9SU", "reviewer": "Reviewer_WpNN", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper studied the problem of transferability of adversarial examples. Specifically, it considered the setting of an input sample and two independent networks that well-behave on the sample, if the adversarial example derived from a specific neural network and the sample can fool the other network.\nBuilding upon previous work that practically prevents the adversarial example overfitting on a specific network by introducing input transformations and momentum strategy into the optimization procedures of generating adversarial examples, this paper proposes to accelerate the optimization procedures by setting an initial value for the momentum item for the iterative updating. The initial value can be considered a good estimation of the adversarial perturbation, so it is generated by a procedure similar to common adversarial attack methods but involving more randomness to improve its adaption.\nConsidering the way of getting the initial value of momentum, the method proposed in this work actually involves more updating steps compared with other baselines.\nIn the experiment, this work compared the attacking performance of the proposed method with methods applying momentum, and the result shows that the adversarial examples generated by the proposed methods have better attacking performance on new models with varying network architectures.", "summary_of_the_review": "After reviewing the paper, this work cannot persuade me that the proposed method can potentially improve the transferability of adversarial attacks under a fair comparison. Secondly, the proposed method is not technically novel to me. Besides, the introduction,  background, and terminology are less well-written.", "strength_and_weaknesses": "Strength\nThis paper did completely present the idea and is easy to follow.\n\nWeaknesses\nOne of my biggest concerns is the unfair comparison in the experiment. The improved attacking performance of the generated adversarial examples on the target models is more likely caused by a stronger attack induced by “more iteration steps” (Steps 2 to 9 in algorithm 1). To me, it is not the reflection of the transferability of the generated adversarial examples. I suggest the experiment should be conducted under saturation attack and equally computational costs. Specifically, the computational costs of steps 2~9 in Algorithm 1 should be considered in other baselines, and a greater number of iterations should be used to validate the root cause of the performance improvement, attack strength, or attack transferability.\nAnother aspect of unfair comparison is the selected baselines. The selected baselines in the experiment seem to be a weakened version of the proposed method. Some parallel work should be used for a fair comparison. Besides, the work is claimed to be a work in the line of black-box attack, then some work in this line should be considered too [4].\n\nMy second concern is about the careless statements, some are listed as (1), (2).\n(1)\tIn Paragraph 2 of the Introduction, “Iterative gradient-based and optimization-based attacks have high white-box but low black-box attack success rates, which means that such two attacks are impracticable in the real world”. Impracticable is not a reasonable conclusion for white-box attack. Please refer [3].\n(2)\t2.2 in the Related Work – the well-known fact about adversarial training is that insufficient inner maximization steps don’t induce enough robustness. However, adversarial training and its variants [1,2] with sufficient inner steps are still the golden baseline to defend against adversarial attacks. The statements about adversarial training are inaccurate and incomplete.\n\nAnother concern is the mathematical foundation of the work. The adversarial perturbation implies the local incremental of loss landscape over a specific point w.r.t a specific function. Setting initial values of perturbation to accelerate optimization is hard to corelated with the transferability of adversarial attacks.\nSpecifically, the statements “leading to better acceleration in the first few iterations”, and “accelerate optimization effectively during the early iterations to improv transferability”, do not make too much sense to me.\n\nMy last concern is about the novelty of the proposed method. The $g^{exp}$ in line 10, which is derived from line 2 to line 9 is the core idea of this paper, i.e., setting an initial value for the adversarial perturbation, which is not technically novel to me.\n\n[1] Madry A, Makelov A, Schmidt L, et al. Towards deep learning models resistant to adversarial attacks[J]. arXiv preprint arXiv:1706.06083, 2017.\n[2] Zhang H, Yu Y, Jiao J, et al. Theoretically principled trade-off between robustness and accuracy[C]//International conference on machine learning. PMLR, 2019: 7472-7482.\n[3] Carlini N, Athalye A, Papernot N, et al. On evaluating adversarial robustness[J]. arXiv preprint arXiv:1902.06705, 2019.\n[4] Shukla S N, Sahu A K, Willmott D, et al. Simple and efficient hard label black-box adversarial attacks in low query budget regimes[C]//Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining. 2021: 1461-1469.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "87tGhZ1yj5", "reviewer": "Reviewer_shJD", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper focuses on the transferability of black-box adversarial attacks. As a benchmark method, the introduction of momentum in iterative attacks helps the attack to get out of the local optimal solution for better transfer attack performance. The authors argue that the initial setting of zero in momentum inhibits the effect of momentum so propose Experienced Momentum (EM) with Random Channels Swapping (RCS) for accelerating optimization effectively. On the other hand, for problems of imprecise pre-update of the traditional Nesterov momentum, authors propose Precise Nesterov momentum (PN), which pre-updates by considering the gradient of the current data point. Finally, combining the above two methods to obtain EPN and achieve state-of-the-art results on some methods and models.", "summary_of_the_review": "We tend to reject this paper due to lack of motivational analysis and necessary experiments.", "strength_and_weaknesses": "Strengths:\n1. EPN focuses on better optimization methods and random channel data enhancement to improve transferability.\n2. This work proposes Experienced Momentum (EM) with Random Channels Swapping (RCS) for accelerating optimization effectively.\n3. This work proposes Precise Nesterov momentum (PN) to complete a more precise pre-attack to help momentum out of the local optimal solution.\n\nWeaknesses:\n1. The overall motivational analysis part of the paper is lacking. The authors do not adequately explain the motivation for the pre-trained momentum and the PN. Furthermore, there is also no relevant citations or empirical experiments as support. \n2. The experiments are done only for some basic models and defense models, and do not consider the performance of attacks under ensemble models and advanced defense methods (HGD, R&P, NIPS-R3, etc.), resulting in a lack of experimental completeness. In model selection, homologous models are simply stacked too much. Ensemble models and advanced defense methods are necessary for previous work on transfer attacks [1][2][3].\n3. The benchmark method uses for the experiments do not consider methods with better performance, such as VT-SITIDI-MIFGSM [3]. Only a relatively single VT method is considered, and the performance in the paper does not exceed the current SOTA method [3]. \n4. The pre-trained momentum introduces additional attack iterations. Can a more iterative attack with a common method achieve a similar effect?\n\n[1] Dong, Yinpeng, Tianyu Pang, Hang Su, and Jun Zhu. \"Evading defenses to transferable adversarial examples by translation-invariant attacks.\" In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4312-4321. 2019.\n[2] Gao, Lianli, Qilong Zhang, Jingkuan Song, Xianglong Liu, and Heng Tao Shen. \"Patch-wise attack for fooling deep neural network.\" In European Conference on Computer Vision, pp. 307-322. Springer, Cham, 2020.\n[3] Wang, Xiaosen, and Kun He. \"Enhancing the transferability of adversarial attacks through variance tuning.\" In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1924-1933. 2021.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject