Robust Adversarial Attacks Against Unknown Disturbance via Inverse Gradient Sample
Authors: Zhaoyang Zhang
Shen Wang
Runze Liu
Guopu Zhu
Fanghui Sun
Ye Lu
Zeyue Wang
Yihan Yan
Venue: ICLR 2026 Poster (2026)
Keywords: Adversarial sample
Transferable attack
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: This paper proposes IGSA, a robust adversarial attack framework that significantly improves the resilience of adversarial examples against unknown disturbance through inverse gradient-based sampling and iterative refinement.

Abstract: Adversarial attacks have achieved widespread success in various domains, yet existing methods suffer from significant performance degradation when adversarial examples are subjected to even minor disturbances. In this paper, we propose a novel and robust attack called IGSA (**I**nverse **G**radient **S**ample-based **A**ttack), capable of generating adversarial examples that remain effective under diverse unknown disturbances. IGSA employs an iterative two-step framework: (i) inverse gradient sampling, which searches for the most disruptive direction within the neighborhood of adversarial examples, and (ii) disturbance-guided refinement, which updates adversarial examples via gradient descent along the identified disruptive disturbance. Theoretical analysis reveals that IGSA enhances robustness by increasing the likelihood of adversarial examples within the data distribution. Extensive experiments in both white-box and black-box attack scenarios demonstrate that IGSA significantly outperforms state-of-the-art attacks in terms of robustness against various unknown disturbances. Moreover, IGSA exhibits superior performance when attacking adversarially trained defense models. Code is available at https://github.com/nimingck/IGSA.

Published as a conference paper at ICLR 2026
ROBUST ADVERSARIAL ATTACKS AGAINST UNKNOWN DISTURBANCES VIA INVERSE GRADIENT SAMPLE
Zhaoyang Zhang', Wang', Runze Liu', Guopu Zhu', Fanghui Sun', Ye Lu Zeyue Wang", Yihan Yan
1 Faculty of Computing. Harbin Institute of Technology, Harbin 150001, China
2 Bio-vision System Laboratory, Shanghai Institute Microsystem and Information Technology, Chinese Academy of Sciences, Shanghai 200050, China. yan. off.offfeeeeeo m@hit. edu. en
ABSTRACT
Adversarial attacks have achieved widespread success in various domains, yet ex- isting methods suffer from significant performance degradation when adversarial examples are subjected to even minor disturbances. In this paper, we propose a novel and robust attack called IGSA (Inverse Gradient Sample-based Attack), capable generating adversarial examples that remain effective under diverse unknown disturbances. IGSA employs an iterative two-step framework: (i) in- verse gradient sampling, which searches for the most disruptive direction within the neighborhood of adversarial examples, and (ii) disturbance-guideds refinement, which updates adversarial examples via gradient descent along the identified dis- ruptive disturbance. Theoretical analysis reveals that IGSA enhances robustness by increasing the likelihood of adversarial examples within the data distribution. Extensive experiments both white-box and black-box attack scenarios demon- strate that IGSA significantly outperforms state-of-the-art attacks in terms of ro- bustness against various unknown disturbances. Moreover, IGSA exhibits supe- rior performance when attacking adversarially trained defense models. Code is available https: / com/ mimingck/IGAA
INTRODUCTION
Extensive research demonstrates that deep neural networks (DNNs) are highly vulnerable to adver- sarial examples Szegedy 2013); Papernot et al. (2017); Kurakin et al. (018)). The emergence of more threatening adversarial examples has the potential to stimulate advances in secure machine leariig Liu et al. (2016); Leino et al. (2021); Zhu all (2023b). To be genuinely threatening in practice, an adversarial example should satisfy three key properties: (i) transferabilityy ensuring its effectiveness in black-box scenarios; (ii) stealthiness, enabling it to evade standard detection mech- anisms; and (iii) robustness, allowing it to retain attack effectiveness under various disturbances.
A widely studied category of adversarial attacks the white-box attack Goodfellow al. (2014); Carlini & Wagner 7): Kurakin et al. (2018), which assumes full access to the target model's parameters and architecture. While effective in theory, this assumption rarely holds in practice, limiting their real-wor world relevance. A more practical alternative is the transfer- based black-box attack (Paperoot al. (2016); Wu al. (2020), where adversarial examples generated on surrogate models are applied to unknown target models. Yet, recent evidence[Lin et al. (2024); [i et al. (2022);
Xie et al. (017) suggests that existing transfer attacks are highly brittle: even minor disturbances result the effectiveness of the attack, especially in targeted attacks, as shown in Fig [ The
fragility of adversarial examples naturally limits their attack success rate in applications.
In this paper, we propose novel adversarial attack framework designed to enhance the robustness of adversarial examples against various (including unseen) disturbances. It adopts an iterative two- step procedure. First, disturbances sampled from a prior distribution and mapped into specified disturbance distribution, which relatively represent diverse and realistic disturbances. Second, the adversarial example is optimized to maintain its effectiveness under the sampled disturbance.

---

Published as a conference paper at ICLR 2026
Types of Disturbances
Seent
Disturbances
Rotate
Perspective
Jegg
Unseen:
Resize
Blu
Controst
Not all types of disturbances be
Seen
Succeed
Previous
Attacks
Unseen
X
Failed
unperturbed
Original Sample
Adversarial Sample
is used for training
Seen
Succeed
IGSA
is the most disruptive disturbance.
Unseen
Succeed
Original Sample
Our Adversarial Sample
used find * used for training.
Figure I: Robustness of adversarial attacks under various disturbances. Existing adversarial exam- ples degrade under unseen disturbances. Our proposed IGSA enhances robustness against both seen and unseen disturbances.
The design of an appropriate mapping function in our robust attack framework raises three key challenges. (i) Sampling Coverage Limitation: When the disturbances are insufficiently sampled, adversarial examples may still fail under unseen disturbances. (ii) Distribution Mismatch: If the distribution disturbances used for training differs from the actual distribution of real-world dis- turbance, adversarial examples may lose their effectiveness in practice. (iii Transferability Con- sideration: In black-box scenarios, adversarial examples must remain transferable across models, necessitating explicit integration of transferability into training.
To address these challenges, we propose the Inverse Gradient Sample- Attack (IGSA). con- trast prior approaches that rely random disturbance sampling during training Athalye al. 2018), IGSA employs inverse gradient sampling to identify the most disruptive disturbances. This mechanism effectively mitigates the failure of adversarial examples under unseen real-world noise. Theoretical analysis further shows that IGSA achieves over 10 times higher efficiency in approximating such disturbances compared random sampling. Moreover, IGSA actively explores flat regions of the loss landscape, strategy recently shown Ge et al. (2023) to substantially enhance transferability of adversarial examples.
By analyzing the impact of data likelihood on robustness of adversarial examples, we evaluate IGSA under distribution mismatch. Extensive experiments show that models exhibit high confidence and robustness on clean samples from the natural distribution Liu et al.] (2025). Theoretical analysis reveals that IGSA preserves a high likelihood of adversarial examples under the natural data dis- tribution. This enables IGSA generate adversarial examples that are both robust and resistant to defenses. Our main contributions are summarized as follows:
We propose robust attack framework that iteratively samples disturbances from a prior distri- bution and refines adversarial examples under these disturbances. The framework can be applied to any existing attack, enabling effective resilience against diverse disturbances.
We introduce IGSA to address three key challenges in the robust attack framework. Theoretical analysis shows that IGSA improves the data likelihood of adversarial examples, enhancing its robustness against disruptions and defenses.
Extensive experiments demonstrate that IGSA maintains high data likelihood during training, generating visually natural adversarial examples with strong attack success. Furthermore, the re- sults show that IGSA outperforms state-of-the-art methods both robustness and transferability.
2

---

Published as a conference paper at ICLR 2026
2 RELATED WORK
2.1 BLACK-BOX ADVERSARIAL ATTACK
Black-box adversarial attacks are typically categorized into query-based Cheng et al. (2019); Dong
er al. )2021); Shi et al. (2022) and transfer-based approaches Xie et al. (2019); Wang & He (202))
Wang et al. 2021 Jin et al. p; Chen et al. (2023): Wang et al. (2024b a). Query-base meth-
ods estimate gradients by iteratively querying the target model. but they often require excessive queries, limiting their practicality under query constraints. In contrast, transfer-based methods gen- erate adversarial examples surrogate models and transfer them to the target model. To enhance transferability, prior work has explored diverse strategies, including momentum integration Wang et al.] (2024a), input transformations Xie al. 2019);; Wang et al. (202T), model-specific strategies Jin et al. (2023) Wang et al. 2022bb, and gradient ensembling Chen et al. (2023).
Despite their effectiveness, many of these attacks fail under even basic input transformations Xie et a 2017):
(217)))00))1111 Li (2022); Liu et al. (2024), revealing a lack of robustmess in real-world scenarios. To mitigate this issue, researchers have proposed several strategies. The Expectation over Transformation (EOT) framework Athalye et al. (2018) incorporates data augmentation during training simulate distributional disturbances. Other techniques, such as gradient smoothing Wang world disturbances Eykholt et al. (2018), affine-invarian estimation Xu et al. (2020), and margin maximization Luo et (208)), further enhance attack stability. Nevertheless, these methods are largely heuristic, exhibit limited generalization to diverse disturbances, and lack theoretical performance guarantees.
et al.] (2023), physical ohysical-world
2.2 DEFENSE METHODS
The number of existing defense methods far exceeds that of adversarial attacks, as stronger attacks continually motivate the development of more effective defenses. Broadly, defenses can be cat- egorized into adversarial training-based and input transformation based approaches. Adversarial training defenses Tramer al. (2017); Liu al. (2020a): Jiang et al. (2023) enhance robustness by incorporating adversarial examples during optimization, but are computationally intensive. Input transformation defenses, on the other hand, attempt to neutralize perturbations before feeding them into the model through techniques such as JPEG compression Dziugaite et al. (2016), image scaling Xu (2017): Zheng et al.] (2023), or randomized transformations Xie al. (2017). Some methods further employ denoising networks to purify inputs while preserving accuracy Hong & Lee| (2024);
often restricted to specific attack types. These methods are attractive in practice, they do not require modifications to the model architecture or additional training cost, making them both efficient and easy to deploy.
Ning et al.] (2024). though their effectiveness
3 METHODOLOGY
3.1 PRELIMINARY: ROBUST ADVERSARIAL ATTACK FRAMEWORK
Given an original sample x E Im and a target model f I + R the goal of adversarial attacks is to find a minimal perturbation 5 such that the perturbed sample + is misclassified by the model into a specified target class I, i.e., f(x + 5) I.
In black-box settings, optimizing 8 is particularly challenging because adversarial examples may be subjected to additional disturbances before being processed by the target model. These distur- bances can arise from various sources, such as secondary data acquisition, client-side preprocessing, or built-in defense mechanisms. To enhance the robustness of adversarial examples against distur- bance, we propose a novel robust attack framework. The framework operates in two stages, aiming to generate perturbations that remain effective under diverse and potentially unseen disturbances: Step 1: Sampling disturbance
We first sample a set of initial disturbances é from prior distribution B. These disturbances are then translated to hi(gh x + 5) by a mapping function h, given the current adversarial example x 4- 5.
Step 2: Optimizing adversarial examples
We apply the disturbed sample x + 8 + h(o, x 8) to a surrogate model g. The task loss is defined as C² (x 55 h(0, 5)) == C(g(x + h(o, x 8)), t), where C denotes the cross-entropy loss. We then minimize the expected loss over the distribution 15: ming EgnB (C + 5 h(0, x + 6))], which can be optimized via gradient descent.
Let h(0, x 8) complies with distribution P. By the Law of the Unconscious Statistician (LOTUS), have: Es [C* (x + 5 h(0, 5))] Eyp (C' (x + + r))], which allows us to formulate
3

---

Published as a conference paper at ICLR 2026
the problem of enhancing robustness against various disturbances as the design of suitable map- ping function h66, x + 5). Unlike conventional methods that sample from a fixed distribution, function h( d) can be designed to adapt both the adversarial example and surrogate models, enabling it to produce the most destructive disturbances for each specific sample. In the following, analyze three key challenges in applying the proposed robust attack framework:
> Limited Sampling Coverage: The estimation of the expected loss typically relies on limited number of Monte Carlo samples. This can lead to poor coverage of the disturbance space, resulting in adversarial examples that generalize poorly to unseen disturbances;
Distribution Mismatch: During application, adversarial examples may encounter real-world dis- turbance that differs significantly from the distribution of h( x + 8), causing the attack to fail; & Transferability Consideration: Under black-box settings, we also need to account for the trans- ferability of adversarial examples to ensure their effectiveness on the unseen target models.
3.2 INVERSE GRADIENT SAMPLING
In this section, we first introduce the Inverse Gradient Sampling (IGS) method and then theoretically analyze how it addresses the first limitation of existing approaches, namely the issue of limited sampling coverage, discussed in section 3.1
Based on the proposed robust attack framework, we define the map function h(o, x + 8) as h(o, x+
5) o o 5 + Φ) The Step is then solved using a two-step iterative approach:
h(o, x + 5 = Φj + Vo, (a + + bj), Φj ~ B
N
6 V
Σ
c² - 6, + Mbb
(2)
N
The challenge of limited sampling coverage arises from insufficient number of training samples, such that realistic perturbations may deviate substantially from any learned disturbance h(o,, x + 5). As a result, adversarial examples may fail to remain effective under real-world disturbance. This suggests that robustness fundamentally depends on whether the set of trained disturbances (h(o,, x + 8)} can sufficiently approximate the most destructive disturbances applied to x + 6.
To quantitatively evaluate the performance of IGS, we assume that the most destructive disturbance given by 6² arg |r (* + + Φ), and that 6" is uniformly distributed within the neighborhood. i.c., o- B(O, r). Under this assumption, the average loss over sampled disturbances satisfies 1/2 C (z+ + +)) I C* +6+++")..W define the error as the gap between the upper bound and the empirical average: & == C'(x+++0") y/ E (² (x++++h(0))) (00t,,(0,.00 x +))) During the iterative optimization in Equation (2). the accumulated error in is given by:
N
]
AS Σ +=++)))) V
+ + (+00))++0))) 01)
V BppoB( (8).
N J=1
(3)
where I is the iteration number of Equation Assuming that C is Lipschitz continuous in the neighborhood of + 8 the expected error over the sampling process satisfies (60. [E] < E.g-B(0,r)) (+)
This enables us compare different sampling strategies by their ability to minimize Ba--B(orr) (1 x + 8) d" |]. Since o² can appear anywhere within the neighborhood of x: + 6, we derive the following theorem to compute the expectation when h(0, 8) d. which commonly used EOT-based approaches (Athale et al. 2): Hu et al. (2021): Liu et al. (2022). Theorem Let m denotes the dimensionality of the input space, and let n be the number of samples
drawn from ((0,7) r). Then, EB-~~((.r)) (Eo-B((r)) ||oo [|ob-$11] 0z - (+) (
Remark 1 Theorem | indicates that the expected error decreases with the number of queries following a power-law decay of -1/m. To halve the error, the number of queries must increase by factor of 2m, which becomes computationally prohibitive in dighediinnsional spaces.
To further quantify the advantage of IGS over EOT, we present the following theorem:
Theorem 2 Let C* be a convex function in spherical neighborhood of radius centered at x + 6, with unique extremum point x 4-+ 8+ +000 6². Then, the following relation holds: h(()) - = 7(0- 6),
where the scalar coefficient 7 is given by V V (x48+6)
01
4

---

Published as a conference paper at ICLR 2026
Let (E) and (E) denote the error bounds of IGS and EOT. Based Theorem
have:
EE) =E B(. 1/ + -6"11 vr. m72
(4)
(E) - =r-
Let 14GS and Agor denote the number of queries required by IGS and EOT, respectively, to achieve the same error bound. By equating the two bounds, we obtaín:
nEOT
BOT
74GS
(1 - (1
Remark Equation (6) shows that the efficiency advantage of IGS over EOT scales exponentially with the data dimensionality In rypical vision tasks where m >> 10*, this advantage becomes particularly pronounced. For example, on ImageNet (m=256256xx3) with Rs 10- we estimate:
TggoT
3.5 10
TAGS
This demonstrates that IGS can capture the most destructive disturbance using far fewer samples than EOT, significuntly alleviating the issue of limited sampling coverage. Theoretical extension for non-convex conditions are detailed in Appendix C
3.3
ROBUSTNESS AND TRANSFERABILITY UNDER DISTRIBUTIONS MISMATCII
Adversarial examples often encounter disturbances that deviate from the distribution assumed during training. In this section, we analyze why our method maintains strong performance under such distribution mismatch and examine how it promotes the transferability of adversarial examples.
3.3.1 WHAT DETERMINES THE ROBUSTNESS OF ADVERSARIAL EXAMPLES?
Our analysis is motivated by the observation that clean samples exhibit significantly greater robust- ness under disturbance compared to existing adversarial examples. To quantify this, we define the robustness boundary, denoted as КJJ, as the minimum amount of disturbance required change the model's 's prediction on given sample set S. Formally: K.3- || arg maxę IEzes [Zo] < r] |l. Zo g(x + 8) 1 (i=topk) (g()), where is random disturbance, т confidence threshold, and [1=ttopk) (-) indicates whether the prediction belongs the original top-k classes. The robustness boundary X33 indicates the ability of samples in S to retain their original labels under disturbance.
As shown in Fig. D. the robustness bounds XJ are consistently larger for clean samples than for adversarial examples, indicating that clean sam- ples are more robust to disturbance. This moti- vates the conjecture that higher likelihood under the natural data distribution Pn correlates with greater robustness. Clean samples are drawn typi-
500
DTA
GRA
PGN
SMI-FGRM
BSR
IGSA (ours)
400
300
KT
from PD. while adversarial examples cally deviate from PD Zhu et al. (2022). Since models trained fit PD. they tend gener- alize better to samples that are more likely un- der Pp. which explains the superior robustness of clean samples. However, directly computing (D(zwd)) generally intractable. The key ques- tion. therefore, becomes: How can we construct adversarial samples that maintain a high likeli- hood under Pp? ? We address this question in the following section.
200
100
ResNet18
DesNet121
Visforeer
Figure 2: A comparison of the robustness bounds KC across different adversarial examples and clean samples. The black bars represent the ro- bustness bounds for clean samples.
3.3.2 ALIGNING GRADIENTS FOR HIGH-LIKELIHON ADVERSARIAL SAMPLES
In Equation 2 we perform gradient descent on Ct to push the input toward misclassification. This process increases the surrogate model's confidence in the target class, o 8). When the gradient

---

Published as a conference paper at ICLR 2026
Algorithm Inverse Gradient Sample Adversarial Attack
Original data æ; balancing parameter A; inverse learning rate μi, step size at perturbation preset range number of sampling points N; sampling variance o²; model g; loss function C; sign function sigm(-); target class t.
Input:
Output:
Robust adversarial example Fadv.
Initialize adversarial perturbation å +- and cumulative update direction d f 0.
repeat
Tado x x
for i 1 to N do
Sample 02 ~ (0
Compute loss at Ø;: Gradient update for di:
C. = Clg(s + 0.), X
3: t sign
Compute loss at Φ:: Compute update direction: Accumulate dswm:
C. = C(g(x + 6 --
9,
d 6. f C. Va, log + +2=
d d t d +
end for
Update adversarial perturbation: Constrain perturbation magnitude:
Tady Jnly - a sign (dsmm)
8 s- clampl-c,
until Loss Co converges Fado < +
return Tade
of the surrogate model aligns with PD, the update also increases the likelihood adversarial exam- ple under PD. To encourage the search for a perturbation 8 where such alignment occurs between the gradients of the surrogate model and PD. we present Theorem 3
Theorem Let [-] denote the trace of the Hessian matrix, and let B(0, r) represent uniform
distribution over the ball of radius in Rm Then:
ABBB(r)) [(V.C*) VoPD) = - [I((H(())]-
Remark Theorem Jestbbishes that minimizing the truce of the Hessian of C² enhances the align- ment between v and PD, which in turn increases the likelihood of the resulting adversarial examples under Po during the iterative process.
We now examine whether the iterative optimization procedure implemented by our proposed IGS method leads adversarial examples with reduced Hessian trace.
Theorem 4 Let Ot denote C* (a: + 8). Suppose the Hessian H(C*) bounded in the neighborhood of x + 8, such that || S L, the update rule satisfies:
V V V.Ct + +|VV&C112++ 2 + & 1/L
+
Remark Theorem44hoow that the proposed IGS method implicitly minimizes (C(H)(*)) through- out the iterative process. This contributes to an increased likelihood of adversarial examples under the data distribution Pp. which verified by Fig. the same time, IGS also reduces ||V &V&C'|.? promoting smoother loss landscapes. As demonstrated by Ge et al. (2023), such improvements in smoothness significantly enhance the transferability of adversarial examples across models.
3.4 INVERSE GRADIENT SAMPLE ADVERSARIAL ATTACK
We present the detailed implementation of the IGSA in Algorithm I. In Algorithm several practical techniques to improve convergence and efficiency:
I we incorporate
(1) Sampling Distribution. We sample the disturbance & from Gaussian distribution, o (0, x²) leads to faster convergence and more stable optimization.
(2) Efficient Gradient Estimation. To reduce the computational cost associated with second-orde derivatives in Equations equation and equation propose efficient first-order approximation based on Theorem in appendix:
V.E (0
2 EB-N10 (c +oo++0 8 + lolog + 6,

---

Published as a conference paper at ICLR 2026
Table 1: Robustness of various attacks on ImageNet under additive and non-additive disturbances.
ASR (8)
VGG19
ResNet34
VIT
Disturbance Types -
Additive GSB
Non-odditive
Additive GSB
Non-additive CB
Additive GSB
Non-additive
time
Attacks Types
JPEG
RT
CB
JPEG
RT
JPEG
CB
PGD Madry et al. 2017
8.3
2.1
43.8
0.0
0.3
31.3
4.2
0.0
9.3
17.2
6.1
0.0
0.025
DD- ot 2018
66.7
62.5
72.9
0.0
77.1
87.5
16.7
67.4
79.6
30.9
0.025
DTA Yank et ai 2024
70.8
68.8
75.0
2.1
91.7
100.0
18.8
0.0
78.
78.1
42.3
7.5
0.186
GRA
20223
62.5
64.6
52.1
8.3
89.6
93.8
56.3
12.5
81.9
85,4
76.4
19.5
0.345
PON Li al 2025
33.3
41.7
27.1
8.3
72.9
81.3
37.5
8.3
72.6
70.9
65.8
11.7
0.659
SMI-FORM et
2025
66.7
62.5
52.1
12.5
87.5
93.8
39.6
6.3
84.0
86.7
65.0
13.9
0.198
DMMXicett er 2019
87.5
75.0
66.7
29.2
93.8
39.6
89.3
82.3
79.6
20.4
0.020
TIM Dong el M011
68.8
58.3
27.1
12.5
87.5
91.8
8.3
4.2
81.8
82.8
19.2
3.9
0.020
BSR
Wans 20243
83.3
10.4
68.8
71.7
PGD+EOT JAmaaay et 2018 IGSX (ourS)
2018
87,5
93.8
79.2
27.1
91.7
100.0
40.3
22.9
87.6
89.2
70.9
26.7
0.461
87.5
95.8
96.7
35.4
97.2
100.0
75.0
92.2
91,9
85.3
27.0
0.423
(3) Gradient Magnitude Control. To ensure stable optimization, we employ a sign-based gradient update rule. Additionally, an fz-norm constraint is imposed on 8 during the computation of the loss C*, in order to minimize the magnitude the perturbation introduced.
EXPERIMENTS
4.1 EXPERIMENT SETUP
Tasks and Models. We evaluate our proposed IGSA on two types of tasks, including image clas- sification and face recognition. We use two benchmark datasets in the image classification task, including CIFAR-10 CIFAR-100Kiizhessky Krizhevsky et al. (2009) and ImageNet Deng et al. (2009.. The models on the ImageNet dataset use the official pre-trained models from torchvision, including VGG19 Simonyan 2014), ResNet34 He et (2016), ResNet101 He et al. (2016). ViT-Base Dosovitskiy et al. (2020), and Inception-v3 Szzgedy al. (2016). The models ResNet34, and ViT-Base, are trained using the standard cross-entropy loss. In the face recognition task, we use the CelebA dataset et al. (2015) and perform attacks based on the aggregation mod- els of the insightface framework Deene et al. (2019). We train these models using a pairwise loss function. More implementation is detailed in Appendix B.I
the CIFAR-10 10 dataset, including VGG19,
Attack Settings. In our experiments, the attack success rate (ASR) is mainly used to measure the performance of various attacks. All experiments are conducted using a NVIDIA 4090 GPU, In various tasks, we first set the adversarial perturbation strength of various attacks to unified value to ensure fairness in comparison. is set to 8/255; in experiments on the ImageNet dataset, is set to 16/255, The number of iterations of various attacks is uniformly set to 100. For our proposed IGSA, the hyperparameter a for adversarial perturbation update is set to 1.6/ 1.6/255. The number of sampling points N is set to 20. The hyperparameter À is set to 0.1 on the ImageNet dataset and 0.03 on the CIFAR-LO dataset. The hyperparameter is set to 0.4 for the ImageNet dataset. For the CIFAR-10 dataset, μ varies across different models: 0.5 for ResNet, 0.8 for VGG, and 0.3 for VIT.
experiments on the CIFAR- and CelebA datasets,
4.2 ROBUSTNESS EXPERIMENTS
Evaluation of Attack Robustness: To evaluate the robustness of various attack methods, we con- duct targeted attacks on the ImageNet dataset under both additive and non-additive disturbances (Table DD. For additive disturbances, we apply Gaussian blur (GSB) with a kernel size of 5 and standard deviation 1.0, and JPEG compression at 50%. For non-additive disturbances, we use ro- tation transformation (RT) with a 10a angle and combined transformation (CB), including resizing (x1.15), rotation (5"), and perspective distortion (0.15). Additional experiments are detailed in the Appendix B.2.1
IGSA Performance Under Disturbances: Without disturbances, most attacks achieve nearly 100% ASR. Table [ shows IGSA outperforms existing methods under almost all disturbances. Transfer- based attacks like MI-FGSM Dong et al. (2018), DTA Yang et al. (2023), and GRA Zhu et al. 2023a) show significant performance drops under disturbances. Gobustness-oriente
attacks such as DIM Xie et al. (2019), TIM Dong al. (011),, BSR Wang al. (2024a), and EOT Athalyel ctt al. (218)) generate more robust adversarial examples, but their effectiveness is limited when the enhancement strategy mismatches the actual disturbance.
7

---

Published as a conference paper at ICLR 2026
Robustness of various attacks on the Ima- geNet dataset against defended models.
Table 2:
Table 3: Black-box testing of various attacks on the ImageNet dataset.
ASR (%)
ResNet50 (Defense)
VIT (Defense)
ASR (%)
RosNet
VIT
Attacks Types
Attack Types
DIM Xie
2019
66.4
MI-FGSM Dony et al.
2018
87.12
11.90
71.95
5.60
DIA Yang al 2023
66.7
61.7
et al
11:20
SMI SMI-FGRRM Faa
4025
70.8
52.0
GRA ZRu et ah Ni
94.69
16.10
72.45
4,90
LLPDLLeed
86.0
83.1
SMI-FGKM Hab eta 2U25
86.89
15.30
73.84
5.80
IGSA (ours)
83.0
79.2
DIM
DIM Xie et al.
2019
IGSA
91.0
89.6
TIM DoBe eral. A01V
94.01
18.60
62.52
2.90
DTA Yany
IGSA
78.5
BSR
Waing
91.64
18.20
68.45
SMI-PGRM Han 2023
IGSA
91.7
77.4
IGSA (ours)
91.75
27.30
90.94
23.90
ILPD
IGSA
89.0
82.7
Table 4: Black-box testing of various attacks the face recognition task using the CelebA dataset.
ASR (%)
ResNer50
MBF
Disturbance Types Attack Types
+
RS
RT
PT
CB
GSB
CTRS
BRT
JPEG
MI-FGSM Dong et al. 2018
66.7
80.0
82.2
84.4
27.3
38.6
50.0
43.2
DTA Yang et al. 2023
79.5
90.9
88.6
87.8
43.9
58,5
63.4
63.4
GRA Zhu
2025a
85.4
73.2
87.8
90.2
61.0
47.6
54.8
61.9
PGN ct al. 2025
85.4
92.1
92.7
92.7
56.8
40.5
48.6
59.5
SMI-FGRM Han ct al. 2023
55.3
48.9
61.7
57.4
25.5
23.4
36.2
DIM Xie et al. TIM
2019
86.0
83.7
83.7
86.0
58.1
51.2
58.1
62,8
Dong el al. 2019
63.8
10.6
23.4
23.4
22.9
4.2
6.3
4.2
IGSA (ours)
87.2
92.3
92.7
94.9
61.0
68.3
73.2
70.7
We validate IGSA on CIFAR-10: detailed results are in Ap- pendix B.2.2 Recent works focus generating adversarial examples resilient to physical-world distortions like reshooting, rotation, and lighting changes. We benchmark IGSA against state-of- the-art physical-world attack methods, also detailed in the Appendix B.2.2
Further Validation on CIFAR-10:
We evaluate IGSA against defended models, including ResNet50 and ViT models trained using defense method of adversarial training Liu al. (2025) within the ARES 2.0 framework Dong et al.] (2020) (Table 2). Results show IGSA maintains sig- nificantly higher robustness than existing attacks, especially under targeted settings where other approaches largely fail.
Performance Against Defended Models:
4.3 TRANSFERARILITY EXPERIMENTS
Evaluation Setup for Transferability: We evaluate the transferability of various attacks on im- age classification (ImageNet) and face recognition (CelebA), as shown in Table and Table Inception-v3 is used as the surrogate model. For black-box evaluation. adversarial examples are tested on ResNer34 and ViT-base for image classification, and ResNer50 and MBF for face recogni- tion. We apply IGSA to enhance state-of-the-an transfer attack methods in image classification and test robustness under black-box settings in face recognition. Additional implementation details are provided in Appendix B.I
Transfer Performance of IGSA: Experimental results show that IGSA achieves higher ASR than existing transfer attacks, When applied to DIM Xie et al. (2019), DTA Yang al. (2023), SMI- FGRM Han et al. (2023). and ILPD Li et al. (2024), the ASR against ResNet34 increases by 13.0%, 16.3%, 20.9%, and 3.0%. respectively; against VIT. improvements 19.0%, 12.4%. 22.9%, and 3.0%. Under black-box robustness tests, IGSA consistently outperforms all baseline attacks across disturbance types.
4.4 HYPERPARAMETER ANALYSIS AND ABLATION STUDY
Hyperparameter analysis. We conducted hyperparameter analysis of IGSA using the ResNet101 model. The results are shown by Table [5] It can be seen that IGSA achieves an ASR above 90% when the number of iterations exceeds 50. The parameter À has negative impact ASR, it
8

---

Published as a conference paper at ICLR 2026
constrains the magnitude of perturbations during iterations. The number of sampling points, frums significantly boosts ASR from 94.4% at points to 100% at 25 points by providing richer neigh- borhood information. The learning rate, a, exhibits optimal range, with ASR peaking at 99% for a = 1.6/ 255 and slightly decreasing for higher values. The parameter has a relatively minor effect on ASR, varying from 96.0% 98.7%.
Ablation analysis of IGS. As discussed in Sec- tion 3.2 IGS enhances adversarial example ro- bustness by approximating the most disruptive disturbance. To evaluate its impact, we compare IGSA with various EOT-based attacks. Figure 2 shows that under strong disturbance (SNR=10), IGSA achieves over 80% attack success rate with only 5 sampling iterations, while EOT-based at- tacks reach only about 60% with 50 samples. This demonstrates that IGS significantly im- proves both efficiency and effectiveness in gen- erating robust adversarial examples.
Table 5: Hyperparameter analysis of our pro- posed IGSA, where the shaded values are used in comparative experiment.
0.02
0.05
0.10
0.20
0.30
ASR (%)
100.00
100.00
97.22
69.44
5.56
0.02
0.04
0.10
0.20
0,50
ASR (%)
96.00
97.22
97.22
97.37
98.68
iteration
10
20
50
100
200
ASR (%)
11.11
56.00
94.44
97.22
100.00
N
10
15
20
25
ASR (%)
94.44
97.22
97.22
99.00
100.00
a
10 10.4/255
0,8/255
1/255
1.6/55
2,2/255
Likelihood Analysis. As discussed in Section 3.3 our IGS enhances robustness by aligning the likelihood of adversarial examples with the original data distribution. We validated this using an energy-based out-of -itt---distribution detection method Liu al. (2020b). Results show that IGSA- generated samples achieve in-distribution scores comparable to clean data, whereas those from other attacks show significantly lower scores. This demonstrates that IGSA produces realistic and distribution-awen adversarial examples, improving both robustness and stealth.
ASR (%)
88.00
96.00
97.22
99.00
97.22
0.9
CIEAR-10
0.20
MI-FGSM
DTA
Attack success (%)
PGN
0.8
0.15
DIM
Density
0.7
BSR
0.10
IOSA (ours)
0.6
PID+BOT
0.05
DEA+BOT
0.5
IGSA (ours)
0.00
10
20
20
25
Number of sampling points
OOD score
Figure 4: Comparison of attack success rates be- tween IGSA and EOT as the number of samples increases.
Figure Distribution of the Energy OOD scores Liu et al. (2020b) for the clean samples, CIFAR- TO, and the adversarial examples.
5 CONCLUSION AND LIMITATION DISCUSSION
In this paper, we propose a robust adversarial attack framework to address the vulnerability of transfer-based attacks under various disturbances. Within this framework, we introduce IGSA to tackle three key challenges: sampling coverage limitation, distribution mismatch, and transferabil- ity. Extensive experiments show that IGSA significantly outperforms existing methods in robustness against diverse unknown disturbances on both image recognition and face recognition tasks. More- over, IGSA achieves strong transferability, making highly effective in black-box settings. One limitation of our current work is the use of a fixed mapping function l1 + 8) for disturbance sampling. Replacing it with a learnable module could further enhance the adaptability and effec- tiveness of the robust attack framework, which we leave for future exploration. We hope work inspires more research into generating adversarial examples that are both transferable and robust under real-world variations.

---

Published as a conference paper at ICLR 2026
6 ACKNOWLEDGEMENTS
This work is supported by the National Defense Basic Scientific Research Program of China (No. JCKY2026033044)) the Key RD Plan of Heilongjiang Province (No. 2022ZX0IC01), Natural Science Foundation of Heilongjiang Province of China (No. LH2024F023), the National Natural Science Foundation of China under Grant 62472128, and Grant 62172402.
REFERENCES
Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International conference machine learning, pp. 284-293. PMLR, 2018.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pp. 39-57. leee, 2017.
Bin Chen, Jiali Yin, Shukai Chen, Bohao Chen, and Ximeng Liu. An adaptive model ensemble adversarial attack for boosting adversarial transferability, Proceedings of the IEEE/CVF Inter- national Conference Computer Vision, pp. 4489-4498, 2023.
Minhao Cheng, Simranjit Singh, Patrick Chen, Pin-Yu Chen, Sijia Liu, and Cho-Jui Hsich. Sign-opt: A query-efficient hard-label adversarial attack. arXiv preprint arXiv:1909 10773, 2019.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter- free attacks. In International conference on machine learning, pp. 2206- 2216. PMLR, 2020.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scall scale hi- erarchical image database. In 2009 IEEE conference computer vision and pattern recognition, pp. 248-255 255.. leee, 2009.
Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafciriou. Areface: Additive angular margin loss for deep face recognition. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 4690-4699, 2019.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 9185-9193, 2018
Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversar- ial examples by translation-invariant attacks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 4312 2019.
Yinpeng Dong, Qi-An Fu, Xiao Yang, Tianyu Pang, Hang Su, Zihao Xiao, and Jun Zhu. Benchmark- ing adversarial robustness on image classification. In proceedings of the IEEF/CVF conference on computer vision and pattern recognition, pp. 321-331, 2020.
Yinpeng Dong, Shuyu Cheng, Tianyu Pang, Hang Su, and Jun Zhu. Query-efficient black-box adversarial attacks guided by a transfer-based prior. IEEE Transactions on Patfern Analysis and Machine Intelligence, 44( (4(12):9536-9544 2021.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition scale. arXiv preprint arXiv:2010.11929 2020.
Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M Roy. A study of the effect of jpg compression on adversarial images. arXiv preprint arXiv:1608 110.:116..00033,,, 2016.
Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks deep learning visual classification. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1625-1634, 2018
10

---

Published as a conference paper at ICLR 2026
William Feller. A direct proof of stirling's formula. The American Mathematical Monthly, 74(10): 1223-1225, 1967.
Zhijin Ge, Hongying Liu, Wang Xiaosen, Fanhua Shang, and Yuanyuan Liu. Boosting adversar- ial transferability by achieving flat local maxima. Advances in Neural Information Processing Systems, 36:70141-70161, 2023.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:14/2.65577 2014.
Xu Han, Anmin Liu, Chenxuan Yao, Yanbo Fan, and Kun He. cumpling-based fast gradient rescal- ing method for highly transferable adversarial attacks. arXiv preprint wrXiv:2307.02825 2023.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual net-
works. In Computer Vision-ECCV 2016: 14th European Conference, Amsterdam, The Nether- lands, October 11-14, 2016, Proceedings. Part IV 14, pp. 630-645 645. Springer, 2016.
Inpyo Hong and Sokjoon Lee. Exploring synergy of denoising and distillation: Novel method for efficient adversarial defense. Applied Sciences, 14(23); 2024.
Yu-Chih- Mn-CChi-TTuan Hu, Bo-Han Kung. Daniel Stanley Tan, Jun-Cheng Chen, Kai-Lung Hua, and Wen- Huang Cheng. Naturalistic physical adversarial patch for object detectors. In Proceedings of the IEEF/CVF international conference on computer vision, pp. 7848-7857, 2021.
Yi Huang and Adams Wii-Kin Kong. Transferable adversarial attack based on integrated gradients. arXiv preprint arXiv: 13155, 2022.
Yulun Jiang, Chen Liu, Zhichao Huang, Mathieu Salzmann, and Sabine Susstrunk. Towards sta- ble and efficient adversarial training against (.1 bounded adversarial attacks. In International Conference Machine Learning, pp. 15089-15104, PMLR, 2023.
Zhibo Jin, Zhiyu Zhu, Xinyi Wang, Jiayu Zhang, Jun Shen, and Huaming Chen. Danaa: Towards transferable attacks with double adversarial neuron attribution. In International Conference on Advanced Data Mining and Applications, pp. 456-470. Springer, 2023.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples the physical world. In Artificial intelligence safety and security, pp. 99-112. Chapman and Hall/CRC, 2018.
Klas Leino, Zifan Wang, and Matt Fredrikson. Globally-robust neural networks. In International Conference on Machine Learning, pp. 6212-6222. PMLR, 2021.
Jinhui Li, Dahao Xu, Yining Qin, and Xinyang Deng. A feature guided denoising network for adversarial defense. In 2022 IEEE International Conference on Unmanned Systems (ICUS), pp. 393-398. IEBE, 2022.
Qizhang Li, Yiwen Guo, Wangmeng Zuo, and Hao Chen. Improving adversarial transferability via intermediate-level perturbation decay. Advances in Neural Information Processing Systems, 36, 2024.
Chang Liu, Yinpeng Dong, Wenzhao Xiang, Xiao Yang, Hang Su, Jun Zhu, Yuefeng Chen, Yuan He, Hui Xue, and Shibao Zheng. A comprehensive study on robustness of image classification models: Benchmarking and rethinking. International Journal of Computer Vision, 133(2):567- 589, 2025.
Chen Liu, Mathieu Salzmann, Tao Lin, Ryota Tomioka, and Sabine Süsstrunk. On the loss landscape of adversarial training: Identifying challenges and how to overcome them. Advances in Neural Information Processing Systems, 33:2 23:21476-21487, 2020a.
Jiabao Liu, Qixiang Zhang, Kanghua Mo, Xiaoyu Xiang, Jin Li, Debin Cheng, Rui Gao, Beishui Liu, Kongyang Chen, and Guanjie Wei. An efficient adversarial example generation algorithm based on an accelerated gradient iterative fast gradient. Computer Standards & Interfaces, 82: 103612, 2022.
11

---

Published as a conference paper at ICLR 2026
Weitang Liu, Xiaoyun Wang. John Owens, and Yixuan Li. Energy-basee out disttiibuittittoonnnn detec- tion. Advances in neural information processing systems, 33:21464-21444 2020b.
Xuehu Liu, Zhixi Feng, Yue Ma, Shuyuan Yang, Zhihao Chang, and Licheng Jiao. D3r-net: De- noising diffusion-based defense restore network for adversarial defense remote sensing scene classification. IEEE Transactions on Geoscience and Remote Sensing, 2024.
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial exam- ples and black-box attacks. arXiv preprint arXiv: 2016.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, pp. 3730-3738, 2015.
Bo Luo, Yannan Liu, Lingxiao Wei, and Qiang Xu. Towards imperceptible and robust adversarial example attacks against neural networks. In Proceedings of the AAAI conference on artificial intelligence, volume 32, 2018.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. stat, 1050(9), 2017.
Jie Ning, Jiebao Sun, Shengzhu Shi, Zhichang Guo, Yao Li, Hongwei Li, and Boying Wu. Adver- sarial transferability in deep denoising models: Theoretical insights and robustness enhancement via out-of-distribution typical sampling. arXiv preprint arXiv:2412.05944 2024.
Nicolas Papernot, Patrick McDaniel, and lan Goodfellow. Transfcrability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint 2016.
Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference computer and communications security, pp. 506-519, 2017.
Yucheng Shi. Yahong Han, Qinghua Hu, Yi Yang, and Qi Tian. Query-efficient black-bor adver- sarial attack with customized iteration and sampling. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(2):2226 222222222255 2022.
Karen Simonyan. Very deep convolutional networks for large-scale image recognition. arXiv preprint 1409 2014.
Szegedy. Intriguing properties of neural networks. arXiv preprint arXiv: 1312.61 2013.
Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jon Shlens, and Zbigniew Wojna. Rethink- ing the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 28 2818-2826, 2016.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint 1eXXiv:705.002220 2017.
Jinwei Wang, Maoyuan Wang, Hao Wu, Bin Ma, and Xiangyang Luo. Improving transferability of adversarial attacks with gaussian gradient enhance momentum. In Chinese Conference Pattern Recognition and Computer Vision (PRCV), pp. 421-432. Springer, 2023.
Kunyu Wang, Xuanran He, Wenxuan Wang, and Xiaosen Wang. Boosting adversarial transfcrability by block shuffle and rotation. Proceedings of the IEFF/CVF Conference on Computer Vision and Pattern Recognition, pp.
2024a.
Maoyuan Wang, Jinwei Wang, Bin Ma, and Xiangyang Luo. Improving the transferability of adver- sarial examples through black-box feature attacks. Neurocomputing, 595:127863, 2024b.
Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 1924-1933, 2021.
12

---

Published as a conference paper at ICLR 2026
Xiaosen Wang. Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 16158-16167, 2021.
Weibin Wu, Yuxin Su, Xixian Chen, Shenglin Zhao, Irwin King, Michael R Lyu, and Yu-Wing Tai. Boosting the transferability of adversarial samples via attention. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 1161-1170, 2020.
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. arXiv preprini 171.:1111..0191120000
Cihang Xie, Zhishuai Zhang. Yuyin Zhou, Song Bai, Jianyu Wang. Zhou Ren, and Alan L. Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp.
2019.
Kaidi Xu, Gaoyuan Zhang. Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in a physical world. In Computer Vision-ECCO ECCC 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part V 16, pp. 661-681. Springer, 2020.
W Xu. Feature squeezing: Detecting adversarial exa mples in deep neural networks. arXiv preprint
arXiv:1704.01155, 2017.
Xiangyuan Yang, Jie Lin, Hanlin Zhang, Xinyu Yang, and Peng Zhao. Improving the transferability of adversarial examples via direction tuning. arXiv preprint arXiv:2303./5109, 2023.
Yaoyuan Zhang, Yu-an Tan, Tian Chen, Xinrui Liu, Quanxin Zhang, and Yuanzhang Li. Enhancing the transfcrability of adversarial examples with random patch. In IJCAI, pp. 1672-1678, 2022.
Jiamin Zheng, Yaoyuan Zhang, Yuanzhang Li, Shangbo Wu, and Xiao Yu. Towards evaluating the robustness of adversarial attacks against image scaling transformation. Chinese Journal of Electronics, 32(1):151-155 2023.
Hegui Zhu, Yuchen Ren, Xiaoyan Sui, Lianping Yang, and Wuming Jiang. Boosting adversarial transferability via gradient relevance attack. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pp. 4741 2023a.
Hong Zhu, Shengzhi Zhang, and Kai Chen. Ai-guardian: Defeating adversarial attacks using back- doors. In 2023 IEEE Symposium on Security and Privacy (SP), pp. 701-718. IEEE, 2023b.
Yao Zhu Yucfeng Chen, Xiaodan Li, Kejiang Chen, Yuan He. Xiang Tian, Bolun Zheng, Yaowu Chen, and Qingming Huang. Toward understanding and boosting adversarial transfcrability from distribution perspective. IEEE Transactions Image Processing, 31 31:6487-6501, 2022.
Junhua Zou, Yexin Duan, Boyu Li, Wu Zhang, Yu Pan, and Zhisong Pan. Making adversarial examples more transferable and indistinguishable. In Proceedings of the AAAI conference on artificial intelligence, volume 36, pp. 3662-3670, 2022.
13

---

Published as a conference paper at ICLR 2026
A PROOF OF THEOREMS
Theorem Let denote the dimensionality of the input space, and let be the number of samples drawn from ((0,r), r). Then, Egr,)((.r)) (E [lló 6-1 0- = -
Proof 1 We define the random variable [1/(de)) &- Z. and the random variable min Z1, .NN] as Y. We know that the volume of an m-dimensional hypersphere is given 21/2
by (r) = l(m//+1) rm A rm, where
l(m/2+1) Since ~ B r), the
="/a
probability density function is f(Ø) = (rVm(r). For Z, its cumulative distribution function is (2) (mm())/Vmm()) The probability density function fz, (2) is:
m 2
f2, = (#2)
(8)
pm
Thus, the cumulative distribution function of Y can be computed
Fv(2)= - P(Z y. Zz V .... ZN y)
II P(Z 8)
II Fz, (1))
Fz, (1))
Equation 9 holds because Z1, .N are independent. Therefore, we can compute the proba-
bility density function of Y as:
(v (v) n(1 Fz, (1)))=1
ym-1 f2.(v)
(10)
=n(1 - ( m pm
Now, we can compute the inner expectation in Theorem Tas:
Eg-B((.)) [11(60) - -0'10")"'1000) = [ (y(dd
(11)
f n(1 -( 1 mny-- m ym
Let = m7) where 0 < a < 1, then we have:
Ex,,(0.)) [1b(0)) 0-110=] //¹ n(1 -u) u)n-1 .ud(r um
=r.n n.
(1 u) 1n)=11 u u du
(12)
11
(1 - 1 du
r.
30
[(n)I( 1 +1)
T(n + 1 +1)
b ((a)T(b) I'a + b)" the equality holds.
By the Beta function: B(a,b) b) fo - x)a-1 111=))-11
Next, we consider the case when the sample size n large. By Stirling's approximation Feller
1967 T(x) R Viw (z)*, we express [(n) and [(n + 1 + 1) equation (12) as:
I(n) =Venn 3r)
n+
(13)
T(n + + 1) = 2T(n (n + + 1).
n +
+
14

---

Published as a conference paper at ICLR 2026
By the Gamma function: r( + +1 (1. + 1) I. equation 12 is transformed into:
[(n)T( L +
E B(.,)) [Ih(0) -5-1|0-
= n
m
[(n m +1
T nV 2Tn )=) ( + 1)
2n(n + 1)
71
=
+1 .r.
(n +
+
m
n"
1
T
m
(n +
1 1)
n +
n + +
m
(14)
at
(2) holds for when n to oo,
to +1)
+
From equation (14), we note that the inner expectation Bg,,((,)) of the position of X Therefore:
-x"1("""'(( is independent
Ex- Ep-00 - - =r
(15)
Theorem Let Oa be a convex function in a spherical neighborhood of radius centered at x + 6, with unique extremum point x x 5 + Then, the following relation holds: h(6) - Φ 7(0" - 6).
where the scalar coefficient 7 is given by (2+50+))
Proof 2 We start from the definition of h(()):
h(6) - o= (2
(16)
Since Ct is convex and has a unique extremum (minimum or maximum) at x + 8 6¹, we apply the first-order Taylor expansion of C' around 8 + o²
(x (xx+ V V 8 d*),
(17)
for some & on the line segment between and Φ" When r is sufficiently small, we can approximate:
(18)
which gives us:
0²).
(19)
Now consider the first-order Taylor expansion of C'd at 8
C'(x+++0) Cº ( + 80) 0³) + ollo (²11)
(20)
Because 6² is an extremum, the gradient at that point vanishes:
(x 0.
(21)
Substituting into Equation (20), we obtain:
C' C' - - 0²1).
(22)
15

---

Published as a conference paper at ICLR 2026
Next, for any direction d Rd with ||d]| 1, and for any small > 0, the local extremality implies:
C² + 8 + x0) 2 C² 5 + wd).
(23)
Expanding both sides using the Taylor approximation yields:
c' 2 (² + 8 + (V
(24)
Taking w + 0, this inequality must hold for all directions d, which implies that VoC + 8 + Φ)
collinear with 6* Φ. That is, there exists scalar 7 > 0 such that:
V.C + 8 Φ) 70 0).
(25)
Substituting this back into Equation (16), we get:
1(6) Ve 7 -))-
(26)
Theorem Let tr (-)) denote the trace of the Hessian matrix, and let B(0, r) represent uniform distribution over the bull of radius in R Then:
= (tr
Proof 3 Let VBm denote the volume of the neighborhood of the sample 8 (0, r).
(07(0.
/ VBm..
Egm (o(CCt)
V&PD)
Vo(Ct)T
VoP
B
1
Vo(C*)T
VsPpdo
VBm
V Ct Podo.
VBT.
I=1
B
Vo, Cr Vo, Podd, d6m-1
VBm
1=1 Bm
(27)
PDlß V C -
PD PD Cl ddm-1
VB
Bmn-1
1=1
m
(4)
PD V2, c'
Vgmm
Bo
PD ()
Vi(O.r)
J
- Le [tr(Hs(((1))
The equation holds due to the application of integration by parts. In the equation @ and represent the upper and lower bounds of the values of the element 6, within the neighborhood of 8mh respectively. When 8m is sufficiently small, the influence of 8; on Pp becomes negligible, i... (a)a) (b) x O. Therefore, the term PD -V x
Taking the gradient of both sides of equation 27 yields:
v,Pp] - -
(28)
Theorem 4 Let C² denote C²rr + 8). Suppose the Hessian H(C*) is bounded in the neighborhood of x such that [H|[**|| S L, the update rule satisfies:
VgE (x+ 100+++ V.C9 = v.C* 1 σ² 2
+ + + < 1/L
16

---

Published as a conference paper at ICLR 2026
Proof 4 Define:
-= +=st==++ro(tetto))
(29)
Expand & cx Φ) around 6:
V (=))) +
(30)
where HCC V2 6). and = Thus:
2 F -= (I+ H) V +
(31)
Expand (z) around 6:
(=(=) (3 (1) - 8).
-
(32)
Substitute 2 - (1 V.C":
=z) VV''' H + v + [[I H) V.C*T H)Φ+ VaC*l.
2
(33)
Take expectation E.I.]. using B[ń] = 0 and T Aø] = o²)r(A))
o tr (1) + 0
d²
E=(C" ~ C' + |V,2*1
(34)
2
Theorem For any conditional distribution (y) we have:
V V.Ey-N(y=))B =) Ey--Nol V. log(N(y12)))
Proof 5 For any conditional distribution.N(yy
V, / Fly) (ulx))d
V Velby-N(oss
/ F(v) V=N(ul=)dy
/ F(U) N()22)
N(ulz). V.N(ul=)dy
(35)
/ NVwll)) Fly) V= ( V. log(<
Application of Theorem 5: To use Theorem 5, we let 2 = x + 8. y = + d +
and Fly) Cy + (y)), then we have: VgE, (C + Volog 6 or +
0 VoC*]] ~
B SUPPLEMENTARY EXPERIMENTS
B. EXPERIMENTS DETAILS
Details of the attack methods. All transfer attack baseline methods are from the TransferAttack li- brary (https: / hub.. cww/Trusttwrreeeeeeoooooooooo
Physical world attacks, such RP2 Eykholt et al. (2018), VMI-FGSM Wang & He (221). AI-FGSM Zou ct al. 2022), used the open-source code from these papers.
Implementation Details for the face recognition task. We extracted the classification model (ResNet50 trained on CelebA) from the aggregation model buffalo./ for attacks. Similarly, we ex- tracted the classification model (MBF.Celebr) size and the number attack steps are set to 1 and 100, respectively. The attack is based on the aggregation model of the insightface framework the CelebA dataset. The classification model of
from the aggregation model buffalo_s. The batch
17

---

Published as a conference paper at ICLR 2026
Table Robustness of various attacks on the ImageNet dataset under additional additive and non- additive disturbances.
ASR (%)
VGG19
ResNet34
VIT
Disturbance Types
Additive CTRS
Non-additive PT
Additive CTRS
Non-additive PT
Additive CTRS
Non-additive
Attacks Types
BRT
BRT
BRT
RS
PT
PGD Madry
2017
85.4
91.7
43.8
0.0
70.8
6.3
63.5
74.9
10.1
MI MI-FGSMM Dong et ala 2018
91.7
97.9
72.9
10.4
83.3
91.7
16.7
0.0
79.2
79.2
29.5
9.2
Yang el
GRA Zhu et 20733
66.7
79.2
52.1
29.2
75.0
93.8
54.2
14.6
78.2
78.7
64.0
23.6
PGN Gr al
2025
37.5
54.2
14.6
62.5
72.9
20.8
10.4
66.9
63.2
54.9
24.9
SMI-FGRM
2203
72.9
95.8
16.7
87.5
87.5
25.0
6.3
73.1
74.4
51.5
16.5
DIM Xiè crai 2019
81.3
89.6
66.7
35.4
89.6
93.8
45.8
14.6
76.4
72.9
61.0
20.0
TIM
58.3
75.8
10,9
BSR Wang el 21245
85.4
89.6
83.3
14.6
77.1
81.3
79.2
8.3
83.3
76.3
91.2
16.4
Athalye
2018
95.8
[GSA (ours)
95.8
100.0
96.7
58.3
95.8
97.9
79.2
27.8
91.6
95.4
95.1
21.6
Table 7: Robustness of various untargeted attacks on ImageNet under additive disturbance.
ASR (%)
VGG19
ResNer34
ViT
Disturbance Types
GSB
CTRS
BRT
JPEG
GSB
CTRS
BRT
JPEG
GSB
CTRS
BRT
JPEG
Attacks Types
PGD Modry al.
2017
75.5
97.9
95.3
70.3
78.6
92.7
87.0
88.5
67.1
78.2
71.9
51.8
MI-FOSKI of 2018
89.1
97.9
98.4
74.5
97.9
97.4
92.2
77.1
79.6
81.5
85.9
68.8
DTA Yang et
91.1
98.4
98.4
71.4
97.4
95.8
94.3
77.1
78.9
79.6
88.1
71.4
GRA Ziu at al 20150
72.9
96.9
94.3
65.1
78.1
90.6
86.5
52.6
68.2
71.9
63.1
45.9
PGN
Ge GG
96.9
100.0
97.9
89.6
99.0
95.8
95.8
86.5
81.2
85.5
89.7
85.5
SMI-GG
2023
99.5
100.0
99.0
99.0
96.9
77.8
88.1
DIM Xie 2019
99.0
100.0
99.5
83.9
94.8
97.4
96.9
89.6
79.1
79.1
89.1
81.8
TIM Dang ar 2019
98.4
97.9
95.8
94.8
91.7
81.2
83.4
80.8
BSR
Wants ocal 20248
85.4
99.0
97.9
76.0
96.9
96.9
92.7
74.0
76.5
85.5
84.4
70.9
PGD+EOT Attaiye 2018
96.9
95.4
88.8
89.3
98.8
75.6
81.5
81.5
IGSA (OBrS)
99.5
100.0
99.5
93.2
99.0
99.0
99.5
91.7
89.6
91.1
91.2
90.2
this framework only outputs 512-dimensional features without performing classification. Therefore, we use pairwise as the loss function. An attack is considered effective when the cosine similarity between the original features and the attacked features is less than 0.4.
Implementation Details for Combinate IGSA with other transferable attack. To combine IGSA with DTA, we use momentum update to smooth the gradient during sampling. momentum decay factor is introduced to balance the influence of the current gradient and the previous gradients. To combine IGSA with ILPD, we integrate the hook function of ILPD during the forward propagation process. For example, in the Inception-v3 model, we use the hook function to obtain the output of the Inception-A A Block and combine with the original intermediate layer output through weighted summation. This allows the generated adversarial samples to have larger perturbation amplitude in the feature space and to be consistent with the target direction the attack, thereby improving the effectiveness of IGSA.
B.2 SUPPLEMENTARY EXPERIMENTAL RESULTS
B.2.1 EXPERIMENTS ON MORE DISTURBANCES
We introduced additional types of perturbations to the images: additive disturbances include contrast transformation (CTRS). which adjusts the grayscale contrast with a compression ratio of 25%. and brightness transformation (BRT), which uniformly modifies image brightness with compression ratio of 25%; non-additive disturbances include resizing transformation (RS) with a magnification factor of 1.25, and perspective transformation (PT) with distortion factor of 0.25. The results shown in Table
Furthermore, we test the ASR of untargeted attacks under additive and non-additive disturbances on the ImageNet dataset, respectively, as represented Table 7 and Table g Compared with the tar- geted setting, various attacks more robust under the untargeted setting. In additive disturbances settings, the standard deviation of GSB is increased to 3, the contrast is set to 5%, the brightness 5%, and the JPEG compression rate is set to 10%. In non-additive disturbance settings,
18

---

Published as conference paper at ICLR 2026
Table 8: Robustness of various untargeted attacks on ImageNet under non-additive disturbance.
ASR (5)
VGG19
ResNet34
Disturbance Types
RS
RT
PT
CB
RS
RT
PT
CB
RS
RT
PT
CB
Attacks Types
PGD Madry al. 2017
60.9
93.8
90.6
90.1
59.9
78.6
70.3
67.2
48.5
77.6
69.3
59.4
MI-FGSNI Dong al.
2018
74.0
94.3
94.3
95.3
73.4
91.1
87.5
84,9
59.4
85.8
85.5
73.4
Yang 20253
89.6
GRA ZnD
60.9
88.0
87.5
90.1
57.8
72.9
67.2
68.8
45.9
70,9
64.1
59.8
PON GD al. 20251
85.4
97.9
94.8
100.0
77.1
94.8
93.8
95.8
73.0
89.6
89.6
79.6
SMI-FGRM Han ctal. 2025
84.4
96.4
100.0
97.4
91.7
96.9
76.1
89.2
90.7
78.9
DIM
85.9
94.8
83,9
96,4
91.1
98.4
74.0
87.7
84.9
71.1
TIM Dong aral. 2019
87.5
95.8
93.8
96.9
83.9
90.6
92.7
91.7
73.5
87.5
86.5
69.1
BSR Wang el 20240
76.0
99.0
92.7
99.0
80.2
99.5
94.8
97.9
78.7
90.1
88.4
78.2
PGD+EOTT Athallya
2018
87.5
92.7
81.3
IGSA (ours)
88.5
99.0
96.4
100.0
83,9
97.9
95.3
98.4
82.9
91.2
91.1
89.8
the image scaling factor is 0.5, the rotation angle is set to 45 degrees, and the perspective distortion coefficient is set to 0.75. The experimental results show that in the untargeted attack experiments, the proposed IGSA is more robust than other attacks under various unknown disturbances.
Table 9: Robustness of various untargeted attacks CIFAR-10 under additive disturbance.
ASR (8)
VGG19
ResNet34
ViT
Disturbance Types
GSB
CTRS
BRT
JPEG
GSB
CTRS
BRT
JPBG
GSB
CTRS
BRT
JPEG
Attacks Types
PGD Madry
2017
90.6
90.6
90.6
89.8
74.2
84.4
89.1
73.3
61.7
78.4
68.4
35.0
MI LGSn et 2018
93.8
90.6
90.6
90.6
79.7
85.9
90.6
65.6
74.5
79.6
69.2
54.2
DTA Yang el
GRA Zhu 20255
90.6
90.6
89.1
90.6
82.8
85.9
92.2
71.9
76.1
80.8
67.6
52.6
PGN 1 2113
93.0
90.6
93.0
92.2
75.0
84.4
92.2
59.4
76.1
81.2
70.8
55.8
SMI-FGRM
2023
93.8
90.6
91.4
90.6
84.4
88.3
65.6
73.0
74.5
54.2
DIM Xiè el 2019
98.4
90.6
93.8
93.8
87.5
80.5
86.7
73.3
80.8
76.0
79.2
62.5
TIM al. 2019
94.5
89.8
93.0
60.5
BSR
Wain 20244
93.8
89.8
90.6
91.4
74.2
84.4
88.3
66.4
79.2
76.1
76.0
41.7
IGSA (DUTS)
100.0
91.4
93.8
95.0
90.6
86.7
95.0
80.5
87.3
86.7
84.3
69.0
Table 10: Robustness of various untargeted attacks on CIFAR-10 under non-additive disturbance.
ASR (%t
VGG19
ResNer34
Disturbance Types +
RS
RT
PT
CB
RS
RT
PT
CB
RS
RT
PT
CB
Attacks Types
PGD Madry al. 2017
90.6
84.4
87.5
87.5
70.0
73.4
80.0
76.7
41.7
63.6
68.4
71.7
2018
87.5
93.8
87.5
93.8
60.9
75.0
73.4
84,4
55.8
69.8
77.6
80.8
DTA
Yang et al
2023
89.1
84.4
93.8
90.6
64.1
73.4
90.6
84.4
56.5
69.8
79.3
82.3
Zhu 212.0
87.5
90.8
80.3
PGN
89.1
95.3
93.0
89.1
64.1
71.9
84.4
85.9
58.9
71.4
79.2
88.6
SML-FGKM Faam 2023
90.6
93.8
93.8
87.5
64.1
78.1
82.8
85.9
57.4
66.7
80.8
$7.0
DIM eie 2019
89.8
93.8
91.4
91.4
68.8
76.6
85.9
89.1
62.0
69.8
77.6
87.8
TIM Dong
73.4
92.2
68.3
80.0
BSR
Wang 20246
87.5
91.4
90.6
88.3
64.1
73.4
71.9
81.3
57.3
63.6
79.2
82.3
IGSA (ours)
95.3
95.3
100.0
100.0
71.9
78.1
90.6
92.2
64.1
73.7
84.8
89.7
B.2.2 EXPERIMENTS ON THE CIFAR-10 DATASET
We conduct extended experiments on the CIFAR1O dataset. the untargeted attacks on CIFARIO under additive disturbance, shown in Table 9 IGSA reaches the highest ASR across different disturbance types for various models such as VGG19, ResNet34, and ViT-base. For instance, when dealing with JPEG compression in the VGG19 model, IGSA achieves ASR of 95.0%, far exceed- ing the values of other attacks. In the non-additive disturbance experiments for untargeted attacks on CIFARIO. 10, shown in Table 10, IGSA also shows remarkable robustness. It can achieve 100.0% ASR in some cases, such as for and CB in the VGG19 model. This indicates that IGSA can effectively resist significant image transformations without losing its attack ability. In the targeted
19

---

Published as a conference paper at ICLR 2026
attack scenarios CIFAR1O, whether it is under additive disturbance, shown in Table |I
non-additive disturbance, as shown Table IGSA again demonstrates its superiority.
Table 11: Robustness of various targeted attacks on CIFAR-10 under additive disturbance.
ASR (%)
VGG19
ResNet34
VIT
Disturbance Types +
GSB
CTRS
BRT
JPBG
GSB
CTRS
BRT
JPBG
GSB
CTRS
BRT
JPEG
Attacks Types
None
33.3
60.0
50.0
33.3
33.3
46.7
40.0
33.3
21.7
51.7
31.7
11.7
PGD Madry et 2017
23.3
43.3
33.3
53.3
60.0
73.3
83.3
63.4
88.4
81.7
88.4
68.4
MI-FGSM
23.4
40.6
40.6
30.8
60.8
75.0
29.2
52.5
71.4
63.4
20.9
DTA
Yang cl al.
2025
21.7
35.9
37.5
29.2
55.8
80.8
76.7
44.2
46.4
69.8
65.1
18.4
GRA Zho
20233
25.0
42.2
27.5
31.3
68.3
PGN Ce
20255
34.4
57.8
53.1
39.1
62.5
62.5
62.5
43.8
66.7
73.0
65,1
37.0
SMI-FGRM Han et 2023
20.0
50.0
40.8
29.2
48.4
61.7
71.9
43.8
65.1
71.4
68.3
40.1
XiM
2019
TIM
Dong
2019
23.4
48.4
43.8
26.6
30.0
82.5
80.0
32.5
33.9
77.6
79.2
24.0
BSR
Wang el al.
20245
46.9
56.3
59.4
46.9
69.2
74.2
74.2
31.3
54.2
69.8
29.2
IGSA
99.2
99.2
99.3
99.3
99.2
99.4
99.6
99.3
91.0
89.6
91.3
90.9
Table 12: Robustness of various targeted attacks on CIFAR-10 under non-additive disturbance.
ASR (%)
VGG19
ResNet34
VIT
Disturbance Types
RT
PT
RT
PT
RT
PT
Attacks Types 4
PGD Madry al. 2017
66.7
66.7
63.4
67.1
53.3
53.3
23.5
64.1
38.4
68.3
35.0
75.0
MI-FGSMI Dong el 2018
70.3
73.4
71.9
76.6
71.9
68.8
54.7
71.9
48.0
63.4
55.9
66.7
DTA Yang el ah 23
73.4
78.1
81.3
75.0
73.4
68.8
64.1
75.0
74.2
75.9
75.0
80.8
GRA Zhu ci 2123a
70.3
73.4
73.4
75.0
53.1
75.0
62.5
67.2
77.6
79,2
75.0
PGN
2005
64.1
60.9
64.1
68.8
50.0
58.9
77.6
68.3
77.6
SMI-FGRM Fan
22023
78.1
82.8
70.0
64.2
76.1
63.6
DIM Xie 2019
73.4
73.4
75.0
76.6
69.2
71.7
71.7
80.0
51.1
77.6
74.5
76.1
TIM
Dong
2019
67.2
73.4
71.9
73.4
56.3
60.9
70.3
64.1
78.4
74.2
74.2
80.0
BSR
Wang al. 20248
48.4
46.9
50.0
53.1
56.3
60.9
59.4
57.8
41.7
65.1
63.6
65.1
IGSA (ours)
87.5
93.8
87.5
93.8
85.9
93.8
89.1
87.5
81.2
77.6
79.1
85.5
Some recent works study how to generate adversarial perturbations for the physical world. Their adversarial samples remain effective under various disturbances in the physical world, such as reshooting, rotation, scaling, and brightness changes. In Table 13, we compare IGSA with the SOTA physical world attacks. The experiment is carried out using Inception-v3
the Cifar- 10 dataset under the setting of untargeted attacks. The experimental results show that IGSA achieves the best ASR without any prior knowledge about the disturbance.
B.2.3 COMPARISON WITH SRADIENT-BASER DISTURBANCE OPTIMIZERS IN THE SPACE
Setup. Recall that IGSA samples disturbances & Paist and refines them inside the attack loop. To address the concern that IGSA's advantage might be attributed merely to having gradients in the disturbance space, we compare against baselines that also explicitly update using white-box gradients, while keeping all other budgets strictly matched. We consider a generic differentiable disturbance operator (=(-) with admissible set (e.g., & = r( for additive disturbances, or bounded parameter range for non-additive transforms). For each outer iteration, we keep the current perturbation and update using a Monte-Carlo estimate under refined disturbance samples (dx N
Baselines. Given sampled o; Paists each baseline produces refined & and then updates ō via the averaged gradient under {T a. Concretely, the update takes the standard EOT form:
N
11 sign
V. (1+))))))
(36)
where C²(-) is the targeted loss and IT denotes projection.
20

---

Published as a conference paper at ICLR 2026
Table 13: Robustness of physical-world attacks the CIFAR-10 dataset under disturbances.
ASR (%)
additional
non-udditional
Disturhance Types
RS
RT
PT
CB
GSB
CTRS
BRT
JPEG
Attacks Types
RPA Zhang et 2022
75.0
72.9
83.3
85.4
79.2
81.3
85.4
VMI-FGSM
He 2022
80.5
50.0
50.0
88.9
77.8
80.5
80.5
86.1
AI-FGSM Zou et
86.0
89.0
88.0
77.0
80.0
77.0
79.0
77.0
AutoAutack Crnze & Hem 4020
59.2
93.9
92.1
47.0
67.4
65.3
67.3
63.3
ILPD Li Li al. A044
39.0
25.0
24.5
28.6
24.5
26.6
40.7
28.6
TAIG Huang & Kong 2022
90.9
92.1
67.4
71.2
80.0
77.6
77.6
IGSA (ours)
94.6
97.9
98.5
97.9
87.5
95.8
91.7
97.9
(1) PGD-ø. This is the most direct gradient-ascent baseline the disturbance space, updating ø to increase the loss value:
6, = 1I (0: 3 (v 5))))
(37)
(2) SIM-6. This baseline applies a local smoothing operator S(.) to the disturbance gradient before the sign step:
I& ( + B (S(V (g(T),
(38)
In our implementation, S is deterministic low-pass filtering on the gradient tensor (thus not intro- ducing additional forward/backward evaluations).
(3) TIM-Ø. This baseline applies a deterministic linear operator T(-) (e.g., conslation-invariian filter) to the disturbance gradient:
Φ. Il (0: + sign (TVV +6))))
(39)
where T is also applied as post-processing step on gradients and does not require extra model evaluations.
Budget matching protocol. All methods in this subsection use the same perturbation budget c, the same outer iterations, the same number of disturbance samples N per outer step, and matched step sizes for updates. For SIM-ø and TIM-2, the operators and are implemented as deter- ministic filtering on the computed gradients, so their total number of forward/backwart evaluations identical to PGD-ø and IGSA under the same (N, outer steps) configuration.
Results on ImageNet under combined disturbances. Table reports the targeted ASR under the same ImageNet setting as the main paper (GSB/JPEG/RT/CCB averaged over the four distur- bances). Despite having identical gradient access in the & space, gradient-ascen baselines remain clearly weaker than IGSA.
Table 14: ImageNet targeted ASR (%) under equal budgets for gradient-based é-optimizers (aver- aged over GSB/IPEG/RT/CB)
Method
Gradient Φ?
ASR (%)
PGD-6
61.4
SIM-Ø
63.8
TIM-6
64.2
IGSA (ours)
71.9
Takeaway. These results indicate that gradient access in the disturbance space alone does not ex- plain the gain of IGSA. Instead, IGSA's improvement comes from its specific refinement mechanism (distributional contraction toward locally most destructive regions), rather than simply maximizing O with respect Φ
21

---

Published as a conference paper at ICLR 2026
B.2.4 VISUAL COMPARISON OF ADVERSARIAL SAMPLES
In Figure 5, we present the adversarial samples generated by various attacks and the performance of these adversarial samples after being subjected to combined disturbances. It can be seen that under the same perturbation intensity, which is uniformly set to 8/ 8/255, the adversarial perturbations of IGSA are less noticeable than those of other methods. This endows the adversarial samples of IGSA with stronger stealthiness.
Original image
Adversarial image
Additive trans.
Non-additive trans.
AKIA
AWA
AWAR
MI-FGSM
ASR: 100.0%
ASR: 84.4%
ASR: 43.2%
AWAAT
AWA
AWAR
SMI-FGRM
ASR: 100.0%
ASR: 57.4%
ASR: 36.2%
AWAI
AWA
AWA
DIM
ASR: 100.0%
ASR: 86.0%
ASSR: 62.8%
IGSA (ours)
ASR: 100.0%
ASR: 94. 9.
ASR: 70.7%
Figure 5: Qualitative analysis on the CelebA dataset under additive and non-additive disturbance.
C THEORETICAL EXTENSION FOR NON-CONVEX CONDITIONS
In this section, extend Theorem 2 to non-convex loss landscapes. As noted by Liu et al. (2020a), adversarially trained models may converge to sharper minima, which makes local convexity a strong assumption. We provide generalized theorem and experimental verification.
22

---

Published as a conference paper at ICLR 2026
Original image
Adversarial image
Additive trans.
Non-additive trans.
MI-FGSM
ASR: 100.0%
ASR: 62.5%
ASR: 0.0%
SMI-FGRM
ASR: 100.0%
ASR: 62.5%
ASR: 12.5%
DIM
ASR: 100.0%
ASR: 75.0%
ASR: 29.2%
IGSA (ours)
ASR: 100.0%
ASR: 95.8%
ASR: 35.4%
Figure 6: Qualitative analysis on the ImageNet dataset under additive and non-additive disturbance.
C.I GENERALIZED THEOREM FOR NON-CONVEX LANDSCAPES
Theorem (Revised Theorem 2: Non-Convex Case) Let d' be local extremun point in the neighborhood B(0,r). For a sampled disturbance & B(0,r), r), define the angle 0g between the gradient and the extremum direction as:
(V.C (I + 8 + o), o" Φ)
cos 0g
V 1000 Φ1
Then the IGS update satisfies:
(b(0) 0- = 110 001 / 2n cos Og + 172
where = V 1 - Q1. Moreover, when cos 0gg > n/2, /2, we have [|](0) - - < 1 Φ*||
Proof Starting from the definition (())) = V.C
[h(() xz 21 || कه V ه| 331 2 Φ" VOC²) |
23

---

Published as a conference paper at ICLR 2026
Substituting the inner product relation:
(Φ - Φ V VOC") = - - || cos
obtain:
(1((6) - 60 1| = | xz 11 21, cos 02 + +1²).
Taking square roots gives the main result. The inequality (T((() 6 < - --'1 holds when:
2nj cos 0g + r/ < = cos 0g
1/ 1/2.
Remark 6 Theorem 6 shows that IGS still reduces distance to ø' when the gradient direction is
sufficiently aligned with o² - (cos 0g > n/2).. This condition holds frequently in practice (verified below), making IGS effective even in non-convex landscapes.
C.2 EXPERIMENTAL VERIFICATION OF cos 0g DISTRIBUTION
We empirically measured cos 0g using adversarially trained models on CIFAR-10 and ImageNet datasets:
CIFAR-10: ResNet-50 model trained with PGD adversarial training (oo-m 8/255)
ImageNet: ResNet-152 model trained with TRADES adversarial training (o -norm, c = 4/ 255)
For each dataset, we randomly selected 1000 samples. To find local extrema in non-convex landscapes, we initialized 5 random points within ((0,r)) r), performed 1000-step gradient descent from each starting point, and selected the 6² achieving the highest C value. We then computed:
cos Os V 10- -
Results in Table 15 show:
Table 15: Distribution of cos 0g adversarially trained models
Dataset
Model
Elcos
P(cos 0g n1/2)
CIFAR-10
ResNet-50
0.68 0.72
92.7%
ImageNet
ResNet- 152
94.1%
C.3 EFFICIENCY RATIO ANALYSIS
The efficiency ratio between EOT and IGS under non-convex conditions is:
ABoo
[ [[)))()) 6"
(40)
TIGS
EllØ - 6z 11
proof:
From Theorem 1, the expected approximation eтror for a sampling method decreases as n 1/m where n is the number of samples. Specifically for EOT:
E - 6"1l < e nooT
1/m
where is a constant depending on the dimension m. Similarly for IGS:
E [1(()) 10 S c naas
-1mm
To achieve the same error bound e, we set:
[l) - 6²'l
1/m
C 7BOOT
=E=
Ello d*1
14GS
24

---

Published as a conference paper at ICLR 2026
Solving for the ratio:
E [ Ø-)
1/m
1/m
PIGS
E 6-1
RgoT
E [ 6011
-m
THGS
E Ø - 001
Calculation for CIFAR-10:
Using experimental mean values 17 8.2 10 and E|cos 8g] 0.68:
( 6"'l
n/|cos = 0.005576 = 0.994424
Blll
61
For input dimension m = 32 x 32 x 3- 3072:
#HOT = (0.994424) 3072 = 2.88 x 10"
TAGS
Remark 5 Eq. equation 40 shows IGS maintains exponential efficiency gains (~ (1- 1f cos 0) )m) even without convexity. The alignment term cos A plays a crucial role: better gradient alignment (higher cos 0o) leads greater efficiency gains.
C.4 EXPERIMENTAL EFFICIENCY COMPARISON
Table 16 compares IGS and EOT on adversarially trained ImageNet models (ResNet-152 with TRADES training) at 95% attack success rate (ASR) threshold:
Table 16: Attack Success Rate (ASR) comparison on adversarially trained ImageNet models
Method
ASR @ 20 samples
ASR
100 samples
Samples to 95% ASR
EOT
34.2%
78.5%
320
IGS (ours)
89.7 %
98.3 %
15
Our analysis demonstrates that: (1) Under non-convex conditions, IGS reduces || Φ*1 when cos fg > 7/2 (validated for 792% of samples across datasets); (2) The efficiency ratio nsoor / /Tıss scales exponentially with dimension m, preserving IGS's sampling advantage; and (3) Practical efficiency gains (21x ImageNet) remain substantial despite theoretical-empiriaal gaps. These results confirm IGS effectively addresses limited sampling coverage, even for adversarially trained models with non-convex loss landscapes. The observed efficiency gap (theoretical 10" practical 21 x) stems from non-global extrema, sampling correlation, and gradient estimation errors, yet IGS maintains significant practical advantages.
D ANALYSIS OF FEATURE-SPACE STABILITY
Typical classification models can be decomposed into a two-stage process: feature embedding fol- lowed by classification. The feature embedding stage captures common features across similar images. Images sharing semantic content (such as an image before and after transformations) ex- hibit similar feature representations in the embedding space. This property enables natural images to maintain consistent classification results under various image transformations.
However, adversarial samples typically deviate from the natural data distribution. Their feature rep- resentations exhibit significant variation under image transformations, leading to the failure of ad- versarial attacks. The proposed IGSA addresses this limitation by enforcing feature-space stability. It ensures that adversarial samples maintain similar feature representations under image transfor- mations, thereby preserving their adversarial efficacy. Next, we provide formal explanation and experimental validation.
25

---

Published as a conference paper at ICLR 2026
D.1 FORMAL DEFINITIONS
Let ʃ : + RR* be a classifier decomposed into: f(x) = c({(x))
(41)
where I Id is the feature extractor and IR + R* is the classifier head.
For natural images x ~ Pp and transformation T, we observe:
||e(x) - e(T()))]l S ET
(42)
where er quantifies the model's inherent transformation tolerance. Traditional adversarial examples Tadv exhibit:
[e((aad) - ((T (Iaav)))l > CT
(43)
due to their deviation from Pp. contrast, IGSA enhances the stability of adversarial examples in the feature space by increasing their likelihood within the data distribution Pp:
( (=(V()=))))))))))))))) eg.
(44)
We provide the following experimental verification.
D.2
EXPERIMENTAL VALIDATION
D.2.1
FEATURE DISTANCE ANALYSIS
Table 17: Feature Space Displacement Under Transformations
Attack
Blur
Noise
JPEG
Brightness
PGD
18.7
22.3
15.2
12.6
EOT
14.1
17.5
11.8
9.3
IGSA (ours)
6.8
8.4
5.1
4.7
Our experiments demonstrate IGSA's superior stability across transformations. Quantitative analysis using ResNet-500s penultimate layer features shows IGSA achieves 63-73% reduction in feature displacement (Areat [[e(z) e(T((z))l2) compared to PGD and 52-58% reduction versus EOT, with final displacements (Areat ~ 4.7 - 8.4) approaching natural image variation levels (er & 4.2). This confirms IGSA's success in maintaining feature-space consistency under perturbations.
26


Reviews:
[{"review_id": "YJXcwKGcq1", "reviewer": "Reviewer_KBuh", "summary": "This paper proposes an adversarial attack framework called Inverse Gradient Sample-based Attack (IGSA) to generate robust adversarial examples that remain effective under unknown disturbances such as noise, transformations, and compression.\nThe method iteratively samples disturbances using inverse gradient sampling to find the most destructive perturbation direction, and then refines adversarial examples through disturbance-guided gradient updates.\nThe authors provide theoretical analyses showing that IGSA improves sampling efficiency exponentially compared to the conventional Expectation over Transformation (EOT) approach, and that it implicitly aligns adversarial examples with the natural data distribution, enhancing robustness and transferability.\nExtensive experiments on CIFAR-10, ImageNet, and CelebA demonstrate that IGSA significantly outperforms state-of-the-art attacks in both robustness and transferability, even against adversarially trained models.", "questions": "1. What can robust adversarial examples be used for? Beyond demonstrating attack robustness, how could they contribute to improving or evaluating model robustness in practice?\n2. Do the authors have any ideas for accelerating IGSA? For instance, could there be a trade-off analysis between robustness and generation speed, or a possible approximation that maintains robustness with reduced computational cost?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The problem setting of generating robust adversarial examples is interesting and meaningful, especially for understanding the vulnerability of models under real-world perturbations.\n- The paper includes theoretical analyses that provide a credible explanation of why the proposed method improves robustness and efficiency.\n- The experimental evaluation is comprehensive, covering multiple datasets, model architectures, and defense settings, which makes the results reliable.", "weaknesses": "- It is unclear what robust adversarial examples are useful for. The paper emphasizes generating stronger attacks, but it does not clearly discuss potential downstream applications, such as improving model robustness or evaluating defense strategies.\n- The proposed IGSA method appears to be computationally expensive (e.g., 0.423s (ISGA) vs 0.186s (VDA) in Table 1). Adversarial examples are mainly used to improve model robustness through adversarial training, where generating a large number of examples quickly is important. In this sense, faster generation could be more desirable, even at some cost to robustness.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Q3QgLifwye", "reviewer": "Reviewer_5uoS", "summary": "The paper proposes Inverse Gradient Sample-based Attack (IGSA), a robust adversarial attack method that maintains effectiveness under various unknown disturbances such as blur, rotation, and compression.\nThe main claim is that existing attack methods are less robust against unknown disturbance distributions; therefore, IGSA aims to design a transferable, imperceptible, and disturbance-robust attack framework. \nIGSA iteratively samples disturbance directions via inverse gradient steps and refines adversarial examples to resist these perturbations.\nThe approach extends the EOT framework with a theoretically motivated sampling rule, claiming improved efficiency and higher data likelihood of adversarial examples.\nExtensive experiments on CIFAR-10, ImageNet, and CelebA show superior robustness and transferability compared to existing attacks.", "questions": "1. Could the authors clearly define what is meant by “disturbance” and specify whether it refers to data corruption, augmentation, or domain shift in the introduction section? Providing this definition early on would enhance clarity and readability.\n2. The paper reports both targeted and non-targeted results, but the discussion primarily focuses on targeted attacks, where IGSA performs better. Could the authors clarify why targeted attacks are emphasized, and how the relatively weaker non-targeted results should be interpreted in terms of transferability?\n3. What is the underlying reason that inverse gradient sampling improves transferability? Is it related to smoother loss landscapes, gradient alignment, or increased data likelihood?\n4. The paper claims imperceptibility as one of the main goals, but no quantitative evaluation or perceptual metric is provided in the main text. Are there plans to include such analysis or measurements?\n5. Could the method be reformulated with KL divergence to extend IGSA beyond classification tasks such as dense prediction? This reformulation could significantly enhance the impact and generality of the proposed approach.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 2, "strengths": "1. The paper clearly motivates the problem by highlighting that existing transfer-based attacks easily fail under unseen disturbances, and explicitly defines robustness as a key missing property.\n2. The presentation is very well-structured and easy to follow, with a logical flow from framework to theoretical analysis to experiments.\n3. Theoretical formulations are sound, and the analysis of inverse gradient sampling provides a quantitative comparison to EOT in terms of sampling efficiency.\n4. Experiments are extensive, covering multiple datasets, diverse disturbance types, and both white-box and black-box settings, along with detailed ablations and hyperparameter studies.\n5. Empirical results consistently show strong improvements, with IGSA maintaining high success rates and transferability even under adversarial defenses.", "weaknesses": "1. Limited conceptual novelty. The proposed Inverse Gradient Sampling (IGS) is presented as a new sampling mechanism, but in practice it closely resembles a single-step gradient ascent in disturbance space. The method can be seen as a localized refinement of existing gradient-based attacks (e.g., EOT or PGD) rather than a fundamentally new paradigm. While the paper’s formulation is mathematically elegant, the conceptual contribution feels incremental unless the authors can demonstrate that IGS leads to qualitatively different optimization behavior or transfer dynamics. \n2. Restrictive theoretical assumptions. The theoretical analysis assumes convexity and smoothness of the loss surface, conditions that rarely hold for deep neural networks. As a result, the convergence guarantees and efficiency bounds provided may not translate to realistic, highly non-convex settings. Moreover, the paper does not discuss convergence stability or potential divergence behaviors of the inverse gradient iteration—an important aspect since the attack involves repeated optimization in disturbance space. Without such analysis or empirical evidence of stability, the theoretical claims remain limited in scope. \n3. Weak empirical support for the data-likelihood claim. The paper claims that IGS improves the data likelihood of adversarial examples, suggesting that they align more closely with the natural image distribution. However, this claim is supported only by a single energy-based OOD metric, which provides an indirect and limited view of sample realism. More robust probabilistic analyses, such as likelihood ratio estimation, diffusion-based density approximations, or human perceptual validation, would be necessary to substantiate the connection between IGS and likelihood improvement. \n4. Insufficient implementation transparency. The paper provides limited discussion on the comparability of experimental settings across baselines. Key factors such as the number of iterations, query budgets, and perturbation strengths directly affect attack success rates, yet their parity across methods is not explicitly guaranteed. Without clear evidence that all methods were evaluated under identical resource and constraint settings, it becomes difficult to attribute improvements solely to IGSA’s algorithmic design. This omission undermines the reliability and fairness of the reported results. \n5. Incomplete baseline coverage and unclear relation to domain generalization. While IGSA aims to improve robustness under disturbances, this goal conceptually overlaps with domain generalization (DG) problems, where models are trained or evaluated under distribution shifts. However, the paper does not clarify whether disturbances are treated as domain shifts or as stochastic corruptions, leaving the problem setting somewhat ambiguous. Additionally, several recent robustness-oriented attacks and defenses addressing distributional shift are not included in the experimental comparison. The lack of both conceptual positioning and comprehensive baselines weakens the empirical credibility of the paper’s main claims.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CJN70SBqtG", "reviewer": "Reviewer_6pSC", "summary": "The paper proposes the Inverse Gradient Sample-based Attack (IGSA), a novel adversarial attack framework designed to enhance the robustness of adversarial examples against unknown disturbances while improving their transferability in black-box settings. The method iteratively samples disturbances and optimizes adversarial examples under these disturbances, demonstrating strong performance across multiple benchmarks.", "questions": "The authors summarize the challenges as limited sampling coverage, distribution mismatch, and transferability considerations. While the method and experiments show clear improvements, it would be helpful to clarify why these three challenges are the most critical in the context of robust adversarial attacks, and whether other potential challenges (e.g., computational cost, semantic preservation) were considered.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1、 Experiments reveal that adversarial examples generated by IGSA exhibit a significantly larger robustness boundary compared to existing methods, indicating superior resistance to a variety of disturbances.\n\n2、The paper provides extensive experiments on multiple datasets (e.g., ImageNet, CIFAR-10, CelebA) and model architectures (e.g., VGG, ResNet, ViT), thoroughly validating the effectiveness of IGSA under both additive and non-additive disturbances.\n\n3、Theoretical analysis is provided to support the claims, including efficiency gains over EOT and the relationship between data likelihood and robustness.\n\n4、IGSA not only improves robustness but also enhances the transferability of adversarial examples, making it highly applicable in practical black-box attack scenarios.", "weaknesses": "1、The theoretical results, while valuable, are presented in a highly mathematical form without intuitive explanations. For broader accessibility, the authors should provide more intuitive descriptions or visual illustrations of the key theorems (e.g., Theorems 1–4).\n\n2、Algorithm 1 is presented without sufficient explanation in the main body. The authors should describe its key steps, hyperparameters, and how it integrates into the overall IGSA framework.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "5QwsUCwoRD", "reviewer": "Reviewer_mtxc", "summary": "This paper proposes Inverse Gradient Sample-based Attack (IGSA), which can generates adversarial examples that remain effective under diverse unknown disturbances. The authors theoretically analyze how inverse gradient sampling improves sampling coverage and transferability of adversarial examples. Through experiments, the authors demonstrate that IGSA outperforms other adversarial attack baselines under disturbances.", "questions": "1. How many sampling points does EOT needs to reach the similar attack success rate of IGSA?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. Propose a novel gradient-based method to enhance the robustness of adversarial examples\n2. Provide theoretical analysis on the efficiency of the proposed method compared to EOT\n3. Experiments show that the adversarial examples generated by proposed method are robust to unknown disturbances and are transferable across different networks", "weaknesses": "**1. Trivial theoretical solution:** The authors theoretically analyze the efficiency of IGS and EOT. However, IGS utilizes the gradient information, while EOT is a black-box method. Therefore, the theoretical solution that IGS is more efficient than EOT is not surprising. It would be better that you could compare IGS with a white-box baseline.\n\n**2. Adversarial training:** It would be interesting to adopt IGSA in adversarial training, and see whether the trained model is robust to different attacks, including IGSA.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)