Deep learning models are known to be vulnerable to adversarial examples
crafted by adding human-imperceptible perturbations on benign images. Many
existing adversarial attack methods have achieved great white-box attack
performance, but exhibit low transferability when attacking other models.
Various momentum iterative gradient-based methods are shown to be effective to
improve the adversarial transferability. In what follows, we propose an
enhanced momentum iterative gradient-based method to further enhance the
adversarial transferability. Specifically, instead of only accumulating the
gradient during the iterative process, we additionally accumulate the average
gradient of the data points sampled in the gradient direction of the previous
iteration so as to stabilize the update direction and escape from poor local
maxima. Extensive experiments on the standard ImageNet dataset demonstrate that
our method could improve the adversarial transferability of momentum-based
methods by a large margin of 11.1% on average. Moreover, by incorporating with
various input transformation methods, the adversarial transferability could be
further improved significantly. We also attack several extra advanced defense
models under the ensemble-model setting, and the enhancements are remarkable
with at least 7.8% on average.

本文提出了一种增强的动量迭代梯度法，通过将先前迭代中梯度方向的数据点采样的平均梯度积累，稳定更新方向并逃离局部最大值，有效提高了动量迭代梯度法的对抗迁移性能，进一步结合各种输入转换方法可显著提升对抗迁移性能，实验证明平均提高 11.1%。同时，在集成模型设置下攻击多种尝试性高的防御模型，达到 7.8% 的显著提高。