# Boosting Adversarial Attacks with Momentum

arXiv: https://arxiv.org/abs/1710.06081 · HTML: https://mlsanity.com/paper/1710.06081/

## Key facts

- Cited by 24 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Oct 2017.

## Built on by (most cited first, 24 of 24)

- [Unleashing the Power of Visual Prompting At the Pixel Level](https://mlsanity.com/paper/2212.10556/) (2022)
- [Boosting the Transferability of Adversarial Attacks with Global Momentum Initialization](https://mlsanity.com/paper/2211.11236/) (2022)
- [Benchmarking Safety Monitors for Image Classifiers with Machine Learning](https://mlsanity.com/paper/2110.01232/) (2021)
- [Proving Common Mechanisms Shared by Twelve Methods of Boosting Adversarial Transferability](https://mlsanity.com/paper/2207.11694/) (2022)
- [A Tale of Two Models: Constructing Evasive Attacks on Edge Models](https://mlsanity.com/paper/2204.10933/) (2022)
- [Adversarial Pixel Restoration as a Pretext Task for Transferable Perturbations](https://mlsanity.com/paper/2207.08803/) (2022)
- [Improving Visual Quality of Unrestricted Adversarial Examples with Wavelet-VAE](https://mlsanity.com/paper/2108.11032/) (2021)
- [Sensor Data Validation and Driving Safety in Autonomous Driving Systems](https://mlsanity.com/paper/2203.16130/) (2022)
- [TrojanTO: Action-Level Backdoor Attacks against Trajectory Optimization Models](https://mlsanity.com/paper/2506.12815/) (2025)
- [Towards Transferable Defense Against Malicious Image Edits](https://mlsanity.com/paper/2512.14341/) (2025)
- [Deep adversarial attack on target detection systems](https://mlsanity.com/paper/2108.05948/) (2021)
- [Efficient Image-to-Image Diffusion Classifier for Adversarial Robustness](https://mlsanity.com/paper/2408.08502/) (2024)
- [Mitigating Adversarial Attacks by Distributing Different Copies to Different Users](https://mlsanity.com/paper/2111.15160/) (2021)
- [Improving Neural ODEs via Knowledge Distillation](https://mlsanity.com/paper/2203.05103/) (2022)
- [Explainability-Driven Leaf Disease Classification Using Adversarial Training and Knowledge Distillation](https://mlsanity.com/paper/2401.00334/) (2023)
- [Towards Adaptive Meta-Gradient Adversarial Examples for Visual Tracking](https://mlsanity.com/paper/2505.08999/) (2025)
- [Ensemble-in-One: Learning Ensemble within Random Gated Networks for Enhanced Adversarial Robustness](https://mlsanity.com/paper/2103.14795/) (2021)
- [Adversarial examples attack based on random warm restart mechanism and improved Nesterov momentum](https://mlsanity.com/paper/2105.05029/) (2021)
- [Measuring Equality in Machine Learning Security Defenses: A Case Study in Speech Recognition](https://mlsanity.com/paper/2302.08973/) (2023)
- [Improving Adversarial Transferability with Neighbourhood Gradient Information](https://mlsanity.com/paper/2408.05745/) (2024)
- [Latent Danger Zone: Distilling Unified Attention for Cross-Architecture Black-box Attacks](https://mlsanity.com/paper/2509.19044/) (2025)
- [Fine-Grained Iterative Adversarial Attacks with Limited Computation Budget](https://mlsanity.com/paper/2510.26981/) (2025)
- [Enhancing Adversarial Transferability through Block Stretch and Shrink](https://mlsanity.com/paper/2511.17688/) (2025)
- [TAPDreamer: Transferable Adversarial Patches for World Action Models](https://mlsanity.com/paper/2610.06814/) (2026)

## Abstract (arXiv)

Deep neural networks are vulnerable to adversarial examples, which poses security concerns on these algorithms due to the potentially severe consequences. Adversarial attacks serve as an important surrogate to evaluate the robustness of deep learning models before they are deployed. However, most of existing adversarial attacks can only fool a black-box model with a low success rate. To address this issue, we propose a broad class of momentum-based iterative algorithms to boost adversarial attacks. By integrating the momentum term into the iterative process for attacks, our methods can stabilize update directions and escape from poor local maxima during the iterations, resulting in more transferable adversarial examples. To further improve the success rates for black-box attacks, we apply momentum iterative algorithms to an ensemble of models, and show that the adversarially trained models with a strong defense ability are also vulnerable to our black-box attacks. We hope that the proposed methods will serve as a benchmark for evaluating the robustness of various deep models and defense methods. With this method, we won the first places in NIPS 2017 Non-targeted Adversarial Attack and Targeted Adversarial Attack competitions.