mlsanityData to 14 Oct 2026

Optimizing the Adversarial Perturbation with a Momentum-based Adaptive Matrix

arXiv 2512.14188 ↗First posted 16 Dec 2025cs.LGcited by 0

Not on the map. Why?

Abstract (arXiv)

Generating adversarial examples (AEs) can be formulated as an optimization problem. Among various optimization-based attacks, the gradient-based PGD and the momentum-based MI-FGSM have garnered considerable interest. However, all these attacks use the sign function to scale their perturbations, which raises several theoretical concerns from the point of view of optimization. In this paper, we first reveal that PGD is actually a specific reformulation of the projected gradient method using only the current gradient to determine its step-size. Further, we show that when we utilize a conventional adaptive matrix with the accumulated gradients to scale the perturbation, PGD becomes AdaGrad. Motivated by this analysis, we present a novel momentum-based attack AdaMI, in which the perturbation is optimized with an interesting momentum-based adaptive matrix. AdaMI is proved to attain optimal convergence for convex problems, indicating that it addresses the non-convergence issue of MI-FGSM, thereby ensuring stability of the optimization process. The experiments demonstrate that the proposed momentum-based adaptive matrix can serve as a general and effective technique to boost adversarial transferability over the state-of-the-art methods across different networks while maintaining better stability and imperceptibility.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 45 of its 68 references that are in the map. First posted on arXiv 16 Dec 2025.

Builds on

45 of 68 references.

References · 45

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  4. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,139
  5. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  8. 2013Intriguing properties of neural networkscited by 5,155
  9. 2023Improved Baselines with Visual Instruction Tuningcited by 4,418
  10. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  11. 2016Adversarial examples in the physical worldcited by 1,769
  12. 2019Towards VQA Models That Can Readcited by 1,718
33 more
  1. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  2. 2016An overview of gradient descent optimization algorithmscited by 1,033
  3. 2019On the Convergence of Adam and Beyondcited by 841
  4. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  5. 2018signSGD: Compressed Optimisation for Non-Convex Problemscited by 571
  6. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  7. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  8. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
  9. 2024Prismatic VLMs: Investigating the Design Space of Visually-Conditioned Language Modelscited by 339
  10. 2019Error Feedback Fixes SignSGD and other Gradient Compression Schemescited by 310
  11. 2020AdaBelief Optimizer: Adapting Stepsizes by the Belief in Observed Gradientscited by 283
  12. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  13. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 130
  14. 2023On the Robustness of Large Multimodal Models Against Image Adversarial Attackscited by 92
  15. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  16. 2020Patch-wise Attack for Fooling Deep Neural Networkcited by 78
  17. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 68
  18. 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 54
  19. 2017Variants of RMSProp and Adagrad with Logarithmic Regret Boundscited by 50
  20. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  21. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 44
  22. 2023An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferabilitycited by 42
  23. 2022Natural Color Fool: Towards Boosting Black-box Unrestricted Attackscited by 38
  24. 2023Improving Adversarial Transferability via Intermediate-level Perturbation Decaycited by 29
  25. 2020Making Adversarial Examples More Transferable and Indistinguishablecited by 19
  26. 2022Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learningcited by 15
  27. 2023Reliable Evaluation of Adversarial Transferabilitycited by 13
  28. 2021Adversarial example generation with AdaBelief Optimizer and Crop Invariancecited by 12
  29. 2022Proving Common Mechanisms Shared by Twelve Methods of Boosting Adversarial Transferabilitycited by 12
  30. 2021The Role of Momentum Parameters in the Optimal Convergence of Adaptive Polyak's Heavy-ball Methodscited by 7
  31. 2021Adaptive Perturbation for Adversarial Attackcited by 7
  32. 2024Explainable and Transferable Adversarial Attack for ML-Based Network Intrusion Detectorscited by 7
  33. 2024Adversarial Example Soups: Improving Transferability and Stealthiness for Freecited by 6

Built on by

Not cited yet.