Enhancing Ensemble Attacks through Momentum Self-Maintenance

Adversarial samples can easily compromise deep neural network models. The transferability of adversarial samples allows them to attack unknown neural network models, posing a significant threat to the applications of many neural network models. While existing ensemble-based attack methods have shown some improvements in enhancing the transferability of adversarial samples, they fail to maintain individual gradient information for each model during the optimization process, thereby limiting the transferability of adversarial samples. To address this issue, this paper proposes a method to enhance the transferability of adversarial samples through self-maintained momentum in an ensemble approach. Firstly, the gradient information from the ensemble of models is decomposed to focus on the individual gradient information of each model. Next, individual momentum is assigned to all models, allowing them to self-maintain momentum information during the iterative optimization process. Finally, the momentum information from all models is integrated into the ultimate gradient information. The experimental data demonstrates that the proposed approach in this study exhibits an improvement of approximately 2% on white-box models and a significant enhancement of 10% to 20% on black-box models, effectively augmenting the transferability of adversarial samples.