On the Convergence of an Adaptive Momentum Method for Adversarial Attacks
Sheng Long, Wei Tao, Shuohao LI, Jun Lei, Jun Zhang
Abstract
Adversarial examples are commonly created by solving a constrained optimization problem, typically using sign-based methods like Fast Gradient Sign Method (FGSM). These attacks can benefit from momentum with a constant parameter, such as Momentum Iterative FGSM (MI-FGSM), to enhance black-box transferability. However, the monotonic time-varying momentum parameter is required to guarantee convergence in theory, creating a theory-practice gap. Additionally, recent work shows that sign-based methods fail to converge to the optimum in several convex settings, exacerbating the issue. To address these concerns, we propose a novel method which incorporates both an innovative adaptive momentum parameter without monotonicity assumptions and an adaptive step-size scheme that replaces the sign operation. Furthermore, we derive a regret upper bound for general convex functions. Experiments on multiple models demonstrate the efficacy of our method in generating adversarial examples with human-imperceptible noise while achieving high attack success rates, indicating its superiority over previous adversarial example generation methods.
BibTeX
@article{Long_Tao_LI_Lei_Zhang_2024, title={On the Convergence of an Adaptive Momentum Method for Adversarial Attacks}, volume={38}, url={https://ojs.aaai.org/index.php/AAAI/article/view/29323}, DOI={10.1609/aaai.v38i13.29323}, abstractNote={Adversarial examples are commonly created by solving a constrained optimization problem, typically using sign-based methods like Fast Gradient Sign Method (FGSM). These attacks can benefit from momentum with a constant parameter, such as Momentum Iterative FGSM (MI-FGSM), to enhance black-box transferability. However, the monotonic time-varying momentum parameter is required to guarantee convergence in theory, creating a theory-practice gap. Additionally, recent work shows that sign-based methods fail to converge to the optimum in several convex settings, exacerbating the issue. To address these concerns, we propose a novel method which incorporates both an innovative adaptive momentum parameter without monotonicity assumptions and an adaptive step-size scheme that replaces the sign operation. Furthermore, we derive a regret upper bound for general convex functions. Experiments on multiple models demonstrate the efficacy of our method in generating adversarial examples with human-imperceptible noise while achieving high attack success rates, indicating its superiority over previous adversarial example generation methods.}, number={13}, journal={Proceedings of the AAAI Conference on Artificial Intelligence}, author={Long, Sheng and Tao, Wei and LI, Shuohao and Lei, Jun and Zhang, Jun}, year={2024}, month={Mar.}, pages={14132-14140} }