Boosting Adversarial Attacks with Momentum

### Transferability of Adversarial Attacks on Deep Neural Networks At 00:00, Xingxing Wei (Tsinghua University) presents research on enhancing the transferability of adversarial perturbations against deep learning computer vision architectures. In black-box threat models where the attacker lacks direct access to model weights and gradients, standard adversarial examples frequently fail to fool target classifiers.

### Limitations of Single-Step and Iterative Gradient Attacks At 03:00, Wei evaluates conventional attack methodologies. While single-step methods like the Fast Gradient Sign Method (FGSM) generate perturbations with reasonable transferability, they lack sufficient attack strength. Conversely, iterative methods like the Basic Iterative Method (BIM) overfit to the specific white-box surrogate model's decision boundaries, resulting in poor evasion rates against unseen black-box defenses.

### The Momentum Iterative Fast Gradient Sign Method (MI-FGSM) At 06:01 and 09:01, Wei introduces the Momentum Iterative Fast Gradient Sign Method (MI-FGSM). By integrating a momentum velocity term into the iterative gradient update steps, the optimization process memorizes previous gradient directions and smooths the perturbation trajectory, preventing the attack from getting trapped in shallow local extrema.

### Empirical Benchmarks Across Computer Vision Architectures At 12:01, the speaker presents empirical evaluations across prominent deep convolutional architectures, including ResNet, Inception, and DenseNet. MI-FGSM achieves consistently superior attack success rates in black-box transfers compared to standard iterative attacks, successfully fooling models even when protected by defensive distillation and adversarial training.

### Implications for AI Vision Security and Robustness Concluding around 15:02, Wei outlines the broader security ramifications for production AI deployments. The high transferability of momentum-boosted attacks demonstrates that deep neural networks share fundamental geometric vulnerabilities in their decision boundaries, emphasizing the urgent need for robust verification and adversarial defense mechanisms.

(AI summary — Gemini Flash)