This section classifies gradient-based iterative attacks into two categories: traditional gradient attack methods and those that evolve from gradient-based strategies.

The threat posed by adversarial examples to deep neural networks has driven the design of more sophisticated defense mechanisms [25]. Tramér et al. [26] proposed separating the generation of adversarial examples from model parameter training, aiming to increase perturbation diversity during training while reducing the dimensionality of the adversarial examples. A fast adversarial training technique was proposed by Shafahi et al. [27], which simultaneously updates the model parameters and image perturbations within one iteration, achieving a training speed 3 to 30 times faster than traditional approaches. In their work, Gokhale et al. [28] developed an adversarial training approach that creates novel samples, maximizing the classifier’s exposure to the attribute space, all without relying on test domain data. The min-max optimization problem is tackled by this adversarial training approach, which first optimizes the loss from adversarial perturbations in the inner maximization phase and then finds the best model parameters in the outer minimization phase.

Currently, one of the best techniques for increasing model robustness is adversarial training; however, it faces challenges related to increased training costs, particularly on large-scale datasets. To address the high computational costs, recent studies have focused on designing efficient methods to enhance model robustness. Naseer et al. [29] developed a NRP model, which uses self-derived supervision to learn to purify images from adversarial interference. To identify hostile examples, Xu et al. [30] developed two feature squeezing methods: Bit Reduction (Bit Red) and Spatial Smoothing. In response to adversarial inputs, Feature Distillation (FD) [31] was introduced as a defense system utilizing JPEG compression.

Adversarial attacks involve generating an adversarial example xadv from a clean sample x using a classifier f with parameters θ. The crafted adversarial example xadv causes the classifier f to produce incorrect classifications, i.e., f(x;θ)≠f(xadv;θ), where f(x;θ) represents the output of the deep neural network (DNN), often denoted by y. The loss function of the classifier f is represented as J(x,y,θ). The generated adversarial example must satisfy the constraint ||xadv−x||p≤ϵ, where ϵ is the constraint value, and ||⋅||p denotes the p-norm distance, with p typically being 0, 2, or ∞. In this work, consistent with previous studies [11], we set p=∞. The specific definition is given as: (1)fθ(xadv)≠y,s.t.||xadv−x||p≤ϵ

Following the introduction of the Fast Gradient Sign Method (FGSM) [13], iterative refinements in gradient-based adversarial attacks have resulted in the creation of advanced techniques, including SM2I-FGSM [12]. All of these methods rely on gradient optimization. The gradient-based optimization family includes FGSM [13], I-FGSM [32], MI-FGSM [14], NI-FGSM [15], VNI-FGSM [11], VMI-FGSM [11], and SM2I-FGSM [12].

Fast Gradient Sign Method (FGSM) [13] as the earliest proposed gradient-based attack, generates adversarial examples by inputting a clean sample x into the network and performing a single update based on the loss function J(xadv,y,θ). The loss function is only calculated once in the adversarial example. The following is the particular generation process: (2)xadv=x+ϵ⋅sign(∇xJ(x,y,θ))where ∇x denotes the gradient with respect to x, J(⋅) represents the loss function, sign(⋅) is the function that computes the sign of the gradient ∇x, and ϵ is the perturbation magnitude.

Iterative Fast Gradient Sign Method (I-FGSM) [32] extends the single-step method FGSM to a multi-step attack by introducing a step parameter α: (3)xt+1adv=xtadv+α⋅sign(∇xtadvJ(xtadv,y;θ))where x0adv=x, x is a clean sample, α=ϵ/T, ϵ is the perturbation size, and T is the iteration count.

Momentum Iterative Fast Gradient Sign Method (MI-FGSM) [14] introduces the momentum factor μ collects the gradient of every iteration of I-FGSM as momentum in the next gradient calculation: (4)gt=μ⋅gt−1+∇xtadvJ(xtadv,y;θ)||∇xtadvJ(xtadv,y;θ)||1 (5)xt+1adv=xtadv+α⋅sign(gt)where  g0=0, μ is the momentum element, and gt is the sum of the current gradient and μ times (t − 1) the next gradient.

Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) [15] introduces the idea of Nesterov Gradient Descent (NAG) by replacing all xtadv in Eq. (4) with xtadv+α⋅μ⋅gt when calculating xt+1adv to additional strengthen the black-box aggressiveness of MI-FGSM.

Variance momentum Iterative Fast Gradient Sign Method (VMI-FGSM) [11] steady the updated guidance of the present gradient by incorporating the gradient variance details from the prior round of iterations: (6)gt+1=μ⋅gt+∇xtadvJ(xtadv,y;θ)+vt||∇xtadvJ(xtadv,y;θ)+vt||1 (7)xt+1adv=xtadv+α⋅sign(gt+1)where  vt+1=1N∑i=1N∇xiJ(xi,y;θ)−∇xJ(x,y;θ), xi is a random sample within a specific range of x uniform distribution.

Spatial Momentum Iterative Fast Gradient Sign Method (SM2I-FGSM) [12] considers contextual gradient knowledge in various image regions, introducing a momentum accumulation system from the timing to the spatial domain, with the gradient updated as: (8)gt+1s=∑i=1nλi∇xJ(Hi(xtadv),y) (9)xt+1adv=xtadv+α⋅sign(gt+1s)where Hi(.) represents the random resizing and padding used to transform xtadv, n denotes the number of transformations in the spatial domain, and λi denotes the weight of the gradient.

Deep neural networks often exhibit complex forms when handling high-dimensional classification tasks due to the highly nonlinear and often high-curvature nature of their decision boundaries. Fig. 2 illustrates the high curvature of Model 1 and Model 2’s decision boundaries. To induce misclassification in both Model 1 and Model 2, our goal is to generate an adversarial example x that identifies the optimal attack direction during its creation. The current techniques for generating adversarial examples struggle in transferring attacks to other models because of the pronounced curvature in the decision boundary. In contrast, robust models feature smoother decision boundaries, which significantly weakens the impact of adversarial attacks against defensive and adversarially trained model.

Our goal is to improve the black-box transferability of adversarial examples by refining the attack direction, steering it towards a more aggressive path. Inspired by VMI-FGSM [11], we investigate the gradient information of a uniform distribution around the sample during the iterative process, effectively improving the transferability of the final adversarial example. Building on this, we consider sample feature information closer to the surrounding sample points, which shares similarities with the feature information of the sampling points. By setting the sampling point as the center of a normal distribution, we can sample misleading features near the sample point with maximum probability. Due to the concentration of the normal distribution around the sample point, most sampled points exhibit features that are more closely aligned with the original examples. In adversarial attacks, critical feature variations often occur near the model’s decision boundary. The localized focus of the normal distribution increases the likelihood of sampling points that are closer to these critical regions, thereby providing more informative guidance for gradient optimization. This focus reduces deviations in gradient update directions, resulting in smoother and more stable gradient variations, which enhance the generalization and cross-model transferability of adversarial perturbations. Furthermore, the localized sampling characteristic of the normal distribution mitigates the interference of high-curvature decision boundaries on gradient updates, particularly in adversarially trained models, thereby improving the accuracy of gradient update directions and the overall attack effectiveness. In contrast, uniform distribution sampling generates points randomly across the entire sampling range, which may result in sampled points with features that deviate from the original examples, introducing noise and irrelevant information into the optimization process. As shown in Fig. 1, the comparison of the two sampling methods clearly demonstrates that normal sampling outperforms uniform sampling on adversarially trained models. To boost the attack power of the adversarial example, we add gradient information from the original sample as noise to image. This is achieved by performing random sampling around the sample’s point based on a normal distribution and aggregating the gradients obtained from this sampling.

Based on this, we present a new attack method called Stochastic Gradient Accumulation Momentum Iterative Attack (SAMI-FGSM). At each iteration, the method combines the gradient information from the earlier step to ensure a more stable gradient direction, effectively smoothing the update direction. Additionally, during the calculation of accumulated gradient information, it incorporates sample gradient information from a specific normal distribution range. The specific implementation of the proposed SAMI-FGSM method is as follows:

Definition: Given a classifier f with parameters θ and a loss function J(x′,y;θ), the gradient accumulation can be described as follows: (10)A(x)=∑i=1N∇xiJ(xi,y;θ) where xi=x+ri ri∼N(0,(δ⋅ϵ)d), and N(0,(δ⋅ϵ)d) denotes a d-dimensional normal distribution. After obtaining the random gradient information from the (t − 1)-th iteration through the above process, this information is used to adjust the gradient of xtadv in the t-th iteration, thereby stabilizing the gradient update direction more effectively. Specifically, At+1 aggregates the gradients of all sampled points in the current iteration, and this accumulation affects the gradient update in the following ways:

Stable direction: The historical gradient information (At) is combined with the current gradient to smooth the randomness of the single gradient update and avoid falling into local optimum.

Enhanced generalization: The gradient mean of multiple sampling points implies the local geometric characteristics of the decision boundary of the model, so that the attack direction is more suitable for the boundary differences of different models.

The complete process of the proposed stochastic gradient accumulation method is described in Algorithm 1, referred to as SAMI-FGSM. The method proposed here demonstrates optimal performance along the primary path of gradient-based attacks and is compatible with various derivative techniques, such as frequency domain attacks [18] and adaptive targeted attacks [33]. Furthermore, the proposed method is compatible with a variety of existing methods such as DIM attacks, TIM attacks, and SIM attacks.

Derivative methods based on gradient attacks primarily originate from FGSM. This section provides an overview of the key gradient-based attack techniques, as illustrated in Fig. 3. If the domain upper bound δ is set to 0, SAMI-FGSM degenerates into MI-FGSM. In the same way, setting the decay factor μ to 0 and limiting the number of iterations T to 1 results in these methods returning to the standard FGSM. Moreover, the aforementioned gradient-based attack methods are capable of being integrated with many input transformations, such as DIM, SIM, and TIM, to enhance the transferability of adversarial examples.

Finally, the framework design of SAMI-FGSM is inspired by VMI-FGSM and inherits the key ideas in VMI-FGSM in design. While SAMI-FGSM and VMI-FGSM are on the same level, SAMI-FGSM simplifies the approach of VMI-FGSM and reduces computational overhead. The contribution of SAMI-FGSM is not a simple combination of existing techniques, but through normal sampling theory and gradient accumulation mechanism, it solves the fundamental limitations of traditional methods in local optimum trap and defense model attack efficiency. As presented in Table 2, the proposed method generates adversarial examples for Inc-v3 that achieve the highest average attack success rate compared to six other models.

Dataset. Based on earlier works [11,14,15,23], we randomly selected one image from every one of the 1000 categories in the ILSVRC2012 validation set, each selected image was able to be correctly categorized in all models in that paper. We also list other mainstream datasets, as shown in Table 1. In the standardized adversarial attack research, ILSVRC2012 still has the only unified benchmark; Although other large-scale or diverse datasets have more advantages in the number of categories, they have not yet formed a unified evaluation standard in the adversarial attack community or the computational cost is too high.

Models. To better contrast our method with the existing dominant methods, seven naturally trained models are used, four of which are typically trained models are Inception-v3 (Inc-v3) [35], Inception-v4 (Inc-v4) [36], Inception-Resnet-v2 (IncRes-v2) [36], Resnet-v2-101 (Res-101) [37], as well as three adversary-trained models that have been trained using adversarial examples, namely, ens3-adv-Inception-v3 (Inc-v3_ens3) [26], ens4-Inception-v3 (Inc-v3_ens4) [26], and ens-adv-Inception-ResNet-v2 (IncRes-v2_ens) [26]. In the experiment of this paper, every one of these models functioned as a stand-in model to produce adversarial examples. In addition to the above CNNs, we also use transformer-based architectures including ViT [38], PiT [39], Visformer [40], Swin [41]. Besides, we utilized three cutting-edge defensive models to evaluate our strategy’s attack performance: Neural Representation Purifier (NRP) [29], Bit-Reduction (Bit-Red) [30], Feature Distillation (FD) [31], Resize and Padding (RP) [42], HGD [43], and RS [44].

Baseline. We consider eight gradient-based attacks as our baselines, including MI-FGSM, NI-FGSM, VMI-FGSM, SM2I-FGSM, NEAA [45], NAA [46] and MFAA [47]. Additionally, our method can be paired with various common input transformation attacks to test its compatibility and effectiveness.

Hyperparameters. The parameters used in our experiments are consistent with those in the baseline attack methods. Specifically, the number of iterations, maximum perturbation, and step size are set to T = 10, ϵ = 16/255, α = 1.6/255, respectively. For the gradient-based momentum term (decay factor) in the baseline attacks, it is set to 1.0. For the three input transformation methods, the parameter settings are as follows: DIM has a transformation probability of 0.5, SIM involves 5 scale copies, and TIM uses a Gaussian kernel of size 7 × 7, as established in previous studies. For VM(N)I-FGSM, the settings are consistent with the optimal attack performance reported in [11], where the domain upper bound factor β is set to 1.5, and the number of samples for variance adjustment N is set to 20. For the method we propose, based on stochastic gradient accumulation, the sample size drawn from normal distribution is N = 500, and the upper limit for sampling is set to 5/2.

In this part, we tested several baseline methods and our proposed Stochastic Gradient Accumulation Momentum Iterative Attack (SAMI-FGSM) on individual deep neural network models. Table 2 shows that the Inc-v3 model was initially used to generate adversarial examples for the experiments. The adversarial examples were generated on the Inc-v3, Inc-v4, and IRes-v2 models, and then evaluated on eight different models, comprising one white-box model, two models trained without defenses, two adversarially trained defense models, and three models with advanced defensive techniques. Table 3 demonstrates that our SAMI-FGSM technique surpasses every baseline method in terms of attack success rates.

To increase the efficacy of adversarial attacks, Wang et al. [11] demonstrated through experiments that DI (DIM), SI (SIM), and TI (TIM) attacks can be integrated into a composite transformation approach (DTS). This method, which integrates multiple transformations, can be paired with gradient-based attack techniques, resulting in enhanced attack success rates. Our approach, the Stochastic Gradient Accumulation Momentum Iterative method (SAMI-FGSM), focuses on improving the transferability of adversarial examples. We validate that our approach is just as applicable as classical gradient-based methods by combining this method with composite transformation techniques. Table 4 demonstrates that combining our method with different input transformations consistently improves attack performance.

Through the integration of multiple models, Liu et al. [48] demonstrated that such an approach boosts the attack performance of adversarial examples, significantly increasing their transferability. Typically, there exist three kinds of ensemble methods: ensemble at the prediction level, ensemble at the logit level, and ensemble within the loss function. In this work, we utilize the logit ensemble method, where we average the logit outputs from the Inc-v3, Inc-v4, and IncRes-v2 models. By making a slight sacrifice in attack performance in white-box attacks, we gain enhanced transferability in black-box attacks, where our proposed method exhibits optimal performance. We conduct experiments on two adversarially trained defense models, and six models with advanced defensive techniques, in Table 5, the upper section reports the success attack rates (%) of four baseline attacks and our proposed method across three ensemble models, while the lower section shows the results when combined with DTS. Additionally, we combine the composite transformation method (DTS) with the ensemble approach to confirm the generality of our proposed approach. Compared to the four standard gradient-based attack techniques, our approach delivers superior performance, achieving an average success rate of 88.9%.

Notably, our method consistently outperforms others on both single and ensemble models, demonstrating its effectiveness and highlighting the vulnerability of current defense models.

In order to verify the generalization ability of SAMI-FGSM on Transformer architecture models, four typical vision Transformer models are selected as target models in this section: ViT, PiT, Visformer, and Swin Transformer. The experiment uses Inc-v3 as the source model to generate adversarial samples, and the attack results are shown in Table 6. The average attack success rate of SAMI-FGSM on four Transformer models reaches 53.7%, which is 21.7% and 10.9% higher than the baseline methods VMI-FGSM (32.0%) and VNI-FGSM (42.8%), respectively. Experiments show that SAMI-FGSM has significant advantages on the Transformer architecture model.

To ensure the statistical reliability of the results, we performed a paired t-test between SAMI-FGSM and the baseline method, and each attack experiment was independently repeated 10 times. The significance test was performed using a two-sample t-test with significance level α = 0.05 to verify whether the performance difference between SAMI-FGSM and baseline methods was significant. As shown in Table 7, The two-sample t-test shows that SAMI-FGSM has a significantly higher attack success rate than VMI-FGSM on the defense model. In addition, in the cross-model transfer scenario, the average success rate of SAMI-FGSM is 28.8% higher than that of the baseline method, indicating that its performance improvement is highly stable.

We invite 20 subjects to blind test 100 pairs of original/adversarial examples. The experimental results show that less than 10% of the samples are correctly distinguished by the subjects, which further verifies the perceptual imperceptibility of SAM I-FGSM under the constraint of ϵ = 16/255. In addition, we also tested the robustness of perturbation to Gaussian noise (σ = 0.1), motion blur (kernel = 5 _* 5) and random cropping (20%). As shown in Table 8, the proposed method has strong robustness to noise, blurring and cropping on the premise of maintaining low perception.

This section presents ablation studies on two parameters of SAMI-FGSM to assess its effectiveness. First, we assess the influence of the two parameters, sampling limit δ and sampling number N, on the attack performance of SAMI-FGSM. To evaluate the influence of these hyperparameters, adversarial examples are created Utilizing Inc-v3 as a source model, with default settings of δ = 5/2 and N = 500.

Sampling Limit δ: As shown in Fig. 6, we analyze how the sampling limit δ in the normal distribution affects the performance of black-box transferability. The left plot shows adversarial examples generated using Inc-v3, while the right plot shows results on the Inc-v4 model. The sampling number N is fixed at 500. When δ = 0, SAMI-FGSM degenerates into MI-FGSM, resulting in lower transferability. When δ = 1/5, despite the small sampling limit, SAMI-FGSM exhibits a significant improvement in attack performance. When δ = 5/2, our method achieves optimal attack performance, showing excellent effectiveness even against several defense models. Finally, as δ increases further, the attack performance of the proposed method gradually decreases. δ controls the normal sampling limit, and its value needs to maintain a proportional relationship with the perturbation constraint value ϵ. When δ = 5/2, it ensures that the sampling points not only contain local feature disturbances, but also avoids the introduction of irrelevant noise due to the large range. Therefore, δ = 5/2 is chosen for all experiments in this study.

Sample Size N: Next, we examine how the number of samples (N) in the neighborhood affects the transferability of adversarial examples. As seen in Fig. 7, the left plot represents adversarial examples created using Inc-v3, while the right plot shows outcomes on the Inc-v4 model. The sampling limit δ is set to 5/2 by default. Our approach also degenerates into MI-FGSM when N = 0. The attack performance of our method will be significantly affected by the sampling number when N = 20, with the effectiveness of the black-box attack increasing significantly as N increases. Our method achieves near-optimal attack performance at N = 500. Although there is a slight increase in success attack rates with further increases in N, each iteration requires extensive sampling and gradient computation. As shown in Table 9, when N increases from 500 to 1000, the average attack success rate increases by 1.9%, but the running time increases by 98.2%. When N > 500, the success rate increases slowly, while the time cost increases significantly. Thus, a larger N results in higher computational costs. In our experiments, we set N = 500 to strike a compromise between attack success and computational efficiency.

In summary, when N > 500, the impact of N on black-box attack effectiveness gradually diminishes, while the parameter δ has an important impact on the success attack rate. Therefore, for all experiments, we choose δ = 5/2 and N = 500.