Enhancing Adversarial Transferability by Balancing Exploration and Exploitation with Gradient-Guided Sampling

AI summary

Overview

Research area: Adversarial machine learning, specifically transferable black-box adversarial attacks against deep neural networks and multimodal large language models.

Technical level: Advanced. The paper assumes familiarity with gradient-based adversarial attacks (FGSM, PGD, MI-FGSM), momentum and Nesterov Accelerated Gradient optimization, loss-landscape analysis, and sharpness-aware/flat-maxima concepts.

Scope: The paper proposes a single inner-iteration sampling strategy called Gradient-Guided Sampling (GGS) that is meant to balance attack potency ("exploitation") against cross-model generalization ("exploration") within existing momentum-based transfer attacks.

What This Paper Is About

Adversarial examples crafted on one "surrogate" model often fail to fool a different "target" model, so attacks must be made more transferable. The authors argue that existing methods sit at two extremes: momentum-based methods such as MI-FGSM push hard for high loss values on the surrogate but overfit it, while recent inner-iteration random sampling methods (for example PGN) flatten the loss surface for better cross-model generalization but lose attack strength. GGS is designed to sit between these extremes by steering the sampling inside each iteration along the gradient ascent direction, so adversarial examples land in flat loss regions that still have high local maxima.

Key Contributions

1. A new inner-iteration sampling strategy. The paper proposes Gradient-Guided Sampling (GGS), which uses the gradient from the previous inner-iteration to guide the direction of the next sampling point, while the sampling magnitude is set by a random distribution. The authors state this produces stable gradient ascent toward flat loss regions with higher local maxima.

2. A framing of the exploitation/exploration dilemma. The work explicitly diagnoses the trade-off in existing literature: momentum-based methods over-prioritize exploitation (higher loss maxima, weaker generalization) while inner-iteration random sampling methods over-prioritize exploration (flatter surfaces, suboptimal local maxima).

3. Compatibility with existing methods. Because GGS is described as a complementary improvement over Random Sampling (RS), the authors show it can be plugged into inner-iteration random-sampling and gradient-averaging methods (PGN, GRA) as well as input transformation methods (DIM, TIM, SIM, Admix, SSM).

4. Broad empirical evaluation. Experiments cover targeted and non-targeted cross-architecture black-box attacks, non-targeted attacks on multimodal large language models (MLLMs), attacks on commercial cloud functions per the contribution list, and a defense robustness study.

Main Findings

• Cross-architecture transfer gains on the nine-model benchmark. With adversarial examples generated on ResNet50, GGS reaches an average of 82.08% untargeted and 17.67% targeted ASR across the nine evaluated models, compared to the strongest listed competitor PGN at 76.53% / 6.84%. Generated on ViT-B, GGS averages 83.33% / 17.22% versus PGN's 75.29% / 9.91%. Generated on Inc-v3, GGS averages 69.27% / 9.80% versus PGN's 63.16% / 5.72%. The paper states that relative to the best-performing competitor, average ASR improves by over 5% in both untargeted and targeted attacks across most architectures, except for Inception-v3.

• Stronger targeted attack potency on the surrogate. The authors report that GGS improves targeted-attack ASR by 4%–25% over other sampling methods such as PGN and GRA, which they present as evidence that it raises attack potency without sacrificing cross-model generalization.

• Lower classification success rate against five MLLMs. Under an ensemble setting (Res50, Inc-v3, ViT-B), GGS achieves an average CSR of 47.54% across GPT-4o, GPT mini, Gemini pro, Gemini flash, and Claude sonnet, versus 56.80% for PGN and 58.50% for GRA, and versus 79.18% for clean samples. The paper reports this as a reduction of the average CSR by over 9% compared to the strongest baseline (lower CSR is better here).

• Loss-surface evidence. In plots over 32 randomly selected adversarial examples, the authors show GGS finding flatter maxima in white-box settings and the highest loss values in black-box testing, with the GGS loss surface largely encompassing those of MI-FGSM, GRA, PGN, and ANDA.

• Ablation isolates the guidance mechanism. Averaged untargeted ASR on ResNet50 and eight target models is 97.3 / 63.74 for Random Sampling, 97.5 / 58.79 for Momentum-Guided Sampling, and 99.3 / 79.93 for GGS. The paper states MGS marginally improves surrogate ASR by 0.2% but reduces transfer capability by 5%, whereas GGS raises both white-box and transfer ASR by 2% and 16% respectively.

• Compatibility results. Adding GGS to GRA raises untargeted ASR from 73.41% to 78.69% and targeted from 8.61% to 13.64%; adding it to PGN raises untargeted from 76.53% to 83.23% and targeted from 6.84% to 12.79%. Among input transformations with GGS, SIM improves from 46.80% to 90.12% untargeted and from 11.14% to 28.44% targeted; Admix goes from 54.78% to 85.50% and 11.28% to 30.50%. Overall the paper reports untargeted ASR increases of 6%–43% and targeted increases of 4%–19%.

• Robustness to defenses. Against seven defense strategies (RP, Bit-red, JPEG, FD, NRP, DP/DiffPure, MD/MimicDiffusion) evaluated on ResNet50 with nine models, the paper reports GGS as superior except for DP and NRP, increasing average ASR by 1.7% over state-of-the-art methods. It also reports that the smallest gap between inner-iteration gradient-averaging methods (GRA, PGN, GGS) and other methods is 12%, comparing ANDA at 54.2% to GRA at 66.74%.

• Degradation analysis of the alternative. The authors show that Momentum-Guided Sampling stabilizes the loss surface but creates long-chain dependencies that produce high similarity between late gradients and the final averaged gradient, which limits exploration; GGS is presented as removing this dependency while keeping the ascent direction.

Methodology in Plain English

The attack starts from MI-FGSM, which repeatedly perturbs an image in the sign direction of a momentum-smoothed gradient. Instead of computing that gradient at a single point, GGS inserts several "inner" sampling steps before each outer update. At each inner step the method samples a random offset, but rather than placing the sample in a purely random direction, it takes the absolute value of the random offset as a magnitude and orients it with the sign of the gradient computed at the previous inner step. This is a Nesterov-style "lookahead": the model is queried at a point already nudged in the ascent direction, and the resulting gradients are averaged and normalized before being added to the momentum term.

The design has two stated purposes. First, using a prior gradient as a directional guide stabilizes the ascent direction. Second, using only the immediately preceding inner-iteration gradient, rather than accumulated momentum, avoids the long-chain dependency that would otherwise over-constrain later samples and kill exploration. The authors contrast this with Random Sampling (independent samples) and Momentum-Guided Sampling (cumulative dependence).

Experimental setup: an ImageNet-compatible dataset of 1,000 images at 299×299×3; six normally trained models (ResNet50, DenseNet121, Inception-v3, InceptionResNet-v2, ViT-B, PiT-B) plus three adversarially trained models (Inc-v3_ens3, Inc-v3_ens4, IncRes-v2_ens); eight gradient-based baselines (MI-FGSM, NI-FGSM, VMI-FGSM, RAP, GRA, PGN, ANDA, GI) and five input transformations (DIM, TIM, SIM, Admix, SSM). Hyperparameters are perturbation ε = 16/255, T = 10 outer iterations, step size α = ε/T, N = 20 inner iterations, and sampling range ζ = 2.0 × ε.

Why This Matters

Impact on research. The paper reframes transferable attack design as an explicit exploration-versus-exploitation trade-off and offers a lightweight, drop-in component rather than a new attack pipeline. If the reported gains hold, it suggests that the sampling strategy inside inner iterations, not just the number of iterations or the loss surface target, is a lever for transferability.

Real-world applications (as framed by the paper and by the attack surface it targets):

• Autonomous driving perception systems, where misclassification of a perturbed input is safety-critical.
• Cybersecurity and content moderation pipelines that rely on machine-learning classifiers.
• Commercial cloud vision/API functions, which the authors list as an evaluation target.
• Multimodal large language model deployments from OpenAI, Google, and Anthropic, where a 47.54% average classification success rate on adversarial inputs indicates a meaningful residual vulnerability.

Industry relevance. Because GGS is compatible with widely used attack toolkits and input transformations, it is directly relevant to red-teaming and robustness benchmarking. The defense robustness results also matter to practitioners choosing defenses, since most of the seven tested defenses did not fully neutralize GGS.

Future Directions

• Extending beyond gradient averaging. The authors explicitly state the goal of refining GGS to support non-gradient-averaging techniques such as VMI-FGSM and RAP, which the current design does not cover.
• Closing the defense gap. GGS was reportedly outperformed by DP (DiffPure) and NRP; understanding why, and whether sampling guidance can be adapted to those defenses, is an open question.
• Understanding the underlying mechanism. The relationship between the single-step gradient dependency, gradient similarity, and the geometry of flat maxima is demonstrated empirically through visualizations but not explained theoretically.
• Broadening evaluation. The main benchmark is a 1,000-image ImageNet-compatible dataset with a fixed hyperparameter setting (T = 10, N = 20, ζ = 2.0 × ε); sensitivity to these choices and to non-classification tasks is not reported in the provided content.

Target Audience

Researchers and graduate students working on adversarial robustness, transferable attacks, and black-box threat modeling; robustness and red-team engineers at organizations deploying vision models or multimodal LLMs; and defense researchers who need to benchmark against strong state-of-the-art transfer attacks such as PGN and GRA. Readers without a background in gradient-based optimization and loss-landscape analysis will find the methodology difficult to follow.

Authors’ abstract

Adversarial attacks present a critical challenge to deep neural networks' robustness, particularly in transfer scenarios across different model architectures. However, the transferability of adversarial attacks faces a fundamental dilemma between Exploitation (maximizing attack potency) and Exploration (enhancing cross-model generalization). Traditional momentum-based methods over-prioritize Exploitation, i.e., higher loss maxima for attack potency but weakened generalization (narrow loss surface). Conversely, recent methods with inner-iteration sampling over-prioritize Exploration, i.e., flatter loss surfaces for cross-model generalization but weakened attack potency (suboptimal local maxima). To resolve this dilemma, we propose a simple yet effective Gradient-Guided Sampling (GGS), which harmonizes both objectives through guiding sampling along the gradient ascent direction to improve both sampling efficiency and stability. Specifically, based on MI-FGSM, GGS introduces inner-iteration random sampling and guides the sampling direction using the gradient from the previous inner-iteration (the sampling's magnitude is determined by a random distribution). This mechanism encourages adversarial examples to reside in balanced regions with both flatness for cross-model generalization and higher local maxima for strong attack potency. Comprehensive experiments across multiple DNN architectures and multimodal large language models (MLLMs) demonstrate the superiority of our method over state-of-the-art transfer attacks. Code is made available at https://github.com/anuin-cat/GGS.