Looking From the Future: Multi-order Iterations Can Enhance Adversarial Attack Transferability

TL;DR

This work addresses the limited transferability of adversarial examples by rethinking the optimization trajectory with Looking From the Future (LFF). By incorporating future information through one- and multi-order lookahead updates (including MLFF variants with momentum), the proposed attacks better generalize across models. Empirical results on ImageNet1k demonstrate substantial transferability gains over strong baselines (MI-FGSM, EMI-FGSM, Admix, SIA) across single, ensemble, and defensive models, with ablations clarifying the roles of lookahead depth and future penalties. The approach offers a practical, modular enhancement to iteration-based attacks, with potential implications for understanding generalization in adversarial settings and informing defense strategies.

Abstract

Various methods try to enhance adversarial transferability by improving the generalization from different perspectives. In this paper, we rethink the optimization process and propose a novel sequence optimization concept, which is named Looking From the Future (LFF). LFF makes use of the original optimization process to refine the very first local optimization choice. Adapting the LFF concept to the adversarial attack task, we further propose an LFF attack as well as an MLFF attack with better generalization ability. Furthermore, guiding with the LFF concept, we propose an $LLF^{\mathcal{N}}$ attack which entends the LFF attack to a multi-order attack, further enhancing the transfer attack ability. All our proposed methods can be directly applied to the iteration-based attack methods. We evaluate our proposed method on the ImageNet1k dataset by applying several SOTA adversarial attack methods under four kinds of tasks. Experimental results show that our proposed method can greatly enhance the attack transferability. Ablation experiments are also applied to verify the effectiveness of each component. The source code will be released after this paper is accepted.

Figures (2)

• Figure 1: The experimental results of changing $\mathcal{Q}$ in LFF-I, LFF-MI, MLFF-I, and MLFF-MI respectively.
• Figure 2: The experimental results of changing $\beta$ in MLFF-MI with $\mathcal{Q} = 4$ and $\mathcal{Q} = 10$ respectively.