The Power of Decaying Steps: Enhancing Attack Stability and Transferability for Sign-based Optimizers

TL;DR

This work tackles the instability and lack of convergence in sign-based adversarial attacks (e.g., I-FGSM, MI-FGSM) by reframing them as coordinate-wise gradient processes and introducing Monotonically Decreasing Coordinate-wise Step-sizes (MDCS). The MDCS framework enforces a per-coordinate, nonincreasing step-size via a diagonal preconditioner, enabling a convergence guarantee for the MI-based variant with a rate of $O(1/\sqrt{T})$ and yielding substantial gains in both transferability and stability across image classification and cross-modal retrieval tasks. Empirically, MDCS-enhanced attacks outperform strong baselines on normally trained and robust models and improve multimodal attack transferability across diverse Vision-Language Models, while maintaining imperceptibility of perturbations. The results highlight MDCS as a universal, plug-and-play optimization strategy that strengthens the reliability and effectiveness of sign-based adversarial attacks in practical, cross-domain settings.

Abstract

Crafting adversarial examples can be formulated as an optimization problem. While sign-based optimizers such as I-FGSM and MI-FGSM have become the de facto standard for the induced optimization problems, there still exist several unsolved problems in theoretical grounding and practical reliability especially in non-convergence and instability, which inevitably influences their transferability. Contrary to the expectation, we observe that the attack success rate may degrade sharply when more number of iterations are conducted. In this paper, we address these issues from an optimization perspective. By reformulating the sign-based optimizer as a specific coordinate-wise gradient descent, we argue that one cause for non-convergence and instability is their non-decaying step-size scheduling. Based upon this viewpoint, we propose a series of new attack algorithms that enforce Monotonically Decreasing Coordinate-wise Step-sizes (MDCS) within sign-based optimizers. Typically, we further provide theoretical guarantees proving that MDCS-MI attains an optimal convergence rate of $O(1/\sqrt{T})$, where $T$ is the number of iterations. Extensive experiments on image classification and cross-modal retrieval tasks demonstrate that our approach not only significantly improves transferability but also enhances attack stability compared to state-of-the-art sign-based methods.

Figures (9)

• Figure 1: Stability comparison of typical sign-based transfer attacks on the NIPS2017 dataset. We employ Res50 as surrogate model and Inc-v3 as target model with $\epsilon = 16/255$.
• Figure 2: Step-size dynamics of a randomly selected coordinate in typical sign-based attacks. $T$ is the maximum iteration. We reformulate $\text{sign}(\bm{g}_t)$ as $\bm{g_{t,i}} / |\bm{g_{t,i}}|$ where $\bm{g}$ denotes the gradient or momentum and $i$ is the number of the randomly selected coordinate. So, the step-size is $\epsilon/(T |\bm{g_{t,i}}|)$ for coordinate-wise gradient.
• Figure 3: Stability comparison of transfer attacks between MDCS-MI and MI-FGSM. AEs are crafted for Res50 and ViT-B/16, respectively.
• Figure 4: Ablation study on the value of $\epsilon$. We employ Res50 as surrogate model and Inc-v3 as target model.
• Figure 5: Visualization of AEs on image classification tasks. AEs are crafted on ViT-B/16 with $\epsilon = 16/255$.

Theorems & Definitions (4)

• Theorem 3
• Lemma 4
• Lemma 5
• Lemma 6