{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,5]],"date-time":"2025-11-05T08:56:28Z","timestamp":1762332988117,"version":"build-2065373602"},"reference-count":38,"publisher":"Institution of Engineering and Technology (IET)","issue":"1","license":[{"start":{"date-parts":[[2024,5,11]],"date-time":"2024-05-11T00:00:00Z","timestamp":1715385600000},"content-version":"vor","delay-in-days":131,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100008871","name":"Yunnan Provincial Science and Technology Department","doi-asserted-by":"publisher","award":["202301AU070194"],"award-info":[{"award-number":["202301AU070194"]}],"id":[{"id":"10.13039\/501100008871","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["2042022kf0021"],"award-info":[{"award-number":["2042022kf0021"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["ietresearch.onlinelibrary.wiley.com"],"crossmark-restriction":true},"short-container-title":["IET Information Security"],"published-print":{"date-parts":[[2024,1]]},"abstract":"<jats:p>Adversarial examples have the property of transferring across models, which has created a great threat for deep learning models. To reveal the shortcomings in the existing deep learning models, the method of the ensemble has been introduced to the generating of transferable adversarial examples. However, most of the model ensemble attacks directly combine the different models\u2019 output but ignore the large differences in optimization direction of them, which severely limits the transfer attack ability. In this work, we propose a new kind of ensemble attack method called stochastic average ensemble attack. Unlike the existing approach of averaging the outputs of each model as an integrated output, we continuously optimize the ensemble gradient in an internal loop using the model history gradient and the average gradient of different models. In this way, the adversarial examples can be updated in a more appropriate direction and make the crafted adversarial examples more transferable. Experimental results on ImageNet show that our method generates highly transferable adversarial examples and outperforms existing methods.<\/jats:p>","DOI":"10.1049\/2024\/7983842","type":"journal-article","created":{"date-parts":[[2024,5,11]],"date-time":"2024-05-11T15:20:06Z","timestamp":1715440806000},"update-policy":"https:\/\/doi.org\/10.1002\/crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Boosting the Transferability of Ensemble Adversarial Attack via Stochastic Average Variance Descent"],"prefix":"10.1049","volume":"2024","author":[{"given":"Lei","family":"Zhao","sequence":"first","affiliation":[]},{"given":"Zhizhi","family":"Liu","sequence":"additional","affiliation":[]},{"given":"Sixing","family":"Wu","sequence":"additional","affiliation":[]},{"given":"Wei","family":"Chen","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4959-444X","authenticated-orcid":false,"given":"Liwen","family":"Wu","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4959-8432","authenticated-orcid":false,"given":"Bin","family":"Pu","sequence":"additional","affiliation":[]},{"given":"Shaowen","family":"Yao","sequence":"additional","affiliation":[]}],"member":"265","published-online":{"date-parts":[[2024,5,11]]},"reference":[{"key":"e_1_2_9_1_2","unstructured":"SallabA. E. AbdouM. PerotE. andYogamaniS. Deep reinforcement learning framework for autonomous driving 2017 arXiv preprint arXiv: 1704.02532."},{"key":"e_1_2_9_2_2","doi-asserted-by":"crossref","unstructured":"TaigmanY. YangM. RanzatoM. A. andWolfL. Deepface: closing the gap to human-level performance in face verification 2014 IEEE Conference on Computer Vision and Pattern Recognition 2014 Columbus OH USA IEEE 1701\u20131708 https:\/\/doi.org\/10.1109\/CVPR.2014.220 2-s2.0-84911198048.","DOI":"10.1109\/CVPR.2014.220"},{"key":"e_1_2_9_3_2","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2021.3105723"},{"key":"e_1_2_9_4_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2023.3289573"},{"key":"e_1_2_9_5_2","doi-asserted-by":"publisher","DOI":"10.1145\/3411806"},{"key":"e_1_2_9_6_2","unstructured":"SzegedyC. ZarembaW. SutskeverI. BrunaJ. ErhanD. GoodfellowI. andFergusR. Intriguing properties of neural networks 2013 arXiv preprint arXiv:1312.6199."},{"key":"e_1_2_9_7_2","unstructured":"GoodfellowI. J. ShlensJ. andSzegedyC. Explaining and harnessing adversarial examples 2014 arXiv preprint arXiv:1412.6572."},{"key":"e_1_2_9_8_2","doi-asserted-by":"crossref","unstructured":"CarliniN.andWagnerD. Towards evaluating the robustness of neural networks 2017 IEEE Symposium on Security and Privacy (SP) 2017 San Jose CA USA IEEE 39\u201357 https:\/\/doi.org\/10.1109\/SP.2017.49 2-s2.0-85024480368.","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_2_9_9_2","unstructured":"PapernotN. McDanielP. andGoodfellowI. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples 2016 arXiv preprint arXiv: 1605.07277."},{"key":"e_1_2_9_10_2","unstructured":"LiuY. ChenX. LiuC. andSongD. Delving into transferable adversarial examples and black-box attacks 2016 In International Conference on Learning Representations."},{"key":"e_1_2_9_11_2","doi-asserted-by":"crossref","unstructured":"DongY. LiaoF. PangT. SuH. ZhuJ. HuX. andLiJ. Boosting adversarial attacks with momentum Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition 2018 IEEE 9185\u20139193 https:\/\/doi.org\/10.1109\/CVPR.2018.00957 2-s2.0-85057255236.","DOI":"10.1109\/CVPR.2018.00957"},{"key":"e_1_2_9_12_2","doi-asserted-by":"crossref","unstructured":"XiongY. LinJ. ZhangM. HopcroftJ. E. andHeK. Stochastic variance reduced ensemble adversarial attack for boosting the adversarial transferability Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition 2022 IEEE 14983\u201314992.","DOI":"10.1109\/CVPR52688.2022.01456"},{"key":"e_1_2_9_13_2","article-title":"A stochastic gradient method with an exponential convergence_rate for finite training sets","volume":"25","author":"Roux N.","year":"2012","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_2_9_14_2","doi-asserted-by":"crossref","unstructured":"RussakovskyO. DengJ. SuH. KrauseJ. SatheeshS. MaS. HuangZ. KarpathyA. KhoslaA. BernsteinM. BergA. C. andFei-FeiL. Imagenet large scale visual recognition challenge International Journal of Computer Vision 2015 115 211\u2013252 https:\/\/doi.org\/10.1007\/s11263\u2010015\u20100816\u2010y 2-s2.0-84947041871.","DOI":"10.1007\/s11263-015-0816-y"},{"key":"e_1_2_9_15_2","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"e_1_2_9_16_2","unstructured":"LinJ. SongC. HeK. WangL. andHopcroftJ. E. Nesterov accelerated gradient and scale invariance for adversarial attacks In International Conference on Learning Representations."},{"key":"e_1_2_9_17_2","doi-asserted-by":"crossref","unstructured":"JangD. SonS. andKimD. S. Strengthening the transferability of adversarial examples using advanced looking ahead and self-cutmix Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition 2022 IEEE 148\u2013155.","DOI":"10.1109\/CVPRW56347.2022.00026"},{"key":"e_1_2_9_18_2","doi-asserted-by":"crossref","unstructured":"XieC. ZhangZ. ZhouY. BaiS. WangJ. RenZ. andYuilleA. L. Improving transferability of adversarial examples with input diversity Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition 2019 IEEE 2730\u20132739.","DOI":"10.1109\/CVPR.2019.00284"},{"key":"e_1_2_9_19_2","doi-asserted-by":"crossref","unstructured":"DongY. PangT. SuH. andZhuJ. Evading defenses to transferable adversarial examples by translation-invariant attacks Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition 2019 IEEE 4312\u20134321.","DOI":"10.1109\/CVPR.2019.00444"},{"key":"e_1_2_9_20_2","doi-asserted-by":"crossref","unstructured":"WangX. HeX. WangJ. andHeK. Admix: enhancing the transferability of adversarial attacks Proceedings of the IEEE\/CVF International Conference on Computer Vision 2021 IEEE 16138\u201316147 https:\/\/doi.org\/10.1109\/ICCV48922.2021.01585.","DOI":"10.1109\/ICCV48922.2021.01585"},{"key":"e_1_2_9_21_2","doi-asserted-by":"crossref","unstructured":"LongY. ZhangQ. ZengB. GaoL. LiuX. ZhangJ. andSongJ. Frequency domain model augmentation for adversarial attack European Conference on Computer Vision 2022 Cham Springer Nature Switzerland 549\u2013566.","DOI":"10.1007\/978-3-031-19772-7_32"},{"key":"e_1_2_9_22_2","doi-asserted-by":"crossref","unstructured":"ZhangJ. HuangJ. T. WangW. LiY. WuW. WangX. andLyuM. R. Improving the transferability of adversarial samples by path-augmented method Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition 2023 IEEE 8173\u20138182.","DOI":"10.1109\/CVPR52729.2023.00790"},{"key":"e_1_2_9_23_2","doi-asserted-by":"publisher","DOI":"10.1007\/s12083\u2010021\u201001178\u20103"},{"key":"e_1_2_9_24_2","unstructured":"MadryA. MakelovA. SchmidtL. TsiprasD. andVladuA. Towards deep learning models resistant to adversarial attacks 2017 arXiv preprint arXiv: 1706.06083."},{"key":"e_1_2_9_25_2","unstructured":"Tram\u00e8rF. KurakinA. PapernotN. GoodfellowI. BonehD. andMcDanielP. Ensemble adversarial training: attacks and defenses 2018 In International Conference on Learning Representations."},{"key":"e_1_2_9_26_2","doi-asserted-by":"publisher","DOI":"10.1049\/ise2.12030"},{"key":"e_1_2_9_27_2","unstructured":"XuW. EvansD. andQiY. Detecting adversarial examples in deep neural networks 2017 arXiv preprint arXiv: 1704.01155."},{"key":"e_1_2_9_28_2","doi-asserted-by":"crossref","unstructured":"CohenG. SapiroG. andGiryesR. Detecting adversarial samples using influence functions and nearest neighbors Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition 2020 IEEE 14453\u201314462.","DOI":"10.1109\/CVPR42600.2020.01446"},{"key":"e_1_2_9_29_2","unstructured":"GuoC. RanaM. CisseM. andVan Der MaatenL. Countering adversarial images using input transformations 2017 arXiv preprint arXiv: 1711.00117."},{"key":"e_1_2_9_30_2","unstructured":"XieC. WangJ. ZhangZ. RenZ. andYuilleA. Mitigating adversarial effects through randomization 2018 International Conference on Learning Representations."},{"key":"e_1_2_9_31_2","doi-asserted-by":"crossref","unstructured":"LiaoF. LiangM. DongY. PangT. HuX. andZhuJ. Defense against adversarial attacks using high-level representation guided denoiser Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition 2018 IEEE 1778\u20131787.","DOI":"10.1109\/CVPR.2018.00191"},{"key":"e_1_2_9_32_2","doi-asserted-by":"crossref","unstructured":"LiuZ. LiuQ. LiuT. XuN. LinX. WangY. andWenW. Feature distillation: DNN-oriented jpeg compression against adversarial examples 2019 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR) 2019 IEEE 860\u2013868.","DOI":"10.1109\/CVPR.2019.00095"},{"key":"e_1_2_9_33_2","doi-asserted-by":"crossref","unstructured":"JiaX. WeiX. CaoX. andForooshH. Comdefend: an efficient image compression model to defend adversarial examples Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition 2019 IEEE 6084\u20136092.","DOI":"10.1109\/CVPR.2019.00624"},{"key":"e_1_2_9_34_2","unstructured":"CohenJ. RosenfeldE. andKolterZ. Certified adversarial robustness via randomized smoothing International Conference on Machine Learning 2019 PMLR 1310\u20131320."},{"key":"e_1_2_9_35_2","doi-asserted-by":"crossref","unstructured":"WangX.andHeK. Enhancing the transferability of adversarial attacks through variance tuning Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern recognition 2021 IEEE 1924\u20131933.","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"e_1_2_9_36_2","unstructured":"JohnsonR.andZhangT. Accelerating stochastic gradient descent using predictive variance reduction Advances in Neural Information Processing Systems2013 26."},{"key":"e_1_2_9_37_2","doi-asserted-by":"crossref","unstructured":"SzegedyC. VanhouckeV. IoffeS. ShlensJ. andWojnaZ. Rethinking the inception architecture for computer vision Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition 2016 IEEE 2818\u20132826.","DOI":"10.1109\/CVPR.2016.308"},{"key":"e_1_2_9_38_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v31i1.11231"}],"container-title":["IET Information Security"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/downloads.hindawi.com\/journals\/ietis\/2024\/7983842.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/ietis\/2024\/7983842.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/ietresearch.onlinelibrary.wiley.com\/doi\/pdf\/10.1049\/2024\/7983842","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,5]],"date-time":"2025-11-05T08:51:40Z","timestamp":1762332700000},"score":1,"resource":{"primary":{"URL":"https:\/\/ietresearch.onlinelibrary.wiley.com\/doi\/10.1049\/2024\/7983842"}},"subtitle":[],"editor":[{"given":"Guowen","family":"Xu","sequence":"additional","affiliation":[]}],"short-title":[],"issued":{"date-parts":[[2024,1]]},"references-count":38,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2024,1]]}},"alternative-id":["10.1049\/2024\/7983842"],"URL":"https:\/\/doi.org\/10.1049\/2024\/7983842","archive":["Portico"],"relation":{},"ISSN":["1751-8709","1751-8717"],"issn-type":[{"type":"print","value":"1751-8709"},{"type":"electronic","value":"1751-8717"}],"subject":[],"published":{"date-parts":[[2024,1]]},"assertion":[{"value":"2023-11-27","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-04-30","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-05-11","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"7983842"}}