{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T17:03:30Z","timestamp":1767978210706,"version":"3.49.0"},"reference-count":65,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T00:00:00Z","timestamp":1767916800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["BDCC"],"abstract":"<jats:p>Deep neural networks are vulnerable and susceptible to adversarial examples, which can induce erroneous predictions by injecting imperceptible perturbations. Transferability is a crucial property of adversarial examples, enabling effective attacks under black-box settings. Adversarial examples at flat maxima-those around which the loss peaks and grows slowly-have been demonstrated to exhibit higher transferability. Existing methods to achieve flat maxima rely on the gradient of the worst-case loss within the small neighborhood around the adversarial point. However, the neighborhood structure is typically defined as a Euclidean space, which neglects the input space\u2019s information geometry, leading to suboptimal results. In this work, we build upon the idea of flat maxima but extend the neighborhood structure from Euclidean space to the manifold measured by the Fisher metric, which takes into account the information geometry of the data space. In the non-Euclidean case, we search for the worst-case point in the direction of the natural gradient with respect to adversarial examples. The natural gradient adjusts the original gradient using the Fisher information matrix, giving the steepest direction in the manifold. Furthermore, to reduce the computational cost of calculating the Fisher information matrix, we introduce a diagonal approximation of the matrix and propose an empirical Fisher method under the model ensemble setting. Experimental results demonstrate that our proposed manifold extensions significantly enhance attack success rates against both normally and adversarially trained models. In particular, compared to methods relying on the Euclidean metric, our approach demonstrates more efficient performance.<\/jats:p>","DOI":"10.3390\/bdcc10010027","type":"journal-article","created":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T12:52:17Z","timestamp":1767963137000},"page":"27","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Improving Flat Maxima with Natural Gradient for Better Adversarial Transferability"],"prefix":"10.3390","volume":"10","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-1458-4514","authenticated-orcid":false,"given":"Yunfei","family":"Long","sequence":"first","affiliation":[{"name":"College of Computer Science and Technology, Harbin Engineering University, Harbin 150001, China"}]},{"given":"Huosheng","family":"Xu","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Harbin Engineering University, Harbin 150001, China"}]}],"member":"1968","published-online":{"date-parts":[[2026,1,9]]},"reference":[{"key":"ref_1","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2013). Intriguing properties of neural networks. arXiv."},{"key":"ref_2","unstructured":"Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Guo, R., Chen, Q., Liu, H., and Wang, W. (2024). Adversarial robustness enhancement for deep learning-based soft sensors: An adversarial training strategy using historical gradients and domain adaptation. Sensors, 24.","DOI":"10.3390\/s24123909"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., and Li, J. (2018, January 18\u201322). Boosting adversarial attacks with momentum. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Salt Lake City, UT, USA.","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref_5","unstructured":"Lin, J., Song, C., He, K., Wang, L., and Hopcroft, J.E. (2020). Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks. Proceedings of the 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, 26\u201330 April 2020, OpenReview.net."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Wang, X., and He, K. (2021, January 19\u201325). Enhancing the transferability of adversarial attacks through variance tuning. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Virtual.","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Wang, X., Lin, J., Hu, H., Wang, J., and He, K. (2021). Boosting adversarial transferability through enhanced momentum. arXiv.","DOI":"10.5244\/C.35.186"},{"key":"ref_8","first-page":"70141","article-title":"Boosting adversarial transferability by achieving flat local maxima","volume":"36","author":"Ge","year":"2023","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_9","first-page":"29845","article-title":"Boosting the transferability of adversarial attacks with reverse adversarial perturbation","volume":"35","author":"Qin","year":"2022","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Yang, X., Lin, J., Zhang, H., Yang, X., and Zhao, P. (2023). Improving the transferability of adversarial examples via direction tuning. arXiv.","DOI":"10.1016\/j.ins.2023.119491"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Zhu, H., Ren, Y., Sui, X., Yang, L., and Jiang, W. (2023, January 2\u20136). Boosting adversarial transferability via gradient relevance attack. Proceedings of the IEEE\/CVF International Conference on Computer Vision, Paris, France.","DOI":"10.1109\/ICCV51070.2023.00437"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"2569","DOI":"10.1109\/TNNLS.2021.3106961","article-title":"Exploring Adversarial Attack in Spiking Neural Networks with Spike-Compatible Gradient","volume":"34","author":"Liang","year":"2023","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Chen, J., Feng, Z., Zeng, R., Pu, Y., Zhou, C., Jiang, Y., Gan, Y., Li, J., and Ji, S. (2025). Enhancing Adversarial Transferability with Adversarial Weight Tuning. Proceedings of the AAAI Conference on Artificial Intelligence, 2025, AAAI Press.","DOI":"10.1609\/aaai.v39i2.32203"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Xie, C., Zhang, Z., Zhou, Y., Bai, S., Wang, J., Ren, Z., and Yuille, A.L. (2019, January 16\u201320). Improving transferability of adversarial examples with input diversity. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Long Beach, CA, USA.","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Dong, Y., Pang, T., Su, H., and Zhu, J. (2019, January 16\u201320). Evading defenses to transferable adversarial examples by translation-invariant attacks. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Long Beach, CA, USA.","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Wang, X., He, X., Wang, J., and He, K. (2021, January 11\u201317). Admix: Enhancing the transferability of adversarial attacks. Proceedings of the IEEE\/CVF International Conference on Computer Vision, Virtual.","DOI":"10.1109\/ICCV48922.2021.01585"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Wang, X., Zhang, Z., and Zhang, J. (2023, January 2\u20136). Structure invariant transformation for better adversarial transferability. Proceedings of the IEEE\/CVF International Conference on Computer Vision, Paris, France.","DOI":"10.1109\/ICCV51070.2023.00425"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"3778","DOI":"10.1109\/TMM.2023.3315550","article-title":"Boosting adversarial transferability with learnable patch-wise masks","volume":"26","author":"Wei","year":"2023","journal-title":"IEEE Trans. Multimed."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Zhang, J., Huang, J.t., Wang, W., Li, Y., Wu, W., Wang, X., Su, Y., and Lyu, M.R. (2023, January 18\u201322). Improving the transferability of adversarial samples by path-augmented method. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada.","DOI":"10.1109\/CVPR52729.2023.00790"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Xiong, Y., Lin, J., Zhang, M., Hopcroft, J.E., and He, K. (2022, January 19\u201324). Stochastic variance reduced ensemble adversarial attack for boosting the adversarial transferability. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, New Orleans, LA, USA.","DOI":"10.1109\/CVPR52688.2022.01456"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Chen, B., Yin, J., Chen, S., Chen, B., and Liu, X. (2023, January 2\u20136). An adaptive model ensemble adversarial attack for boosting adversarial transferability. Proceedings of the IEEE\/CVF International Conference on Computer Vision, Paris, France.","DOI":"10.1109\/ICCV51070.2023.00414"},{"key":"ref_22","unstructured":"Chen, H., Zhang, Y., Dong, Y., Yang, X., Su, H., and Zhu, J. (2023). Rethinking model ensemble in transfer-based adversarial attacks. arXiv."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Huang, H., Chen, Z., Chen, H., Wang, Y., and Zhang, K. (2023, January 18\u201322). T-sea: Transfer-based self-ensemble attack on object detection. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada.","DOI":"10.1109\/CVPR52729.2023.01965"},{"key":"ref_24","unstructured":"Foret, P., Kleiner, A., Mobahi, H., and Neyshabur, B. (2020). Sharpness-aware minimization for efficiently improving generalization. arXiv."},{"key":"ref_25","first-page":"26190","article-title":"Practical sharpness-aware minimization cannot converge all the way to optima","volume":"36","author":"Si","year":"2024","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_26","first-page":"24543","article-title":"Random sharpness-aware minimization","volume":"35","author":"Liu","year":"2022","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_27","unstructured":"Zhao, Y., Zhang, H., and Hu, X. (2022). Penalizing gradient norm for efficiently improving generalization in deep learning. Proceedings of the International Conference on Machine Learning, Baltimore, MD, USA, 17\u201323 July 2022, PMLR."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Liang, H., Zheng, H., Wang, H., He, L., Lin, H., and Liang, Y. (2025). Exploring Flatter Loss Landscape Surface via Sharpness-Aware Minimization with Linear Mode Connectivity. Mathematics, 13.","DOI":"10.3390\/math13081259"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"106829","DOI":"10.1016\/j.neunet.2024.106829","article-title":"Noise-resistant sharpness-aware minimization in deep learning","volume":"181","author":"Su","year":"2025","journal-title":"Neural Netw."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Zhang, Y., Hu, S., Zhang, L., Shi, J., Li, M., Liu, X., Wan, W., and Jin, H. (2024, January 19\u201323). Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferability. Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP), Los Alamitos, CA, USA.","DOI":"10.1109\/SP54263.2024.00010"},{"key":"ref_31","unstructured":"Zhao, C., Fletcher, P.T., Yu, M., Peng, Y., Zhang, G., and Shen, C. (February, January 27). The adversarial attack and detection under the fisher information metric. Proceedings of the AAAI Conference on Artificial Intelligence, Honolulu, HI, USA."},{"key":"ref_32","unstructured":"Kim, M., Li, D., Hu, S.X., and Hospedales, T. (2022). Fisher sam: Information geometry and sharpness aware minimisation. Proceedings of the International Conference on Machine Learning, PMLR."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Zhong, Q., Ding, L., Shen, L., Mi, P., Liu, J., Du, B., and Tao, D. (2022). Improving sharpness-aware minimization with fisher mask for better generalization on language models. arXiv.","DOI":"10.18653\/v1\/2022.findings-emnlp.300"},{"key":"ref_34","first-page":"13887","article-title":"A theory of transfer-based black-box attacks: Explanation and implications","volume":"36","author":"Chen","year":"2023","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_35","unstructured":"K, A., Hamner, B., and Goodfellow, I. (2025, December 29). NIPS 2017: Non-Targeted Adversarial Attack. Kaggle. Available online: https:\/\/kaggle.com\/competitions\/nips-2017-non-targeted-adversarial-attack."},{"key":"ref_36","unstructured":"Tram\u00e8r, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., and McDaniel, P. (2017). Ensemble adversarial training: Attacks and defenses. arXiv."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Liu, Z., Lin, Y., Cao, Y., Hu, H., Wei, Y., Zhang, Z., Lin, S., and Guo, B. (2021, January 11\u201317). Swin transformer: Hierarchical vision transformer using shifted windows. Proceedings of the IEEE\/CVF International Conference on Computer Vision, Montreal, BC, Canada.","DOI":"10.1109\/ICCV48922.2021.00986"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27\u201330). Deep residual learning for image recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"85","DOI":"10.1016\/j.acha.2021.12.009","article-title":"Loss landscapes and optimization in over-parameterized non-linear systems and neural networks","volume":"59","author":"Liu","year":"2022","journal-title":"Appl. Comput. Harmon. Anal."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Long, Y., Zhang, Q., Zeng, B., Gao, L., Liu, X., Zhang, J., and Song, J. (2022). Frequency domain model augmentation for adversarial attack. Proceedings of the European Conference on Computer Vision, Springer.","DOI":"10.1007\/978-3-031-19772-7_32"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Wang, K., He, X., Wang, W., and Wang, X. (2024, January 16\u201322). Boosting adversarial transferability by block shuffle and rotation. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Seattle, WA, USA.","DOI":"10.1109\/CVPR52733.2024.02297"},{"key":"ref_42","unstructured":"Liu, Y., Chen, X., Liu, C., and Song, D. (2016). Delving into transferable adversarial examples and black-box attacks. arXiv."},{"key":"ref_43","first-page":"17642","article-title":"Trs: Transferability reduced ensemble via promoting gradient diversity and model smoothness","volume":"34","author":"Yang","year":"2021","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_44","unstructured":"Li, Q., Guo, Y., Zuo, W., and Chen, H. (2023). Making substitute models more bayesian can enhance transferability of adversarial examples. arXiv."},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Tang, B., Wang, Z., Bin, Y., Dou, Q., Yang, Y., and Shen, H.T. (2024, January 17\u201321). Ensemble diversity facilitates adversarial transferability. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Seattle, WA, USA.","DOI":"10.1109\/CVPR52733.2024.02301"},{"key":"ref_46","unstructured":"Keskar, N.S., Mudigere, D., Nocedal, J., Smelyanskiy, M., and Tang, P.T.P. (2016). On large-batch training for deep learning: Generalization gap and sharp minima. arXiv."},{"key":"ref_47","unstructured":"Neyshabur, B., Bhojanapalli, S., McAllester, D., and Srebro, N. (2017). Exploring generalization in deep learning. Adv. Neural Inf. Process. Syst., 30."},{"key":"ref_48","unstructured":"Izmailov, P., Podoprikhin, D., Garipov, T., Vetrov, D., and Wilson, A.G. (2018). Averaging weights leads to wider optima and better generalization. arXiv."},{"key":"ref_49","unstructured":"Jiang, Y., Neyshabur, B., Mobahi, H., Krishnan, D., and Bengio, S. (2019). Fantastic generalization measures and where to find them. arXiv."},{"key":"ref_50","unstructured":"Qiu, C., Duan, Y., Zhao, L., and Wang, Q. (2024). Enhancing Adversarial Transferability Through Neighborhood Conditional Sampling. arXiv."},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Wu, T., Luo, T., and Wunsch, D.C. (2023). Gnp attack: Transferable adversarial examples via gradient norm penalty. Proceedings of the 2023 IEEE International Conference on Image Processing (ICIP), IEEE.","DOI":"10.1109\/ICIP49359.2023.10223158"},{"key":"ref_52","doi-asserted-by":"crossref","unstructured":"Huang, G., Liu, Z., Van Der Maaten, L., and Weinberger, K.Q. (2017, January 21\u201326). Densely connected convolutional networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref_53","unstructured":"Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., and Gelly, S. (2020). An image is worth 16x16 words: Transformers for image recognition at scale. arXiv."},{"key":"ref_54","unstructured":"Touvron, H., Cord, M., Douze, M., Massa, F., Sablayrolles, A., and J\u00e9gou, H. (2021). Training data-efficient image transformers & distillation through attention. Proceedings of the International Conference on Machine Learning, PMLR."},{"key":"ref_55","unstructured":"Wightman, R. (2025, December 29). PyTorch Image Models. Available online: https:\/\/github.com\/rwightman\/pytorch-image-models."},{"key":"ref_56","doi-asserted-by":"crossref","unstructured":"Liao, F., Liang, M., Dong, Y., Pang, T., Hu, X., and Zhu, J. (2018, January 18\u201323). Defense against adversarial attacks using high-level representation guided denoiser. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Salt Lake City, UT, USA.","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref_57","doi-asserted-by":"crossref","unstructured":"Jia, J., Cao, X., Wang, B., and Gong, N.Z. (2019). Certified robustness for top-k predictions against adversarial perturbations via randomized smoothing. arXiv.","DOI":"10.1145\/3366423.3380029"},{"key":"ref_58","doi-asserted-by":"crossref","unstructured":"Naseer, M., Khan, S., Hayat, M., Khan, F.S., and Porikli, F. (2020, January 13\u201319). A self-supervised approach for adversarial robustness. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Seattle, WA, USA.","DOI":"10.1109\/CVPR42600.2020.00034"},{"key":"ref_59","unstructured":"Nie, W., Guo, B., Huang, Y., Xiao, C., Vahdat, A., and Anandkumar, A. (2022). Diffusion models for adversarial purification. arXiv."},{"key":"ref_60","doi-asserted-by":"crossref","unstructured":"Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., and Wojna, Z. (2016, January 27\u201330). Rethinking the inception architecture for computer vision. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref_61","doi-asserted-by":"crossref","unstructured":"Sandler, M., Howard, A., Zhu, M., Zhmoginov, A., and Chen, L.C. (2018, January 18\u201323). Mobilenetv2: Inverted residuals and linear bottlenecks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Salt Lake City, UT, USA.","DOI":"10.1109\/CVPR.2018.00474"},{"key":"ref_62","unstructured":"Gao, L., Zhang, Q., Song, J., Liu, X., and Shen, H.T. (2020). Patch-wise attack for fooling deep neural network. Proceedings of the Computer Vision\u2013ECCV 2020: 16th European Conference, Glasgow, UK, August 23\u201328, 2020, Proceedings, Part XXVIII 16, Springer."},{"key":"ref_63","doi-asserted-by":"crossref","unstructured":"Szegedy, C., Ioffe, S., Vanhoucke, V., and Alemi, A. (2017, January 4\u20139). Inception-v4, inception-resnet and the impact of residual connections on learning. Proceedings of the AAAI Conference on Artificial Intelligence, San Francisco, CA, USA.","DOI":"10.1609\/aaai.v31i1.11231"},{"key":"ref_64","unstructured":"Simonyan, K., and Zisserman, A. (2014). Very deep convolutional networks for large-scale image recognition. arXiv."},{"key":"ref_65","doi-asserted-by":"crossref","first-page":"1059","DOI":"10.1080\/03610918908812806","article-title":"A stochastic estimator of the trace of the influence matrix for Laplacian smoothing splines","volume":"18","author":"Hutchinson","year":"1989","journal-title":"Commun. Stat. Simul. Comput."}],"container-title":["Big Data and Cognitive Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2504-2289\/10\/1\/27\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T12:56:46Z","timestamp":1767963406000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2504-2289\/10\/1\/27"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,9]]},"references-count":65,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,1]]}},"alternative-id":["bdcc10010027"],"URL":"https:\/\/doi.org\/10.3390\/bdcc10010027","relation":{},"ISSN":["2504-2289"],"issn-type":[{"value":"2504-2289","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,9]]}}}