Ada-MGNS: Enhancing Black-Box Transfer Attacks on Vision Transformers via Adaptive Momentum and Deep Attention Guidance

Abstract

Transfer-based black-box attacks are an important tool for evaluating deployed vision models, yet adversarial examples generated from Vision Transformer (ViT) surrogates often exhibit limited cross-architecture transferability. Existing momentum-based attacks are effective for convolutional neural network (CNN) surrogates, but they can accumulate stale directions and overfit the surrogate when the source model is a ViT. This paper presents Ada-MGNS, a ViToriented transferable attack that combines adaptive momentum with deep attention guidance. The adaptive component measures the directional discrepancy between the current guided gradient and the accumulated trajectory, and then attenuates stale momentum when the search direction becomes unstable. The guidance component fuses the classification gradient with an auxiliary gradient extracted from the last transformer block’s attention responses, encouraging perturbations to disturb both output decisions and semantic aggregation. Experiments on ImageNet with four ViT surrogates, thirteen standard black-box targets, and five defense models show that Ada-MGNS consistently improves attack success rates over representative ViT-specific baselines, remains compatible with DI/TI transformations and effective against adversarially trained and purification-based defenses.