Boosting adversarial attacks with future momentum and future transformation

Summary: This study proposes a Transformed Gradient method, which achieves a higher attack success rate with lower perturbations against an ensemble of black-box defense models through original gradient accumulation, gradient amplification, and gradient truncation. By optimizing coefficients of the source-model ensemble and introducing new evaluation metrics, it outperforms existing methods in generating adversarial examples.