MoCo-EA: Exploiting Adversarial Mode Connectivity for Efficient Evolutionary Attacks

Evolutionary algorithms for adversarial attacks leverage population-based search to discover perturbations without gradient information, but suffer from inefficient crossover operations that destroy adversarial properties through discrete interpolation. We introduce Mode Connectivity Evolutionary Attack (MoCo-EA), which replaces traditional crossover with a novel Bézier crossover operator that optimizes perturbations along a continuous Bézier curve between parent perturbations. Our key insight is that adversarial examples lie on connected manifolds where intermediate points maintain and often enhance attack effectiveness. We demonstrate three findings: (1) Successful adversarial perturbations exhibit mode connectivity; (2) Intermediate points along optimized paths achieve higher transferability than endpoints; (3) Bézier crossover dramatically outperforms discrete genetic operations while reducing convergence time and query requirements. By exploiting the geometric structure of adversarial space through path optimization, MoCo-EA provides an efficient and reliable method. Our work challenges the traditional view of adversarial examples as isolated points and opens new directions for both attack generation and defense research.

Image-recognition models can make wrong predictions when an image is changed in a very small way that is often hard for people to notice. Finding these failures is important, but standard search methods that keep and combine many candidate changes can waste effort when the combination destroys what made the original changes successful. We propose MoCo-EA, a method that treats two successful changes not as separate points, but as endpoints of a smooth path. MoCo-EA adjusts this path and tests points along it, so that new candidate changes are more likely to continue fooling the model. Our experiments show that successful changes are often connected by such paths, and that points between two successful changes can sometimes fool the model even more reliably than the endpoints. Using this idea, MoCo-EA finds successful attacks faster than a standard evolutionary search method on two widely used image datasets, CIFAR-10 and ImageNet. This gives researchers a more efficient way to study hidden weaknesses in image-recognition systems and can help guide the design of safer models.