Ensemble Attack Network: Methods and Analysis

• Ensemble Attack Network is defined as a coordinated fusion of heterogeneous models, used to synthesize adversarial examples and detect malicious activity.
• It aggregates multiple surrogate models or learners to boost black-box transferability in adversarial settings and improve security detection accuracy.
• Advanced techniques such as gradient coordination, variance reduction, and adaptive reweighting are employed to optimize performance across diverse security applications.

Ensemble Attack Network is a cross-domain term used for several distinct but structurally related constructs in security research. In adversarial machine learning, it most commonly denotes an attack-side ensemble method that aggregates multiple surrogate models in order to synthesize adversarial examples with stronger black-box transferability (Liu et al., 2018, Xiong et al., 2021, Ma et al., 2 May 2025). In intrusion detection and cyber-physical security, the same term is used for ensemble-based detection pipelines that combine clustering, deep networks, trees, or online learners to identify malicious traffic in IoT, IIoT, ICS, WSN, and DDoS settings (Ahmed et al., 2022, Tabbaa et al., 2022, Priya et al., 2021, S et al., 2024). A further usage appears in robust watermarking, where an ensemble attack network is a trainable adversary inserted into the training loop to harden an encoder–decoder system against post-processing distortions (Huang et al., 3 Sep 2025). Across these usages, the common principle is not a single canonical architecture but the coordinated fusion of heterogeneous attack or detection signals.

1. Terminological scope and historical usage

The term acquired its earliest clear adversarial-example meaning in transfer-based competitions, where a locally accessible ensemble of classifiers was attacked so that the resulting perturbation would transfer to an unseen black-box target. The CAAD 2018 targeted attack formulated an iterative ensemble adversarial attack over six equally weighted ImageNet models—Inception V3, ResNet-50, ResNet-101, Inception-ResNet V2, EnsAdv Inception-ResNet V2, and Adv Inception V3—and optimized a Jensen-derived “loss ensemble” rather than the more tightly coupled probability-ensemble loss (Liu et al., 2018). The IJCAI19-winning EPGD then specialized this idea for efficient targeted $L_2$ attacks on an ensemble of Inception V3, ResNet-50, and VGG-16 by changing ensemble weights and step size per iteration and per input (Wu et al., 2019).

Subsequent adversarial-attack work expanded the ensemble concept from static averaging to gradient coordination. SVRE reframed iterative ensemble attack as a stochastic optimization problem over model index and introduced an SVRG-style control variate to reduce model-space gradient variance (Xiong et al., 2021). HEAT later reinterpreted each surrogate model as a “domain,” using SVD to extract consensus gradient directions and adaptive weighting to balance intra-domain coherence with inter-domain diversity (Ma et al., 2 May 2025). MORA, although aimed at robustness evaluation rather than transfer attack generation, retained the same ensemble-centered perspective and attacked defended ensembles by reweighing sub-model contributions at each iteration (Yu et al., 2022).

In parallel, network-security papers used the same label for detection systems rather than perturbation generators. These works include an unsupervised IoT attack detector based on MBKMeans, FCM, OPTICS, and DBN (Ahmed et al., 2022), a two-phase IIoT detector that blends SVM, Naive Bayes, Decision Tree, Random Forest, and ANN (Priya et al., 2021), an online WSN intrusion detector based on ARF and HAT (Tabbaa et al., 2022), an attack-specialized stacked detector for NSL-KDD (Dissanayake et al., 14 Oct 2025), and a self-attention-enabled weighted ensemble for DDoS classification (S et al., 2024). This terminological divergence is central: in one literature, the ensemble is the attacker; in another, it is the detector.

Usage family	Representative papers	Core mechanism
Transferable adversarial attack	(Liu et al., 2018, Wu et al., 2019, Xiong et al., 2021, Ma et al., 2 May 2025)	Aggregate or reweight surrogate-model gradients
Ensemble robustness evaluation	(Yu et al., 2022, Bogun et al., 2021)	Attack or regularize multi-model defenses
Attack detection network	(Ahmed et al., 2022, Tabbaa et al., 2022, Priya et al., 2021, S et al., 2024, Dissanayake et al., 14 Oct 2025, Alzubi et al., 21 May 2026)	Fuse multiple detectors or classifier branches
Adversarial training for watermarking	(Huang et al., 3 Sep 2025)	Train against multiple learned attack modules

2. Mathematical foundations in adversarial-example generation

In the adversarial-example literature, the basic ensemble objective is to find a perturbation that simultaneously increases loss across multiple source models. SVRE states this explicitly: for source models $\{f_m\}_{m=1}^M$, input $x$, label $y$, loss $L$, norm budget $\varepsilon$, and norm choice $p \in \{\infty,2\}$, the attacker solves

$$\max_{\delta}\; J(\delta)\triangleq \frac{1}{M}\sum_{m=1}^{M} L(f_m(x+\delta),y) \quad \text{s.t.} \quad \|\delta\|_p \le \varepsilon .$$

Iterative variants then update $\delta_t$ or $x_t^{adv}$ by projected sign steps, with momentum, translation invariance, input diversity, or scale averaging inserted as plug-ins (Xiong et al., 2021).

A second design choice is the level at which model outputs are fused. SVRE reports three standard formulations: ensemble on predictions, ensemble on logits, and ensemble on losses, with uniform weights $\{f_m\}_{m=1}^M$0 in its experiments. The same paper states that ensemble on logits is empirically stronger than prediction or loss averaging (Xiong et al., 2021). Earlier CAAD 2018 work instead emphasized probability-space coupling and applied Jensen’s inequality to upper-bound the probability-ensemble cross-entropy by an average of per-model cross-entropies, thereby producing an additive loss ensemble with simple per-model gradients (Liu et al., 2018). EPGD departed from equal weighting and formed ensemble logits as

$\{f_m\}_{m=1}^M$1

where the weights were adapted online to focus on models not yet fooled (Wu et al., 2019).

These formulations are not interchangeable. Loss averaging, logit fusion, Jensen-relaxed probability ensembles, and dynamically weighted logit sums induce different gradient fields. This suggests that the defining issue in ensemble attack design is not merely “using multiple models,” but specifying how the ensemble objective transforms disagreement among those models into an update direction.

3. Gradient coordination, variance reduction, and model reweighting

A central problem in ensemble attacks is cross-model gradient disagreement. SVRE formalized this as a model-space gradient variance,

$\{f_m\}_{m=1}^M$2

and argued that large variance produces noisy updates, poor local optima, and overfitting to surrogate peculiarities (Xiong et al., 2021). Its solution was a variance-reduced estimator,

$\{f_m\}_{m=1}^M$3

which is unbiased but has lower variance because it subtracts the sampled model’s reference gradient and adds back the full reference gradient. In ImageNet experiments with four normal source models and $\{f_m\}_{m=1}^M$4, this mechanism improved average transfer success across hold-out normal models from $\{f_m\}_{m=1}^M$5 to $\{f_m\}_{m=1}^M$6 for I-FGSM, from $\{f_m\}_{m=1}^M$7 to $\{f_m\}_{m=1}^M$8 for MI-FGSM, and from $\{f_m\}_{m=1}^M$9 to $x$0 for TI-DIM (Xiong et al., 2021).

HEAT attacked the same disagreement problem differently. Rather than reducing stochastic variance around an ensemble mean, it used SVD on the stacked gradient matrix

$x$1

to synthesize a consensus direction from the top singular components, then combined this with a Dual-Harmony Weight Orchestrator that assigns per-model weights based on intra-domain coherence and inter-domain divergence (Ma et al., 2 May 2025). Its formulation treats each surrogate model as a domain and computes the final gradient as

$x$2

followed by a clipped sign update. On average over eight black-box models, HEAT raised CIFAR-10 ASR from $x$3 for Ens to $x$4, ImageNet ASR from $x$5 to $x$6, and under DI2-FGSM on CIFAR-10 from $x$7 to $x$8 (Ma et al., 2 May 2025).

EPGD and MORA addressed weighting from different operational viewpoints. EPGD targeted ensemble surrogates under an $x$9-style PGD procedure, setting weights of already fooled models to zero and scaling step size by the current ensemble target confidence. In competition-style evaluation, EPGD with TensorFlow, three models, and all implementation tricks reduced the final score to $y$0, compared with $y$1 for PGD with TensorFlow and two models (Wu et al., 2019). MORA, by contrast, was designed to evaluate defended ensembles and argued that standard attacks overestimate robustness because of gradient obfuscation under softmax or voting aggregation and because diversified sub-model gradients cancel when simply averaged. Its adaptive reweighing is derived from the sensitivity of the ensemble decision margin to each sub-model’s decision margin, and it reported that most ensemble defenses exhibit near or exactly $y$2 robustness against MORA with $y$3 perturbation within $y$4 on CIFAR-10 and $y$5 on CIFAR-100 (Yu et al., 2022).

Taken together, these methods define an internal progression within adversarial ensemble design: from equal-weighted aggregation, to adaptive inclusion and step scheduling, to explicit variance reduction, to consensus-subspace extraction, and finally to attack-time reweighting against ensemble defenses themselves.

4. Detection-oriented ensemble attack networks in IoT, IIoT, ICS, WSN, and DDoS security

In intrusion-detection literature, an ensemble attack network is a detection architecture that fuses multiple learners to identify malicious traffic or cyber-physical anomalies. One influential unsupervised variant generates pseudo-labels from heterogeneous clusterers and then trains a deep model on those system-generated labels. The IoT framework in (Ahmed et al., 2022) used MBKMeans, FCM, and OPTICS with weighted voting

$y$6

with weights $y$7, $y$8, and $y$9, then trained LSTM, MLP, and DBN classifiers on the generated labels. DBN was reported as best, achieving approximately $L$0 accuracy on both NSL-KDD and TON-IoT, with FAR $L$1 on NSL-KDD and $L$2 on TON-IoT, alongside ROC-AUC $L$3 on both datasets (Ahmed et al., 2022).

A more recent benign-only anomaly-detection line replaced clusterers with ensembles of outlier detectors. UNAD+ trained $L$4 LOF and $L$5 Isolation Forest detectors on benign data only, aggregated hard votes with Weighted Majority Voting using validation F1 as weights,

$L$6

then refined the pseudo-labels with a Random Forest and attached LIME plus a surrogate decision tree for explainability (Alzubi et al., 21 May 2026). It reported full-system F1 of $L$7 on CICIDS2017 and $L$8 on NSL-KDD, while reducing FPR from $L$9 to $\varepsilon$0 on CICIDS2017 and from $\varepsilon$1 to $\varepsilon$2 on NSL-KDD. WMV also eliminated voting ties, reducing them from $\varepsilon$3 to $\varepsilon$4 on CICIDS2017 and from $\varepsilon$5 to $\varepsilon$6 on NSL-KDD (Alzubi et al., 21 May 2026).

Other works instantiated the ensemble directly at classifier level. The DDoS framework in (S et al., 2024) used three self-attention-enabled CNN branches—SA-CNN + XGBoost, SA-CNN + LSTM, and SA-CNN + Random Forest—combined by a convex weighted ensemble with learned weights $\varepsilon$7 and a light global merger. On CIC-DDoS2019 it achieved accuracy $\varepsilon$8, precision $\varepsilon$9, recall $p \in \{\infty,2\}$0, and F1-score $p \in \{\infty,2\}$1, outperforming each individual branch. The attack-specialized NSL-KDD system in (Dissanayake et al., 14 Oct 2025) trained separate detectors for DoS, Probe, R2L, and U2R, fused their probabilities with a Random Forest meta-classifier, and reported KDDTest+ accuracy $p \in \{\infty,2\}$2, precision $p \in \{\infty,2\}$3, recall $p \in \{\infty,2\}$4, F1 $p \in \{\infty,2\}$5, and ROC-AUC $p \in \{\infty,2\}$6.

In cyber-physical and streaming settings, ensemble structure often addresses class imbalance and concept drift. The ICS detector in (Al-Abassi et al., 2020) trained four stacked autoencoders on balanced subsets, then four DNNs on the learned representations, and finally a Decision Tree on the concatenated outputs; it reported GP F1 $p \in \{\infty,2\}$7 and SWaT F1 $p \in \{\infty,2\}$8. The WSN stream-learning study in (Tabbaa et al., 2022) used majority-voted ARF+HAT and HAT(10) ensembles under prequential evaluation, reaching recall $p \in \{\infty,2\}$9 and $$\max_{\delta}\; J(\delta)\triangleq \frac{1}{M}\sum_{m=1}^{M} L(f_m(x+\delta),y) \quad \text{s.t.} \quad \|\delta\|_p \le \varepsilon .$$0, respectively. The IIoT two-phase detector in (Priya et al., 2021) blended SVM, Naive Bayes, and Decision Tree into a Random Forest, compared that with an ANN, and reported highest accuracy of $$\max_{\delta}\; J(\delta)\triangleq \frac{1}{M}\sum_{m=1}^{M} L(f_m(x+\delta),y) \quad \text{s.t.} \quad \|\delta\|_p \le \varepsilon .$$1 across WUSTL_IIOT-2018, N_BaIoT, and Bot_IoT.

These detection-oriented systems share the ensemble label but differ fundamentally from adversarial-example generation: their objective is classification reliability under attack traffic, not perturbation synthesis against models.

5. Ensemble robustness, defensive diversification, and trainable attack networks

A separate line of work studies ensembles not as detectors or attackers, but as objects to be regularized or stress-tested. Saliency Diversified Deep Ensemble proposed Saliency Map Diversity as a training objective that reduces pairwise alignment among member saliency maps by minimizing

$$\max_{\delta}\; J(\delta)\triangleq \frac{1}{M}\sum_{m=1}^{M} L(f_m(x+\delta),y) \quad \text{s.t.} \quad \|\delta\|_p \le \varepsilon .$$2

where $$\max_{\delta}\; J(\delta)\triangleq \frac{1}{M}\sum_{m=1}^{M} L(f_m(x+\delta),y) \quad \text{s.t.} \quad \|\delta\|_p \le \varepsilon .$$3 is the true-class saliency of member $$\max_{\delta}\; J(\delta)\triangleq \frac{1}{M}\sum_{m=1}^{M} L(f_m(x+\delta),y) \quad \text{s.t.} \quad \|\delta\|_p \le \varepsilon .$$4 (Bogun et al., 2021). With $$\max_{\delta}\; J(\delta)\triangleq \frac{1}{M}\sum_{m=1}^{M} L(f_m(x+\delta),y) \quad \text{s.t.} \quad \|\delta\|_p \le \varepsilon .$$5 and ensemble size $$\max_{\delta}\; J(\delta)\triangleq \frac{1}{M}\sum_{m=1}^{M} L(f_m(x+\delta),y) \quad \text{s.t.} \quad \|\delta\|_p \le \varepsilon .$$6 in the main text, this approach improved robustness under medium and high strength attacks by reducing transferability between ensemble members. For MNIST at $$\max_{\delta}\; J(\delta)\triangleq \frac{1}{M}\sum_{m=1}^{M} L(f_m(x+\delta),y) \quad \text{s.t.} \quad \|\delta\|_p \le \varepsilon .$$7, white-box PGD robust accuracy rose from $$\max_{\delta}\; J(\delta)\triangleq \frac{1}{M}\sum_{m=1}^{M} L(f_m(x+\delta),y) \quad \text{s.t.} \quad \|\delta\|_p \le \varepsilon .$$8 for a naive ensemble to $$\max_{\delta}\; J(\delta)\triangleq \frac{1}{M}\sum_{m=1}^{M} L(f_m(x+\delta),y) \quad \text{s.t.} \quad \|\delta\|_p \le \varepsilon .$$9 for SMD and $\delta_t$0 for the combined SMD+ variant (Bogun et al., 2021).

MORA belongs in the same robustness-evaluation context but reaches the opposite conclusion: ensemble defenses that diversify gradients may appear strong under standard PGD, CW, or AutoAttack variants while in fact being brittle under a model-reweighing attack tailored to ensemble structure (Yu et al., 2022). This creates a methodological tension within ensemble-robustness research. Gradient diversity is simultaneously a defense mechanism against transferability and a source of attack difficulty that can mask true vulnerability under inadequate white-box evaluation.

The watermarking literature offers yet another interpretation. In post-processing watermarking, the ensemble attack network is not the final deployed model but a differentiable adversary used during training. The framework in (Huang et al., 3 Sep 2025) combined a spatial CNN attack network with a frequency-domain DCT-Transformer attack network through several ensemble schemes, including Model Cascade, Random Blend, Aggregate Blend, and Model Parallel. Model Parallel performed best on WAVES distortions. The combined training procedure significantly improved robustness, including an $\delta_t$1 gain for StegaStamp under the WAVES Regeneration Attack and an $\delta_t$2 improvement for Stable Signature under WAVES distortions (Huang et al., 3 Sep 2025). Here, the ensemble attack network is neither a detector nor a transfer attack; it is a learned perturbation generator that broadens the training-time attack distribution.

6. Empirical patterns, computational trade-offs, and reproducibility issues

Across adversarial-example generation papers, the consistent empirical pattern is that simple averaging is rarely the strongest strategy. SVRE reported improvements over standard ensemble baselines on normal, adversarially trained, and defense models, but incurred an estimated overhead factor of approximately $\delta_t$3; with $\delta_t$4 and $\delta_t$5, this is about $\delta_t$6 the cost of the equal-weighted ensemble baseline (Xiong et al., 2021). HEAT improved average ASR substantially on CIFAR-10, CIFAR-100, and ImageNet, but added SVD and pairwise alignment computations to the per-iteration budget (Ma et al., 2 May 2025). EPGD improved competition scores through adaptive weighting and step-size scheduling while remaining far more efficient than CW-style optimization (Wu et al., 2019). MORA, conversely, argued that stronger evaluation requires more adaptive ensemble-aware attacks, reporting up to $\delta_t$7 faster convergence than APGD under certain budgets while simultaneously driving many defended ensembles to near-zero robust accuracy (Yu et al., 2022).

In detection-oriented systems, ensemble gains often arise from heterogeneity, pseudo-label refinement, or specialization, but the cost profile shifts toward training complexity and reproducibility. UNAD+ adds $\delta_t$8 benign-only anomaly detectors, SMOTE, RF refinement, LIME, and a global surrogate tree, yet reports F1 above $\delta_t$9 with much lower FPR than the original UNAD (Alzubi et al., 21 May 2026). The DDoS self-attention ensemble improves over single branches, but its training includes end-to-end CNN+attention+LSTM learning plus separate tree-based learners and a fusion layer (S et al., 2024). The WSN and IIoT papers emphasize drift adaptation or blended model selection, but do not fully quantify memory footprint, false positive breakdowns, or full hyperparameter sensitivity (Tabbaa et al., 2022, Priya et al., 2021).

A recurring reproducibility issue is under-specification of components. The unsupervised IoT detector in (Ahmed et al., 2022) did not report OPTICS parameters, FCM fuzziness, or DBN architecture details, even though these choices affect pseudo-label quality and final DBN performance. The IIoT ensemble in (Priya et al., 2021) reported the two-phase blending/stacking structure and the final accuracy level, but not the full SVM, Random Forest, or ANN hyperparameterization. This suggests that, outside benchmark results, practical replication often depends less on the ensemble label itself than on omitted optimization and preprocessing details.

7. Conceptual distinctions and continuing directions

Three distinctions structure the modern literature. First, there is the difference between attack-side ensemble methods and detection-side ensemble networks. The former optimize perturbations over multiple surrogate models, usually under explicit norm constraints and projection operators (Liu et al., 2018, Xiong et al., 2021). The latter fuse multiple detectors, clusterers, or classifier branches to identify malicious samples or anomalous flows (Ahmed et al., 2022, S et al., 2024). Second, there is the difference between offensive ensemble attacks and defensive or evaluative ensemble methods, as seen in SMD and MORA (Bogun et al., 2021, Yu et al., 2022). Third, there is the training-time use of learned attack ensembles, exemplified by watermarking, where the ensemble exists to improve robustness of another model rather than to act directly at deployment (Huang et al., 3 Sep 2025).

Within adversarial machine learning, the main unresolved issue is how to harmonize shared gradient structure with useful disagreement. SVRE interprets disagreement as variance to be reduced; HEAT interprets it as domain diversity to be orchestrated; MORA interprets it as a pitfall that causes standard attacks to underestimate vulnerability (Xiong et al., 2021, Ma et al., 2 May 2025, Yu et al., 2022). In network intrusion detection, the analogous unresolved issue is how to combine heterogeneity without sacrificing transparency, latency, or reproducibility. UNAD+ adds explainability and pseudo-label refinement, while online WSN ensembles prioritize prequential adaptation and streaming feasibility (Alzubi et al., 21 May 2026, Tabbaa et al., 2022).

A plausible implication is that “Ensemble Attack Network” will continue to remain a family resemblance term rather than a standardized model name. What unifies the cited works is not domain, architecture, or threat model, but a design doctrine: a single attack or detection function is made more effective by coordinating multiple learners whose errors, sensitivities, or views of the data are intentionally non-identical.