Abstract:Recent studies have shown that Deep Neural Networks (DNNs) are susceptible to adversarial attacks, with frequency-domain analysis underscoring the significance of high-frequency components in influencing model predictions. Conversely, targeting low-frequency components has been effective in enhancing attack transferability on black-box models. In this study, we introduce a frequency decomposition-based feature mixing method to exploit these frequency characteristics in both clean and adversarial samples. Our findings suggest that incorporating features of clean samples into adversarial features extracted from adversarial examples is more effective in attacking normally-trained models, while combining clean features with the adversarial features extracted from low-frequency parts decomposed from the adversarial samples yields better results in attacking defense models. However, a conflict issue arises when these two mixing approaches are employed simultaneously. To tackle the issue, we propose a cross-frequency meta-optimization approach comprising the meta-train step, meta-test step, and final update. In the meta-train step, we leverage the low-frequency components of adversarial samples to boost the transferability of attacks against defense models. Meanwhile, in the meta-test step, we utilize adversarial samples to stabilize gradients, thereby enhancing the attack's transferability against normally trained models. For the final update, we update the adversarial sample based on the gradients obtained from both meta-train and meta-test steps. Our proposed method is evaluated through extensive experiments on the ImageNet-Compatible dataset, affirming its effectiveness in improving the transferability of attacks on both normally-trained CNNs and defense models.

Transferable Adversarial Attack Based on Sensitive Perturbation Analysis in Frequency Domain

Boosting the Transferability of Adversarial Attacks With Frequency-Aware Perturbation

Toward feature space adversarial attack in the frequency domain

Exploiting Frequency Characteristics for Boosting the Invisibility of Adversarial Attacks

A High-Transferability Adversarial Sample Generation Method Incorporating Frequency Domain Transformations

Frequency-based methods for improving the imperceptibility and transferability of adversarial examples

Exploring Frequencies via Feature Mixing and Meta-Learning for Improving Adversarial Transferability

Improving Adversarial Transferability via Neuron Attribution-Based Attacks

Improving Transferability of Universal Adversarial Perturbation with Feature Disruption.

LFAA: Crafting Transferable Targeted Adversarial Examples with Low-Frequency Perturbations

Delving into Transferable Adversarial Examples and Black-box Attacks

Towards a Novel Perspective on Adversarial Examples Driven by Frequency

Enhancing Transferability of Adversarial Examples Through Mixed-Frequency Inputs

Frequency Domain Model Augmentation for Adversarial Attack

Toward Understanding and Boosting Adversarial Transferability from a Distribution Perspective

Improving Adversarial Transferability by Stable Diffusion

Improving Transferable Targeted Attacks with Feature Tuning Mixup

FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attacks

A Survey on Transferability of Adversarial Examples across Deep Neural Networks

FDAA: A feature distribution-aware transferable adversarial attack method

Promoting Adversarial Transferability via Dual-Sampling Variance Aggregation and Feature Heterogeneity Attacks