Abstract:With the development of adversarial attacks, adversairal examples have been widely used to enhance the robustness of the training models on deep neural networks. Although considerable efforts of adversarial attacks on improving the transferability of adversarial examples have been developed, the attack success rate of the transfer-based attacks on the surrogate model is much higher than that on victim model under the low attack strength (e.g., the attack strength $\epsilon=8/255$). In this paper, we first systematically investigated this issue and found that the enormous difference of attack success rates between the surrogate model and victim model is caused by the existence of a special area (known as fuzzy domain in our paper), in which the adversarial examples in the area are classified wrongly by the surrogate model while correctly by the victim model. Then, to eliminate such enormous difference of attack success rates for improving the transferability of generated adversarial examples, a fuzziness-tuned method consisting of confidence scaling mechanism and temperature scaling mechanism is proposed to ensure the generated adversarial examples can effectively skip out of the fuzzy domain. The confidence scaling mechanism and the temperature scaling mechanism can collaboratively tune the fuzziness of the generated adversarial examples through adjusting the gradient descent weight of fuzziness and stabilizing the update direction, respectively. Specifically, the proposed fuzziness-tuned method can be effectively integrated with existing adversarial attacks to further improve the transferability of adverarial examples without changing the time complexity. Extensive experiments demonstrated that fuzziness-tuned method can effectively enhance the transferability of adversarial examples in the latest transfer-based attacks.

Frequency-based methods for improving the imperceptibility and transferability of adversarial examples

Exploiting Frequency Characteristics for Boosting the Invisibility of Adversarial Attacks

Towards a Novel Perspective on Adversarial Examples Driven by Frequency

An Adversarial Attack Via Feature Contributive Regions

Toward feature space adversarial attack in the frequency domain

Boosting the Transferability of Adversarial Attacks With Frequency-Aware Perturbation

Transferable Adversarial Attack Based on Sensitive Perturbation Analysis in Frequency Domain

Exploring Frequencies via Feature Mixing and Meta-Learning for Improving Adversarial Transferability

Leveraging Information Consistency in Frequency and Spatial Domain for Adversarial Attacks

Frequency Domain Model Augmentation for Adversarial Attack

Frequency-driven Imperceptible Adversarial Attack on Semantic Similarity

A High-Transferability Adversarial Sample Generation Method Incorporating Frequency Domain Transformations

LFAA: Crafting Transferable Targeted Adversarial Examples with Low-Frequency Perturbations

Decision-Based Adversarial Attack With Frequency Mixup

FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attacks

Enhancing Transferability of Adversarial Examples Through Mixed-Frequency Inputs

GreedyFool: Multi-factor imperceptibility and its application to designing a black-box adversarial attack

Boosting the Targeted Transferability of Adversarial Examples via Salient Region & Weighted Feature Drop

DualFlow: Generating imperceptible adversarial examples by flow field and normalize flow-based model

Fuzziness-tuned: Improving the Transferability of Adversarial Examples

Frequency-Aware GAN for Imperceptible Transfer Attack on 3D Point Clouds