Frequency Domain Model Augmentation for Adversarial Attack

2022/07/12 by Yuyang Long, Qilong Zhang, Long, Yuyang +11 · 16 citations
Computer Science · Medicine · #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #COVID-19 diagnosis using AI #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences

paper · pdf · doi:10.48550/arxiv.2207.05382

openalex publication_date 2022/07/12 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

For black-box attacks, the gap between the substitute model and the victim model is usually large, which manifests as a weak attack performance. Motivated by the observation that the transferability of adversarial examples can be improved by attacking diverse models simultaneously, model augmentation methods which simulate different models by using transformed images are proposed. However, existing transformations for spatial domain do not translate to significantly diverse augmented models. To tackle this issue, we propose a novel spectrum simulation attack to craft more transferable adversarial examples against both normally trained and defense models. Specifically, we apply a spectrum transformation to the input and thus perform the model augmentation in the frequency domain. We theoretically prove that the transformation derived from frequency domain leads to a diverse spectrum saliency map, an indicator we proposed to reflect the diversity of substitute models. Notably, our method can be generally combined with existing attacks. Extensive experiments on the ImageNet dataset demonstrate the effectiveness of our method, e.g., attacking nine state-of-the-art defense models with an average success rate of 95.4%. Our code is available in \urlhttps://github.com/yuyang-long/SSA.

Cited by

• Optimizing the Adversarial Perturbation with a Momentum-based Adaptive Matrix
• V-Attack: Targeting Disentangled Value Features for Controllable Adversarial Attacks on LVLMs
• Layer-wise Noise Guided Selective Wavelet Reconstruction for Robust Medical Image Segmentation
• Transferable Dual-Domain Feature Importance Attack against AI-Generated Image Detector
• Dynamic Parameter Optimization for Highly Transferable Transformation-Based Attacks
• Beyond Deceptive Flatness: Dual-Order Solution for Strengthening Adversarial Transferability
• Enhancing Adversarial Transferability by Balancing Exploration and Exploitation with Gradient-Guided Sampling
• Toward Efficient Inference Attacks: Shadow Model Sharing via Mixture-of-Experts
• SegTrans: Transferable Adversarial Examples for Segmentation Models
• SyncBreaker:Stage-Aware Multimodal Adversarial Attacks on Audio-Driven Talking Head Generation
• Latent Danger Zone: Distilling Unified Attention for Cross-Architecture Black-box Attacks
• ADVEDM:Fine-grained Adversarial Attack against VLM-based Embodied Agents
• Generating Transferrable Adversarial Examples via Local Mixing and Logits Optimization for Remote Sensing Object Recognition
• Boosting Adversarial Transferability via Residual Perturbation Attack
• Disrupting Semantic and Abstract Features for Better Adversarial Transferability
• ScoreAdv: Score-based Targeted Generation of Natural Adversarial Examples via Diffusion Models

Related

• Minimizing Maximum Model Discrepancy for Transferable Black-box Targeted Attacks
• Improving the Transferability of Adversarial Examples by Feature Augmentation
• Leveraging Information Consistency in Frequency and Spatial Domain for Adversarial Attacks
• Boosting Adversarial Transferability via High-Frequency Augmentation and Hierarchical-Gradient Fusion
• Black-Box Adversarial Attack with Transferable Model-based Embedding