Transferable adversarial attack based on sensitive perturbation analysis in frequency domain

Abstract

Recently, transferable adversarial attacks on deep neural networks (DNNs) have attracted significant attention. Although existing adversarial attacks have achieved high attack success rates in white-box scenarios, they perform poorly in black-box attack scenarios. To address the issue of low transferability in black-box adversarial attacks, we propose a frequency-sensitive perturbation-based black-box adversarial attack method to enhance transferability performance from the perspective of Fourier domain sensitivity. Initially, the Fourier sensitivity heatmaps of multiple substitute models are integrated to identify the common sensitive frequency region. Subsequently, the perturbations in the frequency domain are optimized through joint loss, thereby constraining the sensitive region and limiting the perturbations in the non-sensitive region. Finally, in each iteration, a spectral model enhancement is performed to simulate additional substitute models and reduce the spectral discrepancy between the substitute and target models. Extensive experimental results on benchmark datasets demonstrated the effectiveness of the proposed method. Compared to existing black-box adversarial attack methods, the proposed approach generates targeted and non-targeted adversarial samples with higher transfer success rates and good invisibility, thereby confirming its superiority.