Scholarlink

<p>Transfer-based adversarial attacks pose a substantial threat to deep neural networks, particularly in black-box scenarios where model information is restricted. Current methods for enhancing adversarial example transferability often involve gradient backpropagation, rendering them susceptible to local optima. To alleviate overfitting during adversarial example training, we propose seeking the maximum gradient flatness neighborhood to enhance example generalization. Beyond spatial information, we argue that frequency information plays a crucial role in computing gradient flatness. In this paper, we introduce the dual-domain gradient flatness attack (DGFA), a novel adversarial attack method that integrates both spatial and frequency gradient information. By transforming input samples to the frequency domain, randomly sampling similar examples within a neighborhood, and reconverting them back to the spatial domain, we generate flatter examples. To mitigate the impact of example randomness on transferability, we average the gradients of these flatter examples to update the final adversarial example. Empirical assessments demonstrate that DGFA significantly improves attack transferability for both convolutional neural network (CNN) and vision transformer (ViT) models, compared to state-of-the-art benchmarks. Our approach provides a robust tool for evaluating model robustness and developing effective defenses against adversarial attacks. Our code is available at: <a href="https://github.com/kaibo-Z/DGFA.git.">https://github.com/kaibo-Z/DGFA.git.</a></p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Enhancing Adversarial Transferability through Dual-Domain Gradient Flatness Optimization

  • 期刊论文

  • 发表日期：

    2025年7月17日

查看全文
  • Kaibo Zhang,
  • Tong Jia,
  • Weihua Chen

摘要

Transfer-based adversarial attacks pose a substantial threat to deep neural networks, particularly in black-box scenarios where model information is restricted. Current methods for enhancing adversarial example transferability often involve gradient backpropagation, rendering them susceptible to local optima. To alleviate overfitting during adversarial example training, we propose seeking the maximum gradient flatness neighborhood to enhance example generalization. Beyond spatial information, we argue that frequency information plays a crucial role in computing gradient flatness. In this paper, we introduce the dual-domain gradient flatness attack (DGFA), a novel adversarial attack method that integrates both spatial and frequency gradient information. By transforming input samples to the frequency domain, randomly sampling similar examples within a neighborhood, and reconverting them back to the spatial domain, we generate flatter examples. To mitigate the impact of example randomness on transferability, we average the gradients of these flatter examples to update the final adversarial example. Empirical assessments demonstrate that DGFA significantly improves attack transferability for both convolutional neural network (CNN) and vision transformer (ViT) models, compared to state-of-the-art benchmarks. Our approach provides a robust tool for evaluating model robustness and developing effective defenses against adversarial attacks. Our code is available at: https://github.com/kaibo-Z/DGFA.git.