Recent studies have shown that deep neural networks (DNNs) are highly vulnerable to adversarial attacks, posing significant security threats. Among various approaches, transfer-based attacks aim to generate adversarial examples that can generalize across models. However, existing methods often lack effective guidance in the unified perturbation direction and struggle to ensure high transferability. To address this, we propose a novel method called frequency-guided adaptive gradient attack (FAGA), which integrates two key components: truncated normal frequency constraints (TNFC) and an adaptive step adjuster (ASA). TNFC applies a truncated normal constraint to high-frequency components, suppressing overfitted high-frequency details while retaining the low-frequency components, thereby guiding perturbations toward a shared decision boundary. ASA dynamically adjusts the step size based on gradient consistency, stabilizing the optimization process as momentum converges. Furthermore, we perform the model augmentation through spectral transformation and aggregate the average gradient of the white-box model to further optimize attack direction. Extensive experiments on the standard surrogate model (Inc-v3) show that FAGA achieves 90.3% black-box success rate and 78.8% on defense models, outperforming existing state-of-the-art methods. Our results demonstrate that FAGA significantly improves the transferability and robustness of adversarial examples.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Frequency-Guided Adaptive Gradient Attack for Transferable Adversarial Examples

  • Zewei Fu,
  • Ya Li,
  • Yan Huang

摘要

Recent studies have shown that deep neural networks (DNNs) are highly vulnerable to adversarial attacks, posing significant security threats. Among various approaches, transfer-based attacks aim to generate adversarial examples that can generalize across models. However, existing methods often lack effective guidance in the unified perturbation direction and struggle to ensure high transferability. To address this, we propose a novel method called frequency-guided adaptive gradient attack (FAGA), which integrates two key components: truncated normal frequency constraints (TNFC) and an adaptive step adjuster (ASA). TNFC applies a truncated normal constraint to high-frequency components, suppressing overfitted high-frequency details while retaining the low-frequency components, thereby guiding perturbations toward a shared decision boundary. ASA dynamically adjusts the step size based on gradient consistency, stabilizing the optimization process as momentum converges. Furthermore, we perform the model augmentation through spectral transformation and aggregate the average gradient of the white-box model to further optimize attack direction. Extensive experiments on the standard surrogate model (Inc-v3) show that FAGA achieves 90.3% black-box success rate and 78.8% on defense models, outperforming existing state-of-the-art methods. Our results demonstrate that FAGA significantly improves the transferability and robustness of adversarial examples.