Transferable adversarial attacks exhibit high concealment and detection difficulty, posing significant security risks to computer vision. In this paper, we propose an Amplitude-Adaptive Frequency Corrector (AAFC) to assist image classification models in defending against transferable adversarial attacks. AAFC consists of“real-imaginary concat,” “amplitude adjustment,” and “multi-channel fusion.” After performing frequency transformation and inverse transformation on the input examples, these three modules sequentially execute the concatenation of real-imaginary feature maps along the channel dimension, adjust the amplitudes of feature maps through a channel attention mechanism based on context, and fuse the feature maps to obtain multi-level feature representations. Compared to previous frequency decomposition-based defense methods, the proposed approach offers more precise frequency manipulation. It can adaptively correct the amplitudes of different frequency components, thus suppressing the components that are significantly vulnerable to adversarial attacks. Numerous experiments demonstrate that AAFC effectively defends against various types of transferable adversarial attacks, attaining the state-of-the-art black-box robustness. The code is available at https://gitcode.com/liuxl25/AAFC .

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Spectral Shielding: Amplitude-Adaptive Frequency Correction Against Transferable Adversarial Attacks

  • Xinlei Liu,
  • Tao Hu,
  • Peng Yi,
  • Rongkui Zhou,
  • Hailong Ma,
  • Yiming Jiang

摘要

Transferable adversarial attacks exhibit high concealment and detection difficulty, posing significant security risks to computer vision. In this paper, we propose an Amplitude-Adaptive Frequency Corrector (AAFC) to assist image classification models in defending against transferable adversarial attacks. AAFC consists of“real-imaginary concat,” “amplitude adjustment,” and “multi-channel fusion.” After performing frequency transformation and inverse transformation on the input examples, these three modules sequentially execute the concatenation of real-imaginary feature maps along the channel dimension, adjust the amplitudes of feature maps through a channel attention mechanism based on context, and fuse the feature maps to obtain multi-level feature representations. Compared to previous frequency decomposition-based defense methods, the proposed approach offers more precise frequency manipulation. It can adaptively correct the amplitudes of different frequency components, thus suppressing the components that are significantly vulnerable to adversarial attacks. Numerous experiments demonstrate that AAFC effectively defends against various types of transferable adversarial attacks, attaining the state-of-the-art black-box robustness. The code is available at https://gitcode.com/liuxl25/AAFC .