通过高频增强与梯度融合，显著提升对抗样本跨模型攻击成功率。
Boosting Adversarial Transferability via High-Frequency Augmentation and Hierarchical-Gradient Fusion
- 在频域和空间域联合设计攻击，利用高频成分增强扰动
- 相比现有方法，平均攻击成功率提升23.6%
- 适合研究对抗攻击迁移性或防御漏洞的开发者
对抗攻击已成为机器学习安全的重要挑战，尤其在黑盒防御场景下。现有提升对抗迁移性的方法多集中于空间域。本文提出频率域攻击（FSA），将频域与空间域变换有效结合。FSA包含两项关键技术：(1) 高频增强，通过傅里叶变换与频带选择性放大，丰富输入并强调高频成分在对抗攻击中的关键作用；(2) 分层梯度融合，融合多尺度梯度分解结果，同时捕捉全局结构与细粒度细节，生成更平滑的扰动。实验表明，FSA在多种黑盒模型上持续优于当前最优方法。特别地，在八种黑盒防御模型上，相比BSR（CVPR 2024），FSA平均攻击成功率提升23.6%。
原文摘要 · Abstract (English)
Adversarial attacks have become a significant challenge in the security of machine learning models, particularly in the context of black-box defense strategies. Existing methods for enhancing adversarial transferability primarily focus on the spatial domain. This paper presents Frequency-Space Attack (FSA), a new adversarial attack framework that effectively integrates frequency-domain and spatial-domain transformations. FSA combines two key techniques: (1) High-Frequency Augmentation, which applies Fourier transform with frequency-selective amplification to diversify inputs and emphasize the critical role of high-frequency components in adversarial attacks, and (2) Hierarchical-Gradient Fusion, which merges multi-scale gradient decomposition and fusion to capture both global structures and fine-grained details, resulting in smoother perturbations. Our experiment demonstrates that FSA consistently outperforms state-of-the-art methods across various black-box models. Notably, our proposed FSA achieves an average attack success rate increase of 23.6% compared with BSR (CVPR 2024) on eight black-box defense models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。