Leveraging Information Consistency in Frequency and Spatial Domain for Adversarial Attacks

TL;DR

This paper introduces a novel gradient-based adversarial attack method that exploits information consistency across frequency and spatial domains, achieving state-of-the-art results in fooling deep neural networks.

Contribution

It proposes a simple, scalable attack algorithm leveraging frequency and spatial domain consistency, enhancing transferability and effectiveness of adversarial examples.

Findings

Achieves state-of-the-art attack success rates

Effective across different neural network models

Demonstrates the importance of frequency-spatial domain consistency

Abstract

Adversarial examples are a key method to exploit deep neural networks. Using gradient information, such examples can be generated in an efficient way without altering the victim model. Recent frequency domain transformation has further enhanced the transferability of such adversarial examples, such as spectrum simulation attack. In this work, we investigate the effectiveness of frequency domain-based attacks, aligning with similar findings in the spatial domain. Furthermore, such consistency between the frequency and spatial domains provides insights into how gradient-based adversarial attacks induce perturbations across different domains, which is yet to be explored. Hence, we propose a simple, effective, and scalable gradient-based adversarial attack algorithm leveraging the information consistency in both frequency and spatial domains. We evaluate the algorithm for its effectiveness against different models. Extensive experiments demonstrate that our algorithm achieves state-of-the-art results compared to other gradient-based algorithms. Our code is available at: https://github.com/LMBTough/FSA.