Boosting Adversarial Transferability via High-Frequency Augmentation and Hierarchical-Gradient Fusion

TL;DR

This paper introduces Frequency-Space Attack (FSA), a novel adversarial attack framework that combines frequency-domain and spatial-domain techniques to significantly improve transferability and success rates against black-box models.

Contribution

The paper proposes FSA, integrating high-frequency augmentation and hierarchical-gradient fusion to enhance adversarial transferability beyond existing spatial-focused methods.

Findings

FSA outperforms state-of-the-art methods across various black-box models.

Achieves an average attack success rate increase of 23.6% over BSR.

Effectively emphasizes high-frequency components and captures multi-scale gradients.

Abstract

Adversarial attacks have become a significant challenge in the security of machine learning models, particularly in the context of black-box defense strategies. Existing methods for enhancing adversarial transferability primarily focus on the spatial domain. This paper presents Frequency-Space Attack (FSA), a new adversarial attack framework that effectively integrates frequency-domain and spatial-domain transformations. FSA combines two key techniques: (1) High-Frequency Augmentation, which applies Fourier transform with frequency-selective amplification to diversify inputs and emphasize the critical role of high-frequency components in adversarial attacks, and (2) Hierarchical-Gradient Fusion, which merges multi-scale gradient decomposition and fusion to capture both global structures and fine-grained details, resulting in smoother perturbations. Our experiment demonstrates that FSA consistently outperforms state-of-the-art methods across various black-box models. Notably, our proposed FSA achieves an average attack success rate increase of 23.6% compared with BSR (CVPR 2024) on eight black-box defense models.