WPEBA: A Novel Ensemble Black-Box Adversarial Attack for Visual Recognition Systems via Wavelet Packet Decomposition
Abstract
Understanding adversarial attacks is crucial for the secure deployment of visual recognition systems. While ensemble attacks combine the strengths of transfer-based and query-based methods to generate highly transferable adversarial examples, their practicality is often limited in real-world scenarios where the number of queries is restricted. In this paper, we propose a novel frequency-driven ensemble adversarial attack, termed WPEBA, that enables efficient black-box attacks with a minimal number of queries. We first apply wavelet packet decomposition (WPD) to decompose images into frequency sub-bands. Driven by a unified ensemble loss across multiple surrogate models, we adaptively adjust frequency-band weights using internal gradient feedback and jointly generate gradient-based and block-based perturbations in the frequency domain. The perturbed components are then reconstructed into the spatial domain via inverse WPD to produce adversarial examples for querying the target model. Finally, we utilize the query feedback from the target model to dynamically update the surrogate-model weights, guiding the attack in subsequent iterations. Extensive evaluations demonstrate that WPEBA achieves an average attack success rate of nearly 99% with merely one or two queries across six distinct standard architectures. Furthermore, it maintains effective attack performance against models equipped with robust defenses and the Google Cloud Vision API. Overall, our method provides a new and practical approach for evaluating general model robustness.