Aug 2026· Neural Networks· Vol 205 Pt B, pp.
109487
· 0 citations· 42 references
Medicine
TL;DR
This approach improves transferability by combining different parameter initializations to generate a diversified set of surrogate models and integrates an adversarial makeup technique that generates adversarial disguises from reference images, thereby further boosting the attack's effectiveness.
Abstract
Facial recognition (FR) models are vulnerable to adversarial attacks, in which attackers manipulate facial images to expose system vulnerabilities, underscoring the urgent need to improve the transferability of adversarial attacks. However, existing methods fail to fully leverage diverse initialization strategies for extending surrogate models, thereby limiting the transferability of adversarial samples. To address this, we propose the Multi-Initialization Enhanced Aggregation (MEA) attack method. This approach improves transferability by combining different parameter initializations to generate a diversified set of surrogate models. MEA consists of two stages: Multi-Initialization Adversarial Enhancement (MIAE) and Enhanced Adversarial Aggregation (EAA). In the MIAE stage, we enhance model diversity through checkpoint saving driven by diversity metrics and multi-layer initialization. In the EAA stage, we further enhance transferability by adding perturbations to high-level features. Additionally, we integrate an adversarial makeup technique that generates adversarial disguises from reference images, thereby further boosting the attack's effectiveness. Experimental results show that MEA outperforms the second-best input transformation attack by 20.35% and achieves a 9.22% improvement over existing facial adversarial attacks.
Adversarial examples generated on a surrogate deep neural network (DNN) can often successfully fool other black-box DNN models. This cross-model transferability poses serious security threats to DNNs in practical applications. Input transformation techniques are widely used to enhance adversarial transferability by increasing the diversity of input images. However, existing methods primarily rely on local operations with limited degrees of freedom (DOF), such as block-wise shuffling and resizing, overlooking global perspective transformations that naturally arise from viewpoint changes. In this work, we propose a Perspective-Invariant Attack (PIA), which introduces a multi-DOF vertex sampling strategy that systematically covers the perspective transformation hierarchy from 2-DOF translation to 8-DOF projective mapping. By generating geometrically diverse input variations, PIA effectively reduces overfitting of adversarial perturbations to the surrogate model, thereby improving adversarial transferability. We further propose PIA-Mix, a generic extension that maintains a complementary transformation pool and efficiently combines our perspective transformation with auxiliary methods for improved transferability. Extensive experiments involving various DNN architectures, advanced defense mechanisms, and multimodal large language models (LLMs) demonstrate that PIA and PIA-Mix outperform state-of-the-art transfer-based attacks.
Kaisheng Liang, Yiming Cao, Bin Xiao· IEEE Transactions on Informa...· 0 citations
Optimize Deep Learning–based Adversarial Defense Mechanism (ODL-ADM) is proposed in this work, which projects adversarial samples into an immune feature space that is both discriminative and resistant to perturbations.
Sheilla Ann Bangoy Pacheco, Mahesh Goyani, Jayzel P. Bangoy et al.· ITEGAM- Journal of Engineeri...· 0 citations
The proposed DiffAttack framework significantly outperforms existing adversarial techniques, achieving a high average attack success rate of 84.86% across multiple face recognition models (e.g., FaceNet).
Physical-domain adversarial attacks have been extensively studied in face recognition and object detection, yet the field of palmprint recognition remains largely unexplored. Existing methods generate grayscale patches constrained by the single-channel input of most palmprint models. When deployed on skin, these patches contrast sharply with the surrounding tissue and are readily noticeable to human observers, undermining the covertness required in practical attacks. To address this limitation, we propose a Color Adversarial Patch (CAP) generation algorithm that leverages style transfer principles to produce visually natural color patches while maintaining high attack success rates. The method initiates the patch with a style prior using a pre-trained Contrastive Arbitrary Style Transfer (CAST) model and jointly optimizes adversarial loss, style loss, and smoothness loss within a unified framework. A three-channel averaging strategy is adopted to ensure compatibility with single-channel recognition models during gradient backpropagation. Experiments on the Tongji palmprint dataset show that the generated color patches achieve average cosine similarity values above the decision threshold in physical-domain tests, with peak signal-to-noise ratio (PSNR) and structural similarity index (SSIM) values significantly higher than those for their grayscale counterparts. Ablation studies validate the indispensable role of each loss component. CAP offers a practical balance between attack effectiveness and visual camouflage, demonstrating the feasibility of concealed physical-domain attacks on palmprint recognition systems.
Yue Liu, Qi Xiong, Lu Leng et al.· Electronics· 0 citations
FDT-PC (Frequency Domain Transformation with Perceptual Constraints), a novel method that enhances adversarial transferability across different model architectures, is proposed, which achieves superior black-box attack performance on both CNNs and Vision Transformers, outperforming existing state-of-the-art input transformation methods.
Bo Li, Li Tang, Xin Jin et al.· ACM Transactions on Multimed...· 0 citations
A method to analyze ANNs designed for image classification from an adversarial robustness perspective and implemented an ablation and fine-tuning strategy that successfully boosted the robustness of the ANNs against a variant of the Auto-PGD attack under different threat models.