Aug 2026· ACM Transactions on Multimedia Computing, Communications, and Applications (TOMCCAP)· 0 citations· 58 references
TL;DR
FDT-PC (Frequency Domain Transformation with Perceptual Constraints), a novel method that enhances adversarial transferability across different model architectures, is proposed, which achieves superior black-box attack performance on both CNNs and Vision Transformers, outperforming existing state-of-the-art input transformation methods.
Abstract
Adversarial examples, crafted by introducing imperceptible perturbations to clean inputs, pose a serious threat to the robustness of deep learning models, particularly in image classification. While existing white-box attack methods often achieve high success rates, their effectiveness in black-box settings remains limited, especially when there is a gap between the source and target models. To address this challenge, we propose FDT-PC (Frequency Domain Transformation with Perceptual Constraints), a novel method that enhances adversarial transferability across different model architectures. Our approach transforms input images into the frequency domain using the Fourier transform, allowing richer semantic information to be captured—especially beneficial for Transformer-based models that leverage global frequency patterns. We then apply frequency-aware scaling and masking to decouple adversarial perturbations from model-specific features, thereby improving cross-model attack success. Furthermore, we incorporate a perceptual loss computed via a pre-trained VGG network to minimize high-level feature discrepancies, maintaining visual similarity while enhancing transferability. Experiments on the ImageNet dataset demonstrate that FDT-PC achieves superior black-box attack performance on both CNNs and Vision Transformers, outperforming existing state-of-the-art input transformation methods. These results highlight the effectiveness of frequency-domain perturbations combined with perceptual constraints in improving adversarial robustness evaluation.
Adversarial examples generated on a surrogate deep neural network (DNN) can often successfully fool other black-box DNN models. This cross-model transferability poses serious security threats to DNNs in practical applications. Input transformation techniques are widely used to enhance adversarial transferability by increasing the diversity of input images. However, existing methods primarily rely on local operations with limited degrees of freedom (DOF), such as block-wise shuffling and resizing, overlooking global perspective transformations that naturally arise from viewpoint changes. In this work, we propose a Perspective-Invariant Attack (PIA), which introduces a multi-DOF vertex sampling strategy that systematically covers the perspective transformation hierarchy from 2-DOF translation to 8-DOF projective mapping. By generating geometrically diverse input variations, PIA effectively reduces overfitting of adversarial perturbations to the surrogate model, thereby improving adversarial transferability. We further propose PIA-Mix, a generic extension that maintains a complementary transformation pool and efficiently combines our perspective transformation with auxiliary methods for improved transferability. Extensive experiments involving various DNN architectures, advanced defense mechanisms, and multimodal large language models (LLMs) demonstrate that PIA and PIA-Mix outperform state-of-the-art transfer-based attacks.
Kaisheng Liang, Yiming Cao, Bin Xiao· IEEE Transactions on Informa...· 0 citations
Empirical support is provided for the utility of structure-aware perturbation refinement in improving black-box adversarial transferability across heterogeneous visual architectures.
Qi-Rui Lu, Liansong Zong, Fu-Ran Liu et al.· Neural Networks· 0 citations
This study reveals an Asymmetric Adversarial Trajectory (AAT) property in LIC systems: transitioning from adversarial to benign regions is significantly easier than the reverse process, where adversarial examples can often be roughly recovered within only 1-2 steps.
Extensive experiments demonstrate that IDATA consistently outperforms state-of-the-art baselines in attack success rate, memory efficiency, and visual imperceptibility, suggesting that IDATA is a promising tool for black-box robustness evaluation of deep visual models.
Yi Pan, Jun-Jie Huang, Tianrui Liu et al.· 0 citations
Season, a spectrum-aware orthogonal gradient refinement framework for L-infinity transfer attacks against black-box target models on ImageNet, using a white-box surrogate to improve transfer success rate.
Deep neural networks are vulnerable and susceptible to adversarial attacks. Audio adversarial examples impose acoustically imperceptible perturbations to clean audio examples, fooling classification models into producing incorrect results. Transferability is a critical property of audio adversarial examples, making black-box attacks applicable in practice and attracting increasing interest. Despite recent studies achieving transferability across models within the same domain, they consistently fail to achieve transferability across different domains. Given that time-domain and frequency-domain models are the two predominant approaches in audio classification, we observe that adversarial examples generated for one domain demonstrate significantly constrained transferability to the other. To address this limitation, we first consider an inter-domain ensemble (IE) strategy, which fuses outputs from both domains to get an ensemble loss, optimizing adversarial examples to converge toward a common adversarial space among both domains. However, we further observe that simply averaging outputs from both domains causes adversarial examples to be more transferable to one domain, while reducing transferability to the other compared to single-domain attacks. Therefore, we propose a novel Adaptive Inter-domain Ensemble (AIE) attack, which dynamically optimizes the contributions of both domains through adaptive weighting, improving the overall cross-domain transferability of audio adversarial examples. Extensive evaluations on diverse datasets consistently demonstrate that AIE outperforms existing methods, establishing its effectiveness in enhancing adversarial transferability across domains. Our code is available at https://github.com/unclelongheu/Audio_Adversarial_Example.
Zilin Tian, Yunfei Long, Liguo Zhang et al.· ACM Transactions on Multimed...· 0 citations