Enhancing the Transferability of Adversarial Samples through Frequency-Domain Attenuation

In recent years, the transferability of adversarial examples has attracted significant attention. To improve the effectiveness of black-box attacks, a frequency-domain decay constraint is introduced, inspired by weight decay and regularization techniques commonly employed during model training. By treating adversarial perturbations as inputs in an optimization process, this constraint aims to mitigate the excessive reliance on low-frequency components during adversarial example generation, thereby enhancing transferability. Fourier heatmaps are utilized to analyze the sensitivity of input samples, enabling a decomposition of the frequency spectrum into low-frequency and high-frequency components. Based on this analysis, low-frequency attenuation is applied in the Fourier domain to suppress dominant low-frequency information, followed by reconstruction of the perturbed inputs. The proposed frequency-domain attenuation strategy enjoys good compatibility with existing algorithms, and increases the attack success rate by approximately 1.53%–8.68% relative to the original method. Extensive experimental results show that the proposed method surpasses existing iterative attack methods and generates more transferable adversarial examples, demonstrating its effectiveness and superiority.