Improving Transferability of Adversarial Attacks via Frequency-Consistent Regularization
Source abstract
Abstract
Adversarial examples have revealed the vulnerability of deep neural networks, and their transferability makes black-box attacks particularly concerning. However, perturbations crafted on a surrogate model often do not remain sufficiently effective on unseen target models. In this paper, we revisit this issue from a frequency-domain perspective and observe that perturbation optimization can become overly dependent on specific spectral patterns, which weakens cross-model transfer. To address this problem, we propose frequency-consistent regularization (FCR), a simple plug-in strategy that can be combined with existing iterative attacks. FCR introduces multiple low-frequency preserving views with randomly sampled frequency ranges at each iteration and optimizes perturbations across these varied views. In this way, the generated perturbations are less tied to a specific frequency configuration and show improved transferability. Experimental results show that FCR consistently improves the transfer performance of various iterative attacks. The improvement is observed not only in standard target models but also in adversarially trained models, where the gain is often more pronounced.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Adversarial Robustness in Machine Learning · Generative Adversarial Networks and Image Synthesis · Advanced Neural Network Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Reliability and Systems Engineering, Beihang University, Beijing 100191, China
Science and Technology on Reliability and Environmental Engineering Laboratory, Beijing 100191, China
References (46)
Show source-provided references
1. Deep learning10.1038/nature14539 ↗
2. Review of deep learning: Concepts, CNN architectures, challenges, applications, future directions10.1186/s40537-021-00444-8 ↗
3. Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2013). Intriguing properties of neural networks. arXiv.
4. Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv.
5. Kurakin, A., Goodfellow, I.J., and Bengio, S. (2018). Adversarial examples in the physical world. Artificial Intelligence Safety and Security, Chapman and Hall/CRC.10.1201/9781351251389-8 ↗
6. Adversarial examples: Attacks and defenses for deep learning10.1109/TNNLS.2018.2886017 ↗
7. Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., and Song, D. (2018). Robust physical-world attacks on deep learning visual classification. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, IEEE.10.1109/CVPR.2018.00175 ↗
8. Singh, I., Araki, T., and Kakizaki, K. (2022). Powerful physical adversarial examples against practical face recognition systems. Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, IEEE.10.1109/WACVW54805.2022.00036 ↗
9. A comprehensive survey of deep face verification systems adversarial attacks and defense strategies10.1038/s41598-025-15753-8 ↗
10. Wang, X., Ge, Z., Liu, B., Fang, Z., Zhou, F., Zhang, R., Wang, S., and Luo, Y. (2026). Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluation. arXiv.
11. Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., and McDaniel, P. (2017). Ensemble adversarial training: Attacks and defenses. arXiv.
12. Parameter interpolation adversarial training for robust image classification10.1109/TIFS.2025.3533925 ↗
13. Studying the robustness of data imputation methodologies against adversarial attacks10.1016/j.cose.2025.104574 ↗
14. Naseer, M., Khan, S., Hayat, M., Khan, F.S., and Porikli, F. (2020). A self-supervised approach for adversarial robustness. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, IEEE.10.1109/CVPR42600.2020.00034 ↗
15. Mitigating adversarial attacks and building robust deep learning models for assessing risks in tunnel construction
16. Chen, P.Y., Zhang, H., Sharma, Y., Yi, J., and Hsieh, C.J. (2017). Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, ACM.10.1145/3128572.3140448 ↗
17. Enhancing adversarial transferability with adversarial weight tuning10.1609/aaai.v39i2.32203 ↗
18. Lin, J., Song, C., He, K., Wang, L., and Hopcroft, J.E. (2019). Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv.
19. Xie, C., Zhang, Z., Zhou, Y., Bai, S., Wang, J., Ren, Z., and Yuille, A.L. (2019). Improving transferability of adversarial examples with input diversity. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, IEEE.10.1109/CVPR.2019.00284 ↗
20. Adversarial attacks of vision tasks in the past 10 years: A survey
21. Dong, Y., Pang, T., Su, H., and Zhu, J. (2019). Evading defenses to transferable adversarial examples by translation-invariant attacks. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, IEEE.10.1109/CVPR.2019.00444 ↗
22. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (2017). Towards deep learning models resistant to adversarial attacks. arXiv.
23. Enhancing the transferability of adversarial attacks via Scale Enriching10.1016/j.neunet.2025.107549 ↗
24. Wang, X., Zhang, Z., and Zhang, J. (2023). Structure invariant transformation for better adversarial transferability. Proceedings of the IEEE/CVF International Conference on Computer Vision, IEEE.10.1109/ICCV51070.2023.00425 ↗
25. Wang, X., He, X., Wang, J., and He, K. (2021). Admix: Enhancing the transferability of adversarial attacks. Proceedings of the IEEE/CVF International Conference on Computer Vision, IEEE.10.1109/ICCV48922.2021.01585 ↗
26. Long, Y., Zhang, Q., Zeng, B., Gao, L., Liu, X., Zhang, J., and Song, J. (2022). Frequency domain model augmentation for adversarial attack. Proceedings of the European Conference on Computer Vision, Springer.10.1007/978-3-031-19772-7_32 ↗
27. Liu, Z., Liu, Q., Liu, T., Xu, N., Lin, X., Wang, Y., and Wen, W. (2019). Feature distillation: Dnn-oriented jpeg compression against adversarial examples. Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), IEEE.10.1109/CVPR.2019.00095 ↗
28. Xu, W., Evans, D., and Qi, Y. (2017). Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv.10.14722/ndss.2018.23198 ↗
29. Cohen, J., Rosenfeld, E., and Kolter, Z. (2019). Certified adversarial robustness via randomized smoothing. Proceedings of the International Conference on Machine Learning, PMLR.
30. Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., and Li, J. (2018). Boosting adversarial attacks with momentum. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, IEEE.10.1109/CVPR.2018.00957 ↗
31. Kurakin, A., Goodfellow, I., Bengio, S., Dong, Y., Liao, F., Liang, M., Pang, T., Zhu, J., Hu, X., and Xie, C. (2018). Adversarial attacks and defences competition. The NIPS’17 Competition: Building Intelligent Systems, Springer.10.1007/978-3-319-94042-7_11 ↗
32. Improving fast adversarial training with prior-guided knowledge10.1109/TPAMI.2024.3381180 ↗
33. Bin Kamilin, M.H., and Yamaguchi, S. (2025). Stackade Ensemble Learning for Resilient Forecasting Against Missing Values, Adversarial Attacks, and Concept Drift. Appl. Sci., 15.10.3390/app15168859 ↗
34. Guo, C., Rana, M., Cisse, M., and Van Der Maaten, L. (2017). Countering adversarial images using input transformations. arXiv.
35. Xie, C., Wang, J., Zhang, Z., Ren, Z., and Yuille, A. (2017). Mitigating adversarial effects through randomization. arXiv.
36. Prakash, A., Moran, N., Garber, S., DiLillo, A., and Storer, J. (2018). Deflecting adversarial attacks with pixel deflection. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, IEEE.10.1109/CVPR.2018.00894 ↗
37. Liao, F., Liang, M., Dong, Y., Pang, T., Hu, X., and Zhu, J. (2018). Defense against adversarial attacks using high-level representation guided denoiser. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, IEEE.10.1109/CVPR.2018.00191 ↗
38. Image super-resolution as a defense against adversarial attacks10.1109/TIP.2019.2940533 ↗
39. Imagenet large scale visual recognition challenge10.1007/s11263-015-0816-y ↗
40. Wightman, R. (2026, March 10). PyTorch Image Models. Available online: https://github.com/rwightman/pytorch-image-models.
41. Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., and Wojna, Z. (2016). Rethinking the inception architecture for computer vision. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, IEEE.10.1109/CVPR.2016.308 ↗
42. He, K., Zhang, X., Ren, S., and Sun, J. (2016). Deep residual learning for image recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, IEEE.10.1109/CVPR.2016.90 ↗
43. Huang, G., Liu, Z., Van Der Maaten, L., and Weinberger, K.Q. (2017). Densely connected convolutional networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, IEEE.10.1109/CVPR.2017.243 ↗
44. Szegedy, C., Ioffe, S., Vanhoucke, V., and Alemi, A. (2017). Inception-v4, inception-resnet and the impact of residual connections on learning. Proceedings of the AAAI Conference on Artificial Intelligence, AAAI Press.10.1609/aaai.v31i1.11231 ↗
45. Image quality assessment: From error visibility to structural similarity10.1109/TIP.2003.819861 ↗
46. Zhang, R., Isola, P., Efros, A.A., Shechtman, E., and Wang, O. (2018). The unreasonable effectiveness of deep features as a perceptual metric. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, IEEE.10.1109/CVPR.2018.00068 ↗