Transfer-based adversarial attacks are widely used to evaluate the robustness of deep neural networks (DNNs) under black-box settings, yet improving their cross-model transferability remains a key challenge. This limitation arises from reliance on locally linear gradient approximations and insufficient guidance from semantically critical regions. To address these limitations, we propose Translation-Dislocation and Curvature-Aware Gradient (TD-CAG), a new adversarial attack framework comprising two complementary modules: a curvature-aware gradient (CAG) module for modeling local nonlinearity, and a translation-dislocation (TD) module for modeling saliency misalignment. Specifically, CAG approximates second-order directional curvature to help perturbations escape local linearity, and TD introduces lightweight spatial shifts to simulate saliency misalignments across architectures, guiding perturbations toward model-invariant discriminative regions. Both modules are plug-and-play and compatible with existing attack pipelines. Extensive experiments demonstrate that TD-CAG consistently achieves superior transferability compared to state-of-the-art attack methods, while maintaining high compatibility and low computational cost. The source code is publicly available at https://github.com/hlkuang24/TD-CAG.
Hailing Kuang, Chen Wan, Xiaohai Lu et al.· Neural Networks· 0 citations
Adversarial training (AT) is a widely adopted defense against adversarial attacks, but its multi-step optimization process for generating adversarial examples leads to substantial computational overhead. To mitigate this, various single-step adversarial training methods have been proposed. However, these models often suffer from catastrophic overfitting under larger perturbations and exhibit degraded robustness. The core issue is that certain single-step adversarial examples, although successfully learned and correctly classified, fail to expose the true vulnerabilities of models. We refer to these misleading examples as “fakers”. Specifically, we find that fakers exhibit three distinct characteristics compared to standard adversarial examples: 1) they unexpectedly degrade the model robustness rather than improve it; 2) they make it harder for the model to learn their robust features; and 3) they show significantly greater divergence from their clean counterparts. These observations motivate us to proactively reduce the impact of fakers during training. To this end, we propose the Faker-Alleviating Single-step adversarial Training method (FAST), a general and effective framework designed to enhance both accuracy and robustness. Concretely, FAST consists of two main components. First, it dynamically adjusts the label-smoothing level for adversarial examples according to their learning difficulty, making fakers easier for the model to learn. Second, it introduces an auxiliary sample with a weak adversarial effect, derived from the single-step adversarial example, which is used to dynamically ease the alignment with clean data and stabilize the optimization process. We demonstrate the effectiveness of FAST through extensive experiments, showing that our method achieves superior clean accuracy and robustness against various types of adversarial attacks. The code is available at https://github.com/mesunhlf/FAST.
Lifeng Huang, Yuquan Lin, Chen Wan et al.· IEEE Transactions on Informa...· 0 citations