AIE: Adaptive Inter-Domain Ensemble for Boosting Cross-Domain Audio Adversarial Transferability

Abstract

Deep neural networks are vulnerable and susceptible to adversarial attacks. Audio adversarial examples impose acoustically imperceptible perturbations to clean audio examples, fooling classification models into producing incorrect results. Transferability is a critical property of audio adversarial examples, making black-box attacks applicable in practice and attracting increasing interest. Despite recent studies achieving transferability across models within the same domain, they consistently fail to achieve transferability across different domains. Given that time-domain and frequency-domain models are the two predominant approaches in audio classification, we observe that adversarial examples generated for one domain demonstrate significantly constrained transferability to the other. To address this limitation, we first consider an inter-domain ensemble (IE) strategy, which fuses outputs from both domains to get an ensemble loss, optimizing adversarial examples to converge toward a common adversarial space among both domains. However, we further observe that simply averaging outputs from both domains causes adversarial examples to be more transferable to one domain, while reducing transferability to the other compared to single-domain attacks. Therefore, we propose a novel Adaptive Inter-domain Ensemble (AIE) attack, which dynamically optimizes the contributions of both domains through adaptive weighting, improving the overall cross-domain transferability of audio adversarial examples. Extensive evaluations on diverse datasets consistently demonstrate that AIE outperforms existing methods, establishing its effectiveness in enhancing adversarial transferability across domains. Our code is available at https://github.com/unclelongheu/Audio_Adversarial_Example.