Aug 2026· ACM Transactions on Multimedia Computing, Communications, and Applications (TOMCCAP)· 0 citations· 58 references
TL;DR
FDT-PC (Frequency Domain Transformation with Perceptual Constraints), a novel method that enhances adversarial transferability across different model architectures, is proposed, which achieves superior black-box attack performance on both CNNs and Vision Transformers, outperforming existing state-of-the-art input transformation methods.
Abstract
Adversarial examples, crafted by introducing imperceptible perturbations to clean inputs, pose a serious threat to the robustness of deep learning models, particularly in image classification. While existing white-box attack methods often achieve high success rates, their effectiveness in black-box settings remains limited, especially when there is a gap between the source and target models. To address this challenge, we propose FDT-PC (Frequency Domain Transformation with Perceptual Constraints), a novel method that enhances adversarial transferability across different model architectures. Our approach transforms input images into the frequency domain using the Fourier transform, allowing richer semantic information to be captured—especially beneficial for Transformer-based models that leverage global frequency patterns. We then apply frequency-aware scaling and masking to decouple adversarial perturbations from model-specific features, thereby improving cross-model attack success. Furthermore, we incorporate a perceptual loss computed via a pre-trained VGG network to minimize high-level feature discrepancies, maintaining visual similarity while enhancing transferability. Experiments on the ImageNet dataset demonstrate that FDT-PC achieves superior black-box attack performance on both CNNs and Vision Transformers, outperforming existing state-of-the-art input transformation methods. These results highlight the effectiveness of frequency-domain perturbations combined with perceptual constraints in improving adversarial robustness evaluation.
Adversarial examples generated on a surrogate deep neural network (DNN) can often successfully fool other black-box DNN models. This cross-model transferability poses serious security threats to DNNs in practical applications. Input transformation techniques are widely used to enhance adversarial transferability by increasing the diversity of input images. However, existing methods primarily rely on local operations with limited degrees of freedom (DOF), such as block-wise shuffling and resizing, overlooking global perspective transformations that naturally arise from viewpoint changes. In this work, we propose a Perspective-Invariant Attack (PIA), which introduces a multi-DOF vertex sampling strategy that systematically covers the perspective transformation hierarchy from 2-DOF translation to 8-DOF projective mapping. By generating geometrically diverse input variations, PIA effectively reduces overfitting of adversarial perturbations to the surrogate model, thereby improving adversarial transferability. We further propose PIA-Mix, a generic extension that maintains a complementary transformation pool and efficiently combines our perspective transformation with auxiliary methods for improved transferability. Extensive experiments involving various DNN architectures, advanced defense mechanisms, and multimodal large language models (LLMs) demonstrate that PIA and PIA-Mix outperform state-of-the-art transfer-based attacks.
Kaisheng Liang, Yiming Cao, Bin Xiao· IEEE Transactions on Informa...· 0 citations
Transfer-based black-box adversarial attacks provide a practical means to evaluate the robustness of deep neural networks under restricted access to target models. However, existing approaches suffer from severe performance degradation in cross-architecture scenarios, particularly when adversarial examples crafted on Vision Transformers (ViTs) are transferred to convolutional neural networks (CNNs). We argue that this limitation cannot be fully attributed to optimization strategies alone, but may also be related to the mismatch between perturbation structure and model-specific inductive biases. To address this issue, we propose a structure-aware adversarial perturbation refinement framework that explicitly enforces spatial coherence during forward propagation. The proposed method consists of three components. First, spatial autocorrelation analysis is used to guide perturbation allocation toward structurally discriminative regions. Second, spatially connected perturbation patterns are introduced to help preserve perturbation effects under convolutional smoothing and pooling operations. Third, the perturbation strength is adaptively adjusted across network depth to balance structural disruption and semantic preservation. Extensive experiments on the ImageNet benchmark show that the proposed approach achieves competitive and often stronger performance than the compared transfer-based attacks across diverse ViT and CNN architectures, with particularly notable gains in the challenging ViT-to-CNN transfer setting. These results provide empirical support for the utility of structure-aware perturbation refinement in improving black-box adversarial transferability across heterogeneous visual architectures.
Qi-Rui Lu, Liansong Zong, Fu-Ran Liu et al.· Neural Networks· 0 citations
Learned image compression (LIC) has demonstrated remarkable rate-distortion (RD) performance in benign settings. However, the high representational capacity endowed by deep neural networks (DNNs) comes at the expense of increased adversarial vulnerability. This hinders their adoption as trusted standardized codecs. Recent work has sketched test-time refinement (TTR) as a defense in gray-box scenarios, despite its original purpose of improving benign RD performance. Unfortunately, extensive iterations of TTR incur prohibitive overhead, while the robustness mechanism lacks theoretical understanding. Moreover, TTR has not been evaluated in white-box settings or against attacks beyond $\ell_2$-bounded rate and untargeted distortion objectives. To bridge these gaps, we present a systematic study. Our study reveals an Asymmetric Adversarial Trajectory (AAT) property in LIC systems: transitioning from adversarial to benign regions is significantly easier than the reverse process, where adversarial examples can often be roughly recovered within only 1-2 steps. We provide a two-dimensional Tube Model to explain this phenomenon. Based on AAT, we propose a Fast Test-Time Refinement (FTTR) framework for practical and robust LIC systems. We establish that the robustness arises from the contraction of adversarial regions induced by the Input-as-Label property of LIC systems, rather than from obfuscated gradients. Extensive evaluations with diverse strong adaptive attacks across multiple LIC systems demonstrate the promise of the proposed FTTR framework. The code is available at https://github.com/chinaliangjiaming/FTTR.git.
Extensive experiments demonstrate that IDATA consistently outperforms state-of-the-art baselines in attack success rate, memory efficiency, and visual imperceptibility, suggesting that IDATA is a promising tool for black-box robustness evaluation of deep visual models.
Yi Pan, Jun-Jie Huang, Tianrui Liu et al.· 0 citations
Season, a spectrum-aware orthogonal gradient refinement framework for L-infinity transfer attacks against black-box target models on ImageNet, using a white-box surrogate to improve transfer success rate.
Deep neural networks are vulnerable and susceptible to adversarial attacks. Audio adversarial examples impose acoustically imperceptible perturbations to clean audio examples, fooling classification models into producing incorrect results. Transferability is a critical property of audio adversarial examples, making black-box attacks applicable in practice and attracting increasing interest. Despite recent studies achieving transferability across models within the same domain, they consistently fail to achieve transferability across different domains. Given that time-domain and frequency-domain models are the two predominant approaches in audio classification, we observe that adversarial examples generated for one domain demonstrate significantly constrained transferability to the other. To address this limitation, we first consider an inter-domain ensemble (IE) strategy, which fuses outputs from both domains to get an ensemble loss, optimizing adversarial examples to converge toward a common adversarial space among both domains. However, we further observe that simply averaging outputs from both domains causes adversarial examples to be more transferable to one domain, while reducing transferability to the other compared to single-domain attacks. Therefore, we propose a novel Adaptive Inter-domain Ensemble (AIE) attack, which dynamically optimizes the contributions of both domains through adaptive weighting, improving the overall cross-domain transferability of audio adversarial examples. Extensive evaluations on diverse datasets consistently demonstrate that AIE outperforms existing methods, establishing its effectiveness in enhancing adversarial transferability across domains. Our code is available at https://github.com/unclelongheu/Audio_Adversarial_Example.
Zilin Tian, Yunfei Long, Liguo Zhang et al.· ACM Transactions on Multimed...· 0 citations