Exploring Frequencies via Feature Mixing and Meta-Learning for Improving Adversarial Transferability.

Area of Science:

• Artificial Intelligence
• Computer Vision
• Machine Learning Security

Background:

• Deep Neural Networks (DNNs) are vulnerable to adversarial attacks.
• Frequency-domain analysis reveals high-frequency components impact predictions, while low-frequency components aid black-box attack transferability.

Purpose of the Study:

• To develop a frequency decomposition-based feature mixing method to exploit frequency characteristics for improved adversarial attacks.
• To address the conflict arising from simultaneously applying different feature mixing strategies.

Main Methods:

• Introduced a frequency decomposition-based feature mixing method.
• Proposed a cross-frequency meta-optimization approach with meta-train, meta-test, and final update steps.
• Leveraged low-frequency components for defense model attacks and adversarial samples for normally-trained model attacks.

Main Results:

• Incorporating clean sample features into adversarial features is effective for normally-trained models.
• Combining clean features with low-frequency adversarial features improves attacks on defense models.
• The cross-frequency meta-optimization approach effectively enhances attack transferability against both model types.

Conclusions:

• The proposed frequency-based feature mixing and meta-optimization method significantly improves adversarial attack transferability.
• The study demonstrates a novel approach to exploit frequency characteristics for more effective DNN attacks.
• The method shows effectiveness on the ImageNet-Compatible dataset for both normally-trained and defense models.