关键词: 对抗样本, 迁移攻击, 输入变换, 空频双域, 梯度融合, 黑盒攻击

Abstract: To address the limitations of existing input transformation methods that are restricted to a single domain and insufficiently exploit spatial structures and spectral information, a Spatial-Frequency Complementary Enhancement and Norm-Balanced Fusion (SFNB) method is proposed for black-box transfer attacks. The proposed method constructs augmented samples in the spatial and frequency domains separately and integrates the transformation information from both domains at the gradient level. In the spatial domain, a Channel-Structure Joint Enhancement (CSJE) mechanism is designed, in which Channel Random Fusion (CRF) introduces cross-channel information interaction, while Block Random Restructuring (BRR) changes the arrangement and orientation of local blocks, thereby expanding the transformation space from the perspectives of both color distribution and spatial structure. In the frequency domain, a Spectral Partition Augmentation (SPA) mechanism is designed to apply differentiated adjustments to different frequency partitions, generating augmented samples with diverse spectral distributions. On this basis, a Conflict-aware Norm-balanced Gradient Fusion (CNGF) strategy is designed to mitigate negatively correlated conflicts between the gradients of the two branches through conditional projection, balance their weighted contributions according to the gradient norms, and iteratively generate adversarial examples using the fused gradient. Extensive experiments are conducted on the ImageNet-Compatible dataset. The results show that SFNB improves the overall average attack success rate by 9.82 and 8.80 percentage points compared with the baseline methods FSD and HAM, respectively. When integrated with the DIM and TIM strategies, the overall average attack success rate reaches 92.48%. Against advanced defense methods, SFNB achieves an average attack success rate of 77.03%, outperforming FSD and HAM by 4.05 and 9.97 percentage points, respectively. The experimental results demonstrate that SFNB alleviates overfitting to the surrogate model through dual-domain spatial-frequency augmentation and gradient fusion, thereby improving the black-box attack success rate and cross-model transferability of adversarial examples.

Key words: adversarial example, transfer attack, input transformation, spatial-frequency dual-domain, gradient fusion, black-box attack