Abstract: To address the limitations of existing input transformation methods that are restricted to a single domain and insufficiently exploit spatial structures and spectral information, a Spatial-Frequency Complementary Enhancement and Norm-Balanced Fusion (SFNB) method is proposed for black-box transfer attacks. The proposed method constructs augmented samples in the spatial and frequency domains separately and integrates the transformation information from both domains at the gradient level. In the spatial domain, a Channel-Structure Joint Enhancement (CSJE) mechanism is designed, in which Channel Random Fusion (CRF) introduces cross-channel information interaction, while Block Random Restructuring (BRR) changes the arrangement and orientation of local blocks, thereby expanding the transformation space from the perspectives of both color distribution and spatial structure. In the frequency domain, a Spectral Partition Augmentation (SPA) mechanism is designed to apply differentiated adjustments to different frequency partitions, generating augmented samples with diverse spectral distributions. On this basis, a Conflict-aware Norm-balanced Gradient Fusion (CNGF) strategy is designed to mitigate negatively correlated conflicts between the gradients of the two branches through conditional projection, balance their weighted contributions according to the gradient norms, and iteratively generate adversarial examples using the fused gradient. Extensive experiments are conducted on the ImageNet-Compatible dataset. The results show that SFNB improves the overall average attack success rate by 9.82 and 8.80 percentage points compared with the baseline methods FSD and HAM, respectively. When integrated with the DIM and TIM strategies, the overall average attack success rate reaches 92.48%. Against advanced defense methods, SFNB achieves an average attack success rate of 77.03%, outperforming FSD and HAM by 4.05 and 9.97 percentage points, respectively. The experimental results demonstrate that SFNB alleviates overfitting to the surrogate model through dual-domain spatial-frequency augmentation and gradient fusion, thereby improving the black-box attack success rate and cross-model transferability of adversarial examples.

Key words: adversarial example, transfer attack, input transformation, spatial-frequency dual-domain, gradient fusion, black-box attack

摘要： 针对现有输入变换方法局限于单一域、对空间结构与频谱信息利用不足的问题，提出一种面向黑盒迁移攻击的空频互补增强与范数平衡融合方法(SFNB)。所提方法分别在空间域和频域构造增强样本，并在梯度层面融合两类变换信息。在空间域，设计通道-结构联合增强(CSJE)机制，通过通道随机融合(CRF)引入跨通道信息交互，并结合块随机重构(BRR)改变局部块的排列与方向，从颜色分布和空间结构两个维度扩展变换空间；在频域，设计频谱分区增强(SPA)机制，对不同频率分区施加差异化调节，生成具有不同频谱分布的增强样本。在此基础上，设计冲突感知范数平衡融合策略(CNGF)，通过条件投影缓解两分支梯度的负相关冲突，再根据梯度范数平衡其加权贡献，并利用融合梯度迭代生成对抗样本。在ImageNet-Compatible数据集上开展大量实验，结果表明，SFNB相较于基准方法FSD和HAM，整体平均攻击成功率分别提升9.82和8.80个百分点；在集成DIM与TIM策略后，整体平均攻击成功率达到92.48%；面对高级防御方法，平均攻击成功率达到77.03%，较FSD和HAM分别提升4.05和9.97个百分点。实验结果表明，SFNB能够通过空频双域增强与梯度融合，缓解对代理模型的过拟合，从而提高对抗样本的黑盒攻击成功率和跨模型迁移性。

关键词: 对抗样本, 迁移攻击, 输入变换, 空频双域, 梯度融合, 黑盒攻击