mlsanityData to 7 Oct 2026

Frequency Domain Model Augmentation for Adversarial Attack

arXiv 2207.05382 ↗First posted 12 Jul 2022cs.CVcited by 128

Not on the map. Why?

Abstract (arXiv)

For black-box attacks, the gap between the substitute model and the victim model is usually large, which manifests as a weak attack performance. Motivated by the observation that the transferability of adversarial examples can be improved by attacking diverse models simultaneously, model augmentation methods which simulate different models by using transformed images are proposed. However, existing transformations for spatial domain do not translate to significantly diverse augmented models. To tackle this issue, we propose a novel spectrum simulation attack to craft more transferable adversarial examples against both normally trained and defense models. Specifically, we apply a spectrum transformation to the input and thus perform the model augmentation in the frequency domain. We theoretically prove that the transformation derived from frequency domain leads to a diverse spectrum saliency map, an indicator we proposed to reflect the diversity of substitute models. Notably, our method can be generally combined with existing attacks. Extensive experiments on the ImageNet dataset demonstrate the effectiveness of our method, textite.g., attacking nine state-of-the-art defense models with an average success rate of 95.4%. Our code is available in urlhttps://github.com/yuyang-long/SSA.

Key facts. Cited by 128 papers in the map (data through 7 Oct 2026). Builds on 50 of its 60 references that are in the map. First posted on arXiv 12 Jul 2022.

Builds on

50 of 60 references.

References · 50

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2016Densely Connected Convolutional Networkscited by 6,691
  4. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  7. 2013Intriguing properties of neural networkscited by 5,114
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  9. 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
  10. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  11. 2016End to End Learning for Self-Driving Carscited by 1,000
  12. 2018CosFace: Large Margin Cosine Loss for Deep Face Recognitioncited by 968
38 more
  1. 2016Adversarial Machine Learning at Scalecited by 934
  2. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  3. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  4. 2016Universal adversarial perturbationscited by 774
  5. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  6. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  7. 2017Countering Adversarial Images using Input Transformationscited by 517
  8. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  9. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  10. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  11. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  12. 2018Feature Denoising for Improving Adversarial Robustnesscited by 312
  13. 2019High Frequency Component Helps Explain the Generalization of Convolutional Neural Networkscited by 310
  14. 2019A Fourier Perspective on Model Robustness in Computer Visioncited by 288
  15. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  16. 2017Deep Reinforcement Learning framework for Autonomous Drivingcited by 224
  17. 2016A study of the effect of JPG compression on adversarial imagescited by 196
  18. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  19. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  20. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  21. 2021Feature Importance-aware Transferable Adversarial Attackscited by 125
  22. 2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
  23. 2018Low Frequency Adversarial Perturbationcited by 80
  24. 2020Patch-wise Attack for Fooling Deep Neural Networkcited by 78
  25. 2019Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distancecited by 72
  26. 2019On the Effectiveness of Low Frequency Perturbationscited by 56
  27. 2021AdvDrop: Adversarial Attack to DNNs by Dropping Informationcited by 55
  28. 2019Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothingcited by 54
  29. 2022Practical Evaluation of Adversarial Robustness via Adaptive Auto Attackcited by 44
  30. 2022Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domainscited by 42
  31. 2021Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fittingcited by 37
  32. 2020Towards Frequency-Based Explanation for Robust CNNcited by 29
  33. 2020Composite Adversarial Attackscited by 29
  34. 2021QAIR: Practical Query-efficient Black-Box Attacks for Image Retrievalcited by 22
  35. 2021Feature Space Targeted Attacks by Statistic Alignmentcited by 21
  36. 2020Projection & Probability-Driven Black-Box Attackcited by 19
  37. 2020Patch-wise++ Perturbation for Adversarial Targeted Attackscited by 19
  38. 2021Staircase Sign Method for Boosting Adversarial Attackscited by 12

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 6; 2023: 27; 2024: 45; 2025: 36; 2026: 14.

128 papers.

Sort:

By area:

  1. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 177
  2. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fastcited by 149
  3. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 93
  4. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 88
  5. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  6. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  7. 2025Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignmentcited by 42
  8. 2024One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Modelscited by 39
  9. 2022Natural Color Fool: Towards Boosting Black-box Unrestricted Attackscited by 38
  10. 2023OT-Attack: Enhancing Adversarial Transferability of Vision-Language Models via Optimal Transport Optimizationcited by 36
  11. 2024Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Modelscited by 36
  12. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
38 more
  1. 2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
  2. 2025A Frustratingly Simple Yet Highly Effective Attack Baseline: Over 90% Success Rate Against the Strong Black-box Models of GPT-4.5/4o/o1cited by 34
  3. 2022Boosting the Transferability of Adversarial Attacks with Global Momentum Initializationcited by 29
  4. 2023Frequency Domain-based Dataset Distillationcited by 28
  5. 2023Rethinking the Backward Propagation for Adversarial Transferabilitycited by 27
  6. 2024Learning to Transform Dynamically for Better Adversarial Transferabilitycited by 23
  7. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  8. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  9. 2025ADVEDM:Fine-grained Adversarial Attack against VLM-based Embodied Agentscited by 19
  10. 2024Boosting Adversarial Transferability across Model Genus by Deformation-Constrained Warpingcited by 18
  11. 2024Fourier-basis Functions to Bridge Augmentation Gap: Rethinking Frequency Augmentation in Image Classificationcited by 18
  12. 2023Practical Deep Dispersed Watermarking with Synchronization and Fusioncited by 15
  13. 2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 14
  14. 2022Towards Lightweight Black-Box Attacks against Deep Neural Networkscited by 13
  15. 2023Improving the Transferability of Adversarial Examples with Arbitrary Style Transfercited by 13
  16. 2023HybridAugment++: Unified Frequency Spectra Perturbations for Model Robustnesscited by 12
  17. 2024Vulnerabilities in AI-generated Image Detection: The Challenge of Adversarial Attackscited by 12
  18. 2025SpectralAR: Spectral Autoregressive Visual Generationcited by 11
  19. 2024Practical Region-level Attack against Segment Anything Modelscited by 9
  20. 2024Cross-Task Attack: A Self-Supervision Generative Framework Based on Attention Shiftcited by 9
  21. 2024Prompt-Driven Contrastive Learning for Transferable Adversarial Attackscited by 9
  22. 2025V-Attack: Targeting Disentangled Value Features for Controllable Adversarial Attacks on LVLMscited by 9
  23. 2023Boosting Adversarial Transferability with Learnable Patch-wise Maskscited by 8
  24. 2023LFAA: Crafting Transferable Targeted Adversarial Examples with Low-Frequency Perturbationscited by 8
  25. 2024FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attackscited by 8
  26. 2024Scaling Laws for Black box Adversarial Attackscited by 8
  27. 2025SegTrans: Transferable Adversarial Examples for Segmentation Modelscited by 8
  28. 2022Improving the Transferability of Adversarial Attacks on Face Recognition with Beneficial Perturbation Feature Augmentationcited by 7
  29. 2023DANAA: Towards transferable attacks with double adversarial neuron attributioncited by 7
  30. 2024GE-AdvGAN: Improving the transferability of adversarial samples by gradient editing-based adversarial generative modelcited by 7
  31. 2024Rethinking Impersonation and Dodging Attacks on Face Recognition Systemscited by 7
  32. 2024Boosting the Transferability of Adversarial Examples via Local Mixup and Adaptive Step Sizecited by 7
  33. 2025Mitigating Object Hallucinations in MLLMs via Multi-Frequency Perturbationscited by 7
  34. 2025Silence is Golden: Leveraging Adversarial Examples to Nullify Audio Control in LDM-based Talking-Head Generationcited by 7
  35. 2023Boosting Adversarial Transferability via Fusing Logits of Top-1 Decomposed Featurecited by 6
  36. 2023On the Robustness of Split Learning against Adversarial Attackscited by 6
  37. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  38. 2023Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systemscited by 6

50 most cited of 128 All 128 (JSON)