一种频率驱动的黑盒对抗攻击方法

A frequency-driven black box adversarial attack method

摘要

深入理解对抗样本的特性对保障机器学习模型安全具有重要意义。针对现有对对抗性扰动与频率成分关系认识不足的问题，对对抗性扰动在频率域中的表征进行了研究，并提出一种高效的黑盒对抗攻击方法。通过小波包分解技术对对抗样本进行多尺度频率分解，发现对抗性扰动主要集中于低频段的高频成分。为此设计了一种结合特定频段信息的黑盒对抗攻击算法，并引入归一化扰动可见性指数（NDV）以解决传统范数在评估连续和离散扰动时的局限性。在多个基准数据集和模型上的实验表明，该多频带组合攻击方法平均攻击成功率达99%，优于单一频段攻击方法，并在7项评估指标上表现出优越的综合性能。此外，验证了NDV指标能够有效克服传统 L ₂范数在扰动评估中的不足。

Abstract

Enhancing the understanding of adversarial examples is crucial for ensuring the security of machine learning models in real-world applications. To address the insufficiency of existing research on the relationship between adversarial perturbations and their frequency components, this work investigates the representation of adversarial perturbations in the frequency domain and proposes an efficient black-box adversarial attack method. By applying wavelet packet decomposition to perform multi-scale frequency analysis of adversarial examples, it is found that adversarial perturbations are predominantly concentrated in the high-frequency components within low-frequency bands. Based on this observation, we design a black-box attack adversarial algorithm that incorporates specific frequency band information and introduce a normalized disturbance visibility (NDV) index to overcome the limitations of traditional norm-based metrics when evaluating both continuous and discrete perturbations. Experiments conducted on multiple benchmark datasets and models show that the proposed multi-band composite attack achieves an average success rate of 99%, significantly outperforming single-band attack approaches and demonstrating superior performance across seven evaluation metrics. Moreover, the NDV index effectively addresses the shortcomings of traditional norms, offering a more accurate and perceptually meaningful assessment of adversarial perturbations.

关键词

黑盒对抗攻击 / 频域 / 机器学习 / 小波包分解

Key words

black box adversarial attack / frequency domain / machine learning / wavelet packet decomposition

参考文献

[1] SHAH M, SUREJA N. A comprehensive review of bias in deep learning models: Methods, impacts, and future directions[J]. Archives of Computational Methods in Engineering, 2025, 32(1): 255-267.

[2] GOODFELLOW I J, SHLENS J, SZEGEDY C. Explaining and harnessing adversarial examples[J]. Stat, 2015, 1050: 20.

[3] XU K, LU Y, WANG Z, et al. A survey of adversarial examples in computer vision: Attack, defense, and beyond[J]. Wuhan University Journal of Natural Sciences, 2025, 30(1): 1-20.

[4] DENG Y P, KARAM L J. Frequency—tuned universal adversarial attacks on texture recognition[J]. IEEE Transactions on Image Processing, 2022, 31: 5856-5868.

[5] QIAN Y G, HE S K, ZHAO C Y, et al. LEA2: A lightweight ensemble adversarial attack via non—overlapping vulnerable frequency regions[C]// Proceedings of the IEEE/CVF International Conference on Computer Vision. New York: IEEE, 2023: 4487-4498.

[6] HAN S C, LIN C H, SHEN C, et al. Interpreting adversarial examples in deep learning: A review[J]. ACM Computing Surveys, 2023, 55(14s): 1-38.

[7] WANG H H, WU X D, HUANG Z Y, et al. High—frequency component helps explain the generalization of convolutional neural networks[C]// Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. [S.l.]: IEEE, 2020: 8684-8694.

[8] YIN D, LOPES R G, SHLENS J, et al. A Fourier perspective on model robustness in computer vision[EB/OL]. [2024—08—12]. https://arxiv.org/abs/1906.08988.

[9] GUO C, FRANK J S, WEINBERGER K Q. Low frequency adversarial perturbation[C]// Proceedings of the Uncertainty in Artificial Intelligence. Tel Aviv, Israel: PMLR, 2020: 1127-1137.

[10] SHARMA Y, DING G W, BRUBAKER M A. On the effectiveness of low frequency perturbations[C]// Proceedings of the 28th International Joint Conference on Artificial Intelligence. Macao, China: International Joint Conferences on Artificial Intelligence, 2019: 3389-3396.

[11] GEIRHOS R, RUBISCH P, MICHAELIS C, et al. ImageNet—trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness[C]// Proceedings of the International Conference on Learning Representations. New Orleans, LA: International Conference on Learning Representations, 2019: 10.48550/arXiv.1811.12231.

[12] SHI J, LIU X P, XIANG W, et al. Novel fractional wavelet packet transform: Theory, implementation, and applications[J]. IEEE Transactions on Signal Processing, 2020, 68: 4041-4054.

[13] KHAYAM S A. The discrete cosine transform (DCT): Theory and application[J]. Michigan State University, 2003, 114(1): 31.

[14] OTHMAN G, ZEEBAREE D Q. The applications of discrete wavelet transform in image processing: A review[J]. Journal of Soft Computing and Data Mining, 2020, 1(2): 31-43.

[15] SZEGEDY C, ZAREMBA W, SUTSKEVER I, et al. Intriguing properties of neural networks[C]// Proceedings of the 2nd International Conference on Learning Representations. Banff: International Conference on Learning Representations, 2014: 10.48550/arXiv.1312.6199.

[16] 王文萱, 汪成磊, 齐慧慧, 等. 面向深度模型的对抗攻击与对抗防御技术综述[J]. 信号处理, 2025, 41(2): 198-223.

[17] WANG W X, WANG C L, QI H H, et al. Survey on adversarial attack and adversarial defense technologies for deep learning models[J]. Journal of Signal Processing, 2025, 41(2): 198-223.

[18] MADRY A, MAKELOV A, SCHMIDT L, et al. Towards deep learning models resistant to adversarial attacks[EB/OL]. [ 2024—07—12]. https://arxiv.org/abs/1706.06083.

[19] ATHALYE A, ENGSTROM L, ILYAS A, et al. Synthesizing robust adversarial examples[C]// Proceedings of the International Conference on Machine Learning. Stockholm, Sweden: PMLR, 2018: 284-293.

[20] ANDRIUSHCHENKO M, CROCE F, FLAMMARION N, et al. Square attack: A query—efficient black—box adversarial attack via random search[M]// Computer Vision — ECCV 2020. Cham: Springer International Publishing, 2020: 484-501.

[21] GUO C, GARDNER J, YOU Y, et al. Simple black—box adversarial attacks[C]// Proceedings of the International Conference on Machine Learning. Long Beach: PMLR, 2019: 2484-2493.

[22] BRENDEL W, RAUBER J, BETHGE M. Decision—based adversarial attacks: Reliable attacks against black—box machine learning models[C]// Proceedings of the International Conference on Learning Representations. Vancouver, BC: International Conference on Learning Representations, 2018: 10.48550/arXiv.1712.04248.

[23] 温泽瑞, 姜天, 黄子健, 等. 分区稀疏攻击: 一种更高效的黑盒稀疏对抗攻击[EB/OL]. [2024—07—12]. https://kns.cnki.net/kcms/detail/50.1075.tp.20250310.1631.023.html.

[24] WEN Z R, JIANG T, HUANG Z J, et al. Partition sparse attack: A more efficient black box sparse counterattack[EB/OL]. [2024—07—12]. https://kns.cnki.net/kcms/detail/50.1075.tp.20250310.1631.023.html.

[25] CHEN P Y, ZHANG H, SHARMA Y, et al. ZOO: Zeroth order optimization based black—box attacks to deep neural networks without training substitute models[C]// Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security. New York: ACM, 2017: 15-26.

[26] HUANG Z, ZHANG T. Black—box adversarial attack with transferable model—based embedding[EB/OL]. [ 2024—07—12]. https://arxiv.org/abs/1911.07140.

[27] CHENG S Y, DONG Y P, PANG T Y, et al. Improving black—box adversarial attacks with a transfer—based prior[C]// Proceedings of the 33rd Conference on Neural Information Processing Systems (NeurIPS 2019). Vancouver: NeurIPS Foundation, 2019: 12345-12356.

[28] 万鹏, 胡聪, 吴小俊 . 多域特征混合增强对抗样本迁移性方法[J]. 中国图象图形学报, 2024, 29(12): 3670-3683.

[29] WAN P, HU C, WU X J. Multi—domain feature mixup boosting adversarial examples transferability method[J]. Journal of Image and Graphics, 2024, 29(12): 3670-3683.

[30] TSUZUKU Y, SATO I. On the structural sensitivity of deep convolutional networks to the directions of Fourier basis functions[C]// Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. New York: IEEE, 2019: 51-60.

[31] LORENZ P, HARDER P, STRAßEL D, et al. Detecting autoattack perturbations in the frequency domain[EB/OL]. [ 2024—07—12]. http://dx.doi.org/10.48550/arXiv.2111.08785.

[32] WANG H S, CORNELIUS C, EDWARDS B, et al. Toward few—step adversarial training from a frequency perspective[C]// Proceedings of the 1st ACM Workshop on Security and Privacy on Artificial Intelligence. New York: ACM, 2020: 11-19.

[33] 耿荣, 孙钦东, 曹晗, 等. 空频域联合优化的通用对抗扰动生成方法[EB/OL]. [2024—07—12]. https://doi.org/10.19678/j.issn.1000—3428.0069619.

[34] GENG R, SUN Q, CAO H, WANG Y, et al. Generating universal adversarial perturbations based on joint optimization in space—frequency domain[EB/OL]. [2024—07—12]. https://doi.org/10.19678/j.issn.1000—3428.0069619.

[35] 徐宇晖, 潘志松, 徐堃 . 面向三种形态图像的对抗攻击研究综述[J]. 计算机科学与探索, 2024, 18(12): 3080-3099.

[36] XU Y H, PAN Z S, XU K. Review of research on adversarial attack in three kinds of images[J]. Journal of Frontiers of Computer Science and Technology, 2024, 18(12): 3080-3099.

[37] WANG H H, WU X D, HUANG Z Y, et al. High—frequency component helps explain the generalization of convolutional neural networks[C]// Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. Los Alamitos, CA: IEEE, 2020: 8684-8694.

[38] MAIYA S R, EHRLICH M, AGARWAL V, et al. A frequency perspective of adversarial robustness[EB/OL]. [ 2024—07—25]. https://arxiv.org/abs/2111.00861.

[39] ABELLO A A, HIRATA R, WANG Z Y. Dissecting the high—frequency bias in convolutional neural networks[C]// Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops. Nashville, Tennessee: IEEE, 2021: 863-871.

[40] PRASAD L, IYENGAR S S. Wavelet analysis with applications to image processing[EB/OL]. [ 2024—07—17]. https://www.taylorfrancis.com/books/9781351433920.

[41] KRIZHEVSKY A, SUTSKEVER I, HINTON G E. ImageNet classification with deep convolutional neural networks[J]. Communications of the ACM, 2017, 60(6): 84-90.

[42] RUSSAKOVSKY O, DENG J, SU H, et al. ImageNet large scale visual recognition challenge[J]. International Journal of Computer Vision, 2015, 115(3): 211-252.

[43] HE K M, ZHANG X Y, REN S Q, et al. Deep residual learning for image recognition[C]// Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. New York: IEEE, 2016: 770-778.

[44] HUANG G, LIU Z, VAN DER MAATEN L, et al. Densely connected convolutional networks[C]// Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. New York: IEEE, 2017: 2261-2269.

[45] LEE G, GOMMERS R, WOHLFAHRT K, et al. PyWavelets: Wavelet transforms in python[EB/OL]. [ 2024—08—17]. https://github.com/PyWavelets/pywtZenodo.

[46] SZEGEDY C, VANHOUCKE V, IOFFE S, et al. Rethinking the inception architecture for computer vision[C]// Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. New York: IEEE, 2016: 2818-2826.

[47] SIMONYAN K, ZISSERMAN A. Very deep convolutional networks for large—scale image recognition[C]// Proceedings of the International Conference on Learning Representations. San Diego: ICLR, 2015: 1-14.

[48] PASZKE A, GROSS S, MASSA F, et al. PyTorch: An imperative style, high—performance deep learning library[EB/OL]. [ 2024—07—25]. https://arXiv.org/abs/1912.01703.

[49] RAHMATI A, MOOSAVI—DEZFOOLI S M, FROSSARD P, et al. GeoDA: A geometric framework for black—box adversarial attacks[C]// Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. New York: IEEE, 2020: 8443-8452.

[50] LI Y, LI L, WANG L, et al. Nattack: Learning the distributions of adversarial examples for an improved black—box attack on deep neural networks[C]// Proceedings of the International Conference on Machine Learning. Long Beach, CA: PMLR, 2019: 3866-3876.

基金资助

四川省自然科学基金(25NSFSC1269)