Improving Adversarial Transferability via Frequency-Guided Sample Relevance Attack

Deep neural networks (DNNs) are known to be vulnerable to adversarial examples. To facilitate model safety, transfer-based attacks employ surrogate models to craft adversarial examples. In this work, we firstly study the intricate mechanisms of such attacks. We observe a correlation between the sharpness of decision boundaries in model sensitive regions and overfitting during adversarial training, which hampers the adversarial examples' transferability. To address this issue, we propose a novel approach termed Frequency-Guided Sample Relevance Attack (FGSRA). Specifically, we leverage frequency information to explore similar sensitive regions across different models, thereby generating neighborhood samples. Additional similarity weights are subsequently introduced to assess the adversarial contribution of the neighborhood samples. A hybrid gradient is then obtained to thoroughly exploit neighborhood information within input samples. Extensive experiments demonstrate the prominent performance of our approach. Compared to other state-of-the-art benchmarks on surrogate model Inc-v3, our method has an average improvement of 27.21% for normally trained CNNs and 42.1% for adversarially trained CNNs. Moreover, we achieve an average improvement of 24.6% for ViTs. Our code is available at:https://github.com/LMBTough/FGSRA