Semantic Attacks based on both Style and Frequency Restrictions

Adversarial attacks can generate adversarial examples by adding perturbation information to benign samples, causing neural networks to misjudge. Semantic-based adversarial attacks are a type of attack algorithm that aims to disrupt the semantic information represented by sample features. However, most semantic attacks do not distinguish between style-related features and content-related features of the sample, resulting in unstable attack effects and perturbations that are easily perceived by the human visual system (HVS). Our attack algorithm generates adversarial examples by perturbing the semantic information of benign examples and then obtains the stylized adversarial examples through style transformations technology. The adversarial examples and stylized adversarial examples compete with each other to suppress perturbations caused by style-related features, while frequency constraints are introduced to limit the perturbations, thereby generating the optimal adversarial examples. Our attack algorithm suppresses the style features of the samples, which can improve the stability of the attack and ensure that perturbations do not appear in areas easily perceived by the HVS. Extensive experiments on the CIFAR-10, CIFAR-100, and ImageNet-1K datasets demonstrate that our attack algorithm can achieve a maximum improvement of 0.41 in ASR, 0.19 in L2, and 2.05 in FID. Therefore, our attack algorithm has a better attack effect and can generate perturbations that are more difficult to detect.