Subspectrum mixup-based adversarial attack and evading defenses by structure-enhanced gradient purification

• The sensitivity difference of model decision to different subspectra were analyzed. • We propose an iterative attack based on frequency subspectrum mixup transformation. • Structure-enhanced gradient purification strategy is designed to evade defenses. • Validating the effectiveness of the proposed method in enhancing transferability. Transferable adversarial attacks against deep neural networks (DNNs) have attracted significant attention. Attackers can use adversarial examples crafted on substitute models to attack unknown target models, highlighting the importance of boosting transferability. However, the transferability of adversarial examples produced by current methods remains relatively weak. In this paper, we first propose an iterative attack based on frequency subspectrum mixup input transformation (FSMA), considering the sensitivity difference of model decision to different frequency components. Specifically, we evenly divide the discrete cosine transform spectra of noisy original image and auxiliary image into four disjoint subspectra respectively, and perform a mixup on each pair of subspectra to obtain diversified inputs to stabilize the perturbation update direction. Secondly, given the different noise phenomena in gradients of normally trained models and defenses, and the resulting gradient structure ambiguity, a structure-enhanced gradient purification strategy (SEGP) is proposed. By narrowing the difference between normal gradient and defense gradient, the success rate of adversarial examples in evading defenses is improved. We use convolutional neural network (CNN) and Transformer-based image classifiers as substitute models to craft adversarial examples. Plentiful experiments on ImageNet-compatible dataset prove the effectiveness of the proposed FSMA and SEGP. The latter can be combined with other attacks involving multi-sample average gradient processes to improve their success rate in breaking defenses. We also conduct a quantitative analysis of subspectrum mixup, illustrating the effectiveness of performing mixup on all subspectra. Our code is available at https://github.com/Rhiannon-lucky/FSMA .