SCF-FGSM: Boosting Transferable Targeted Adversarial Attacks with Feature Mixup and Space Fine-Tuning

With the widespread application of deep neural networks (DNNs) in critical fields such as autonomous driving and medical diagnosis, their adversarial robustness has become a research hotspot. In black-box attack scenarios, the transferability of targeted adversarial examples is limited by differences in decision boundaries between models, and existing methods struggle to achieve efficient attacks. To address this, we propose a novel targeted adversarial attack method, SCF-FGSM, which combines Self-Universality (SU), Clean Feature Mixup (CFM), and Feature Space Fine-Tuning. This method enhances the local feature consistency of adversarial examples through SU, utilizes CFM to generate diverse perturbations to overcome inter-model differences, and incorporates feature space fine-tuning to achieve precise alignment of target features across models. Experiments on the ImageNet dataset demonstrate that SCF-FGSM significantly outperforms existing methods in transferability and attack success rate, especially under Logit loss. Ablation studies and visualization analyses further validate the contributions of each module to transferability, revealing a synergistic mechanism between feature space alignment and perturbation diversity. This provides theoretical support and a technical pathway for improving the transferability of adversarial attacks.