Guided Adversarial Attack in the Low-Frequency Space

Adversarial examples can assess the robustness of machine learning models, which has attracted the attention of many researchers to adversarial example generation methods. Transferability and imperceptibility stand out as two crucial metrics for evaluating the quality of adversarial examples. However, achieving a balance between these two indicators poses a formidable challenge. In this paper, we propose a low-frequency guided adversarial attack method (LGA) to generate adversarial examples with strong transferability and good imperceptibility. Specifically, we enhance the transferability of adversarial examples by increasing the diversity of attack algorithms, and introduce the guiding principle and the triplet loss constraint to ensure that the generated adversarial examples are optimized away from the class regions of the clean examples. We find that the low-frequency component in the frequency domain of the image contains the vast majority of the semantic information of the image. Therefore, we constrain the attack perturbations to low-frequency component space to enhance the covert nature while maintaining visual coherence, rendering the adversarial examples more difficult to perceive. We conduct extensive experiments on various models with different network structures and multiple defense strategies, and the experimental results demonstrate that our method outperforms existing methods in the tradeoff between transferability and imperceptibility, achieving the SOTA performance.