Improving the Adversarial Transferability via Histogram Transformation

The transferability of adversarial examples poses a critical security threat to deep neural networks, since the adversarial examples crafted for one model can deceive other models, even without knowledge of their architecture or parameters. Among various approaches, data augmentation is one of the most effective strategies to improve transferability. In this letter, we propose a new data augmentation technique, termed the Histogram Transform Method (HTM). The proposed method extracts histograms from each RGB channel of the input image, applies shuffling, shifting, and stretching transformations, and constructs augmented examples through histogram matching and channel merging. By combining the gradients of the loss function with respect to both the augmented and input examples, we determine the adversarial perturbations needed to generate adversarial examples. Extensive experiments demonstrate that HTM enhances transferability and remains highly compatible with existing data augmentations, resulting in higher attack success rates across multiple black-box models. The source code is publicly available at <uri xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">https://github.com/xiaohailu1024/HTM</uri>.