Feature variance suppression-based adversarial attack method

In recent years, transfer-based adversarial attacks have received extensive research attention. However, existing methods often retain substantial model-specific features in adversarial samples due to overfitting the source model, resulting in low success rates for black-box attacks. In this work, we observe that applying multiple input transformations to samples reveals significant differences in the distribution of abnormally high-variance features across different models. We propose that suppressing these unstable features can reduce model-specific components in adversarial samples, thereby enhancing their transferability. To this end, we propose Feature Variance Suppression-based Adversarial Method (FVSM). This method suppresses high-variance features in the model’s feature layers, forcing perturbations to focus on stable response patterns across models. Specifically, we train an enhancer network that suppresses abnormally high variance features in specific layers of the source model. We then compute feature gradients using the enhanced images to obtain a more cross-model consistent gradient distribution. These purified gradients were subsequently utilized to guide adversarial sample generation. Experimental evaluations on ImageNet-compatible datasets demonstrate that FVSM effectively attacks diverse networks. Against normally trained models, FVSM achieves an average attack success rate of 89%−97%, representing up to an 8% improvement over existing state-of-the-art methods. Against adversarially trained defense models, FVSM achieves an average attack success rate of 66%−93%, with improvements reaching up to 5%.