Frequency Domain Model Augmentation for Adversarial Attack

For black-box attacks, the gap between substitute model and victim is usually large, which manifests as a weak attack performance. Motivated by observation that transferability of adversarial examples can be improved attacking diverse models simultaneously, augmentation methods simulate different using transformed images are proposed. However, existing transformations for spatial domain do not translate to significantly augmented models. To tackle this issue, we propose novel spectrum simulation craft more transferable against both normally trained defense Specifically, apply transformation input thus perform in frequency domain. We theoretically prove derived from leads saliency map, an indicator proposed reflect diversity Notably, our method generally combined with attacks. Extensive experiments on ImageNet dataset demonstrate effectiveness method, e.g., nine state-of-the-art average success rate 95.4%. Our code available https://github.com/yuyang-long/SSA .