Adversarial attack with frequency blended image

Abstract

Deep neural networks perform well in various computer vision tasks, but they are vulnerable to adversarial attacks. Since adversarial examples are transferable between models, adversaries can induce a model to predict a wrong class even if the target model's interior is hidden. For these transfer-based attacks, preventing adversarial examples from overfitting the source model is the most important challenge in improving transferability. To improve the adversarial transferability, I introduce the Frequency-Blended Image(FBI) method, which diversifies inputs when generating an adversarial image. Specifically, sensitive-frequency and insensitive-frequency components to the model are extracted from the original image and mixed into the original image with different weights to further increase input diversity. Extensive experiments on the ImageNet dataset show that the attack with the FBI significantly improves the transfer-based attack success rates.