Research map / Adversarial robustness and security / Black-box and transfer attacks
FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FACL-Attack, a generator-based transferable adversarial attack that randomizes domain-variant low/high DCT frequency bands (FADR) and contrasts domain-invariant mid-band features (FACL), improving cross-domain and cross-model transfer over BIA.
Problem
Generating adversarial examples that transfer to unknown domains and unknown model architectures in a strict black-box setting, with low inference cost.
Approach
Uses DCT-based frequency-aware domain randomization that perturbs only domain-specific low- and high-frequency components while keeping mid-band content, plus a frequency-augmented contrastive loss that repels clean/adversarial mid-band features and attracts low/high-band feature pairs, built on the BIA generative attack framework.
Key results
- On cross-domain attacks (ImageNet-1K to CUB/Cars/Aircraft, VGG-16 surrogate), FACL-Attack reaches 44.05% average accuracy versus 51.07% for the BIA baseline.
- On cross-model ImageNet attacks, it reaches 19.66% average accuracy versus 24.86% for BIA and 22.30% for LTP.
- Plugging FADR and FACL into LTP lowers its cross-domain accuracy from 49.91% to 47.81%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add FADR and FACL (ablation) | Baseline generator · Cross-domain | top-1 accuracy after attack: 51.07 -> 44.05 | Helped |
| Add frequency-aware domain randomization (ablation) | Baseline generator · Cross-domain | top-1 accuracy after attack: 51.07 -> 46.24 | Helped |
| Add band-specific frequency contrast (ablation) | Baseline generator · Cross-domain | top-1 accuracy after attack: 51.07 -> 45.36 | Helped |
| Add FADR and FACL (ablation) | Baseline generator · Cross-model | top-1 accuracy after attack: 24.86 -> 19.66 | Helped |
| Randomize the entire frequency band instead of using domain-aware frequency randomization (ablation) | FACL-Attack · Cross-domain | top-1 accuracy after attack: 44.05 -> 47.24 | Hurt |
| Randomize the entire frequency band instead of using domain-aware frequency randomization (ablation) | FACL-Attack · Cross-model | top-1 accuracy after attack: 19.66 -> 21.68 | Hurt |
| Randomize only mid-frequency components (ablation) | Frequency randomization · Cross-domain and cross-model | top-1 accuracy after attack: Low-Rand 47.06; Mid-Rand 48.17; High-Rand 47.78; Low-Rand 21.25; Mid-Rand 22.99; High-Rand 22.79 | Hurt |
| Reduce perturbation budget from l∞≤10 to l∞≤9 (ablation) | FACL-Attack · ImageNet-1K, cross-model | top-1 accuracy after attack: 19.66 -> 23.85 | Hurt |
| Reduce perturbation budget from l∞≤10 to l∞≤9 (ablation) | FACL-Attack · ImageNet-1K, cross-model | SSIM: 0.72 -> 0.75 | Helped |
| Add domain-agnostic attention (ablation) | FACL-Attack · Cross-domain | top-1 accuracy after attack: 44.05 -> 38.46 | Helped |
| Add random normalization (ablation) | FACL-Attack · Cross-domain and cross-model | top-1 accuracy after attack: 44.05 -> 50.06; 19.66 -> 18.51 | Mixed |
| Add FADR and FACL modules (ablation) | LTP · Cross-domain and cross-model | top-1 accuracy after attack: 49.91 -> 47.81; 22.30 -> 19.74 | Helped |
Surprising findings
- Randomizing mid-band frequencies alone degrades attack gains relative to low- or high-band randomization, suggesting mid-band content is more domain-invariant and should be preserved.
Limitations
- Results are averaged over three seeds but with only a single training epoch and fixed hyperparameters tuned on Dense-169.
- Combining FADR with BIA's random normalization module conflicts and degrades performance.
Experimental setup
Datasets: ImageNet-1K
Benchmarks: CUB-200-2011 Stanford Cars FGVC Aircraft ImageNet-1K
Metrics: top-1 accuracy after attack SSIM PSNR LPIPS
Baselines: GAP CDA LTP BIA PGD DIM DR SSP
Builds on: BIA SSA FSDR FACT LTP
Closest papers by meaning
- Towards Transferable Adversarial Attacks with Centralized Perturbation (AAAI 2024 · similarity 0.87)
- CDTA: A Cross-Domain Transfer-Based Attack with Contrastive Learning (AAAI 2023 · similarity 0.87)
- Frequency-Aware Deepfake Detection: Improving Generalizability through Frequency Space Domain Learning (AAAI 2024 · similarity 0.87)
- DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain (NeurIPS 2024 · similarity 0.86)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.84)
- Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature (AAAI 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.