Research map / Adversarial robustness and security / Black-box and transfer attacks
Towards Transferable Adversarial Attacks with Centralized Perturbation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a plug-and-play frequency-domain attack that dynamically quantizes DCT coefficient blocks of the perturbation, with a learned quantization matrix, to centralize perturbation and improve black-box transferability.
Problem
Transfer-based black-box attacks create perturbations over the whole image, producing excessive model-specific noise that overfits the source model and limits transferability to unknown DNNs.
Approach
Decompose perturbations into YCbCr channels and 8x8 DCT blocks, then apply a learnable binary quantization matrix (optimized per iteration via back-propagation with a straight-through style differentiable top-percentile rounding) so perturbation is concentrated on dominant frequency coefficients, integrated into existing gradient attacks.</429>
Key results
- Integrating the centralized perturbation strategy improves transfer fooling rates by 11.7% on average over vanilla gradient-based attacks.
- Against JPEG compression (quality 75), MI-FGSM with the method raises ResNet-152 fooling rate from 23.1% to 34.8%.
- Against adversarial-training defenses, the approach boosts fooling rates by up to 20% in some scenarios.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add dynamic frequency-domain centralized perturbation to gradient-based attacks | MI-FGSM, DI-FGSM, TI-FGSM, VMI-FGSM, and SI-NI-FGSM · ImageNet transfer attacks | fooling rate: 11.7% | Helped |
| Add centralized perturbation | transfer-based attacks · Adversarially trained black-box models | fooling rate: 10.5% | Helped |
| Add centralized perturbation | MI-FGSM and VMI-FGSM · JPEG compression quality 75 and bit-depth reduction to 3 bits | fooling rate: at least 3.5% | Helped |
| Allocate more quantization to the luma channel rather than chroma channels (ablation) | MI-FGSM + Ours · ImageNet transfer attacks | fooling rate | Helped |
| Increase quantization of the Cb or Cr channel (ablation) | MI-FGSM + Ours · ImageNet transfer attacks | fooling rate | Hurt |
| Use randomly chosen fixed quantization matrices (RandA) instead of dynamically guided matrices (ablation) | MI-FGSM and SI-NI-FGSM · Res-152, VGG-11, Dense-121, Inc-v4, Conv-NeXt, and ViT-B/16 | fooling rate: 44.6% -> 37.0%; 43.0% -> 52.1%; 43.2% -> 36.7%; 35.4% -> 61.5% | Mixed |
| Choose random quantization matrices at each iteration (RandB) instead of dynamically guided matrices (ablation) | MI-FGSM and SI-NI-FGSM · Res-152, VGG-11, Dense-121, Inc-v4, Conv-NeXt, and ViT-B/16 | fooling rate: 44.6% -> 37.6%; 43.0% -> 52.2%; 43.2% -> 28.2%; 35.4% -> 51.4% | Mixed |
| Preserve only low-frequency coefficients (Low) instead of dynamically selecting coefficients (ablation) | MI-FGSM and SI-NI-FGSM · ImageNet transfer attacks | fooling rate: 44.6% -> 50.3%; 43.0% -> 63.1%; 50.7% vs 50.3%; 49.9% vs 45.5% | Mixed |
| Preserve only high-frequency coefficients (High) (ablation) | gradient-based attacks · ImageNet transfer attacks | fooling rate: zero | Hurt |
| Set the chroma-channel quantization ratios to r_Cb=0.05 and r_Cr=0.05 rather than allocating more quantization to chroma (ablation) | centralized perturbation · ImageNet transfer attacks | fooling rate: less than 50% at best | Helped |
Surprising findings
- Preserving only high-frequency coefficients causes fooling rates to drop to near zero in most cases.
- Centralizing perturbation toward chroma channels consistently deteriorates transferability.
Limitations
- Gains are reported primarily on a single 1000-image subset with a limited set of source models (ResNet-50, VGG-19, Inception-v3).
- Results against adversarial training show high variance across attacks and models; the method slightly underperforms baselines on ConvNeXt in some settings.
Experimental setup
Datasets: NeurIPS 2017 Adversarial Learning Challenge ImageNet subset
Benchmarks: NeurIPS 2017 Adversarial Learning Challenge ImageNet subset
Metrics: fooling rate white-box success rate
Baselines: MI-FGSM DI-FGSM TI-FGSM VMI-FGSM SI-NI-FGSM Low-frequency constraint
Builds on: MI-FGSM DI-FGSM TI-FGSM VMI-FGSM SI-NI-FGSM
Closest papers by meaning
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.90)
- Improving Transferable Targeted Adversarial Attacks with Model Self-Enhancement (CVPR 2024 · similarity 0.90)
- Boosting Adversarial Transferability through Augmentation in Hypothesis Space (CVPR 2025 · similarity 0.88)
- Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatness (NeurIPS 2024 · similarity 0.88)
- Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignment (NeurIPS 2025 · similarity 0.88)
- Boosting the Transferability of Adversarial Attack on Vision Transformer with Adaptive Token Tuning (NeurIPS 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.