A Highly Transferable Adversarial Example Generation Method via Spatial-Frequency Dual-Domain Feature Fusion

ZHANG Shihui; ZHAO Pengyu; ZHANG Yao; HAN Shaojie

doi:10.12263/DZXB.20250521

您当前的位置：

首页 >

文章列表页 >

A Highly Transferable Adversarial Example Generation Method via Spatial-Frequency Dual-Domain Feature Fusion

PAPERS | 更新时间：2026-04-29

- A Highly Transferable Adversarial Example Generation Method via Spatial-Frequency Dual-Domain Feature Fusion
- ACTA ELECTRONICA SINICA Vol. 54, Issue 1, Pages: 125-140(2026)
- 作者机构：
  
  1.燕山大学人工智能学院，河北秦皇岛 066000
  2.河北省计算机虚拟技术与系统集成重点实验室，河北秦皇岛 066000
- 作者简介：
- 基金信息：
  
  National Natural Science Foundation of China(62476235);Natural Science Foundation of Hebei Province(F2023203012)
- DOI：10.12263/DZXB.20250521
  CLC： TP391.4;
- Received：19 June 2025，
  
  Accepted：30 December 2025，
  
  Published：25 January 2026
- 稿件说明：
移动端阅览
张世辉, 赵鹏宇, 张尧, 等. 基于空频双域特征融合的高迁移性对抗样本生成方法[J]. 电子学报, 2026, 54(01): 125-140.

ZHANG Shihui, ZHAO Pengyu, ZHANG Yao, et al. A Highly Transferable Adversarial Example Generation Method via Spatial-Frequency Dual-Domain Feature Fusion[J]. Acta Electronica Sinica, 2026, 54(01): 125-140.
张世辉, 赵鹏宇, 张尧, 等. 基于空频双域特征融合的高迁移性对抗样本生成方法[J]. 电子学报, 2026, 54(01): 125-140. DOI：10.12263/DZXB.20250521

ZHANG Shihui, ZHAO Pengyu, ZHANG Yao, et al. A Highly Transferable Adversarial Example Generation Method via Spatial-Frequency Dual-Domain Feature Fusion[J]. Acta Electronica Sinica, 2026, 54(01): 125-140. DOI：10.12263/DZXB.20250521

摘要

尽管深度神经网络在许多领域中均表现出卓越的性能，但对抗样本的存在暴露出其在安全方面的显著缺陷。现有黑盒攻击方法通常仅在单一域中进行对抗攻击，忽视了多域特征协同扰动在提升对抗样本迁移性中的重要作用，且多存在损失函数功能单一问题，难以兼顾目标类别导向与梯度稳定。鉴于此，本文提出了一种基于空频双域特征融合的高迁移性对抗样本生成方法（Spatial-Frequency Dual-domain Feature Fusion，SFDFF）。首先，使用离散余弦变换将输入样本从空间域转换至频率域，区域级融合输入样本与原始样本的频率域特征；其次，利用逆离散余弦变换将输入样本还原至空间域，并向其注入基于原始样本统计特征的噪声；然后，通道级融合输入样本与原始样本的空间域特征；最后，设计了一种兼具目标引导与稳定梯度的双导向损失以进一步提高攻击性能。在ImageNet-Compatible与CIFAR-10数据集上的大量实验验证了所提方法的性能。例如，在ImageNet-Compatible数据集上，当从adv-RN-50模型迁移至LeViT模型时，所提SFDFF方法的攻击成功率较当前最优方法提升了2.5%。本文代码见

https：//github.com/ipkpkpk/SFDFF

https://github.com/ipkpkpk/SFDFF

。

Abstract

Despite the remarkable performance of deep neural networks across various fields

the existence of adversarial examples reveals significant security vulnerabilities. Existing black-box attack methods typically operate within a single domain

overlooking the importance of multi-domain feature co-perturbation in enhancing the transferability of adversarial examples. Moreover

many methods suffer from a single-purpose loss function

making it difficult to balance target class guidance and gradient stability. To address these issues

this paper proposes a high-transferability adversarial examples generation method based on spatial-frequency dual-domain feature fusion (SFDFF). Specifically

the input examples are first transformed from the spatial domain to the frequency domain using the discrete cosine transform

and region-level feature fusion is performed between the input and clean examples in the frequency domain. Then

the input examples are restored to the spatial domain via the inverse discrete cosine transform

and no

ise based on the statistical characteristics of the original examples are injected. Next

channel-level fusion of spatial features between the input and clean examples are conducted. Finally

a dual-guidance loss function is designed to simultaneously enhance target class directionality and gradient stability. Extensive experiments on ImageNet-Compatible and CIFAR-10 datasets demonstrate the performance of the proposed method. For instance

the attack success rate of the proposed SFDFF increases by 2.5% compared to the state-of-the-art method when transferred from the adv-RN-50 to LeViT model on ImageNet-Compatible dataset. The code is available at

https://github.com/ipkpkpk/SFDFF

关键词

Keywords

references

He Kaiming , Zhang Xiangyu , Ren Shaoqing , et al . Deep residual learning for image recognition [C ] // 2016 IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE , 2016 : 770 - 778 .

Huang Gao , Liu Zhuang , Van Der Maaten L , et al . Densely connected convolutional networks [C ] // 2017 IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE , 2017 : 2261 - 2269 .

Zhang Peiyuan , Luo Junwei , Yang Xue , et al . PointOBB-v3: Expanding performance boundaries of single point-supervised oriented object detection [J ] . International Journal of Computer Vision , 2025 , 133 ( 9 ): 6108 - 6128 .

Lin Zhiwei , Liu Zhe , Xia Zhongyu , et al . RCBEVDet: Radar-camera fusion in bird’s eye view for 3D object detection [C ] // 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE , 2024 : 14928 - 14937 .

张世辉 , 张晓微 , 宋丹丹 , 等 . 基于逆扰动融合生成对抗网络的对抗样本防御方法 [J ] . 电子学报 , 2023 , 51 ( 4 ): 879 - 884 .

Zhang Shihui , Zhang Xiaowei , Song Dandan , et al . Adversarial example defense method based on inverse perturbation fusing generative adversarial network [J ] . Acta Electronica Sinica , 2023 , 51 ( 4 ): 879 - 884 . (in Chinese)

吴骥 , 邵文泽 , 葛琦 , 等 . 一种基于迭代累积梯度的多层特征重要性攻击方法 [J ] . 电子学报 , 2024 , 52 ( 11 ): 3798 - 3808 .

Wu Ji , Shao Wenze , Ge Qi , et al . A multi-layer feature importance attack method based on iterative accumulated gradients [J ] . Acta Electronica Sinica , 2024 , 52 ( 11 ): 3798 - 3808 . (in Chinese)

王硕 , 徐茹枝 , 关志涛 . 基于主特征归因的对抗样本生成方法研究 [J ] . 电子学报 , 2023 , 51 ( 11 ): 3137 - 3145 .

Wang Shuo , Xu Ruzhi , Guan Zhitao . Research on the generation of adversarial samples based on the attribution of principal features [J ] . Acta Electronica Sinica , 2023 , 51 ( 11 ): 3137 - 3145 . (in Chinese)

Kurakin A , Goodfellow I J , Bengio S . Adversarial examples in the physical world [M ] //Yampolskiy R V. Artificial intelligence safety and security . New York : Chapman and Hall/CRC , 2018 : 99 - 112 .

Dong Yinpeng , Liao Fangzhou , Pang Tianyu , et al . Boosting adversarial attacks with momentum [C ] // 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE , 2018 : 9185 - 9193 .

Lin Jiadong , Song Chuanbiao , He Kun , et al . Nesterov accelerated gradient and scale invariance for adversarial attacks [PP/OL ] . V5.arXiv ( 2020-02-03 )[ 2025-06-20 ] . https://arXiv.org/abs/1908.06281 https://arXiv.org/abs/1908.06281 .

Wang Xiaosen , He Kun . Enhancing the transferability of adversarial attacks through variance tuning [C ] // 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE , 2021 : 1924 - 1933 .

Xie Cihang , Zhang Zhishuai , Zhou Yuyin , et al . Improving transferability of adversarial examples with input diversity [C ] // 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE , 2019 : 2725 - 2734 .

Zou Junhua , Pan Zhisong , Qiu Junyang , et al . Improving the transferability of adversarial examples with resized-diverse-inputs, diversity-ensemble and region fitting [C ] // Proceedings of the 16th European Conference on Computer Vision . Heidelberg : Springer , 2020 : 563 - 579 .

Dong Yinpeng , Pang Tianyu , Su Hang , et al . Evading defenses to transferable adversarial examples by translation-invariant attacks [C ] // 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE , 2019 : 4307 - 4316 .

Wang Xiaosen , He Xuanran , Wang Jingdong , et al . Admix: Enhancing the transferability of adversarial attacks [C ] // 2021 IEEE/CVF International Conference on Computer Vision . Piscataway : IEEE , 2022 : 16138 - 16147 .

Long Yuyang , Zhang Qilong , Zeng Boheng , et al . Frequency domain model augmentation for adversarial attack [C ] // Proceedings of the 17th European Conference on Computer Vision . Heidelberg : Springer , 2022 : 549 - 566 .

Li Jiachun , Hu Yuchao , Yan Cheng . FDAA: A feature distribution-aware transferable adversarial attack method [J ] . Neural Networks , 2024 , 178 : 106467 .

Zhao Zhengyu , Liu Zhuoran , Larson M . On success and simplicity: A second look at transferable targeted attacks [PP/OL ] . V4.arXiv ( 2021-10-26 )[ 2025-10-10 ] . https://arxiv.org/abs/2012.11207 https://arxiv.org/abs/2012.11207 .

Weng Juanjuan , Luo Zhiming , Li Shoazi , et al . Logit margin matters: Improving transferable targeted adversarial attack by logit calibration [J ] . IEEE Transactions on Information Forensics and Security , 2023 , 18 : 3561 - 3574 .

Inkawhich N , Liang K J , Carin L , et al . Transferable perturbations of deep feature distributions [PP/OL ] . V1.arXiv ( 2020-04-27 )[ 2025-06-20 ] . https://arXiv.org/abs/2004.12519 https://arXiv.org/abs/2004.12519 .

Byun J , Kwon M J , Cho S , et al . Introducing competition to boost the transferability of targeted adversarial examples through clean feature mixup [C ] // 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE , 2023 : 24648 - 24657 .

Weng Juanjuan , Luo Zhiming , Li Shaozi . Improving transferable targeted adversarial attack via normalized logit calibration and truncated feature mixing [J ] . IEEE Transactions on Information Forensics and Security , 2025 , 20 : 4595 - 4609 .

Liang Kaisheng , Dai Xuelong , Li Yanjie , et al . Improving transferable targeted attacks with feature tuning Mixup [C ] // 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE , 2025 : 25802 - 25811 .

Simonyan K , Zisserman A . Very deep convolutional networks for large-scale image recognition [PP/OL ] . V6.arXiv ( 2015-04-10 )[ 2025-06-20 ] . https://arXiv.org/abs/1409.1556 https://arXiv.org/abs/1409.1556 .

Sandler M , Howard A , Zhu Menglong , et al . MobileNetV2: Inverted residuals and linear bottlenecks [C ] // 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE , 2018 : 4510 - 4520 .

Tan Mingxing , Le Q V . EfficientNet: Rethinking model scaling for convolutional neural networks [PP/OL ] . V5.arXiv ( 2020-09-11 )[ 2025-10-10 ] . https://arXiv.org/abs/1905.11946 https://arXiv.org/abs/1905.11946 .

Szegedy C , Ioffe S , Vanhoucke V , et al . Inception-v4, inception-ResNet and the impact of residual connections on learning [PP/OL ] . V2.arXiv ( 2016-08-23 )[ 2025-10-10 ] . https://arxiv.org/abs/1602.07261 https://arxiv.org/abs/1602.07261 .

Szegedy C , Vanhoucke V , Ioffe S , et al . Rethinking the inception architecture for computer vision [C ] // 2016 IEEE Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE , 2016 : 2818 - 2826 .

Dosovitskiy A , Beyer L , Kolesnikov A , et al . An image is worth 16 × 16 words: Transformers for image recognition at scale [PP/OL ] . V2.arXiv ( 2021-06-03 )[ 2025-06-18 ] . https://arXiv.org/abs/2010.11929 https://arXiv.org/abs/2010.11929 .

Graham B , El-Nouby A , Touvron H , et al . LeViT: A vision transformer in ConvNet’s clothing for faster inference [C ] // 2021 IEEE/CVF International Conference on Computer Vision . Piscataway : IEEE , 2021 : 12239 - 12249 .

D’Ascoli S , Touvron H , Leavitt M L , et al . ConViT: Improving vision transformers with soft convolutional inductive biases [J ] . Journal of Statistical Mechanics: Theory and Experiment , 2022 , 2022 ( 11 ): 114005 .

Chu Xiangxiang , Tian Zhi , Wang Yuqing , et al . Twins: Revisiting the design of spatial attention in vision transformers [C ] // Proceedings of the 35th International Conference on Neural Information Processing Systems . Red Hook : Curran Associates Inc , 2021 : 716 .

Heo B , Yun S , Han D , et al . Rethinking spatial dimensions of vision transformers [C ] // 2021 IEEE/CVF International Conference on Computer Vision . Piscataway : IEEE , 2021 : 11916 - 11925 .

Pang Tianyu , Xu Kun , Du Chao , et al . Improving adversarial robustness via promoting ensemble diversity [PP/OL ] . V3.arXiv ( 2019-05-29 )[ 2025-10-10 ] . https://arxiv.org/abs/1901.08846 https://arxiv.org/abs/1901.08846 .

Kariyappa S , Qureshi M K . Improving adversarial robustness of ensembles with diversity training [PP/OL ] . V1.arXiv ( 2019-01-28 )[ 2025-06-20 ] . https://arXiv.org/abs/1901.09981 https://arXiv.org/abs/1901.09981 .

Byun J , Cho S , Kwon M J , et al . Improving the transferability of targeted adversarial examples through object-based diverse input [C ] // 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE , 2022 : 15223 - 15232 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on Category Similarity-Driven Dynamic Fake Target Adversarial Attack Methods

A Multi-Layer Feature Importance Attack Method Based on Iterative Accumulated Gradients

Boosting Adversarial Transferability Through Adaptive-Learning-Rate with Data Augmentation Mechanism

Related Author

YU Hong-xia

LU Lei-ji

BAO Lei

CHEN Jun

ZHANG Lin-jun

WU Ji

SHAO Wen-ze

GE Qi

Related Institution

Department of Information Engineering, PLA Army Services University

School of Telecommunications and Information Engineering, Nanjing University of Posts and Telecommunications

Engineering Research Center for Digital Forensics Ministry of Education, Nanjing University of Information Science and Technology

Department of Information Engineering， PLA Army Academy of Artillery and Air Defense

PLA Academy of Military Science

⁰