Yuyang Long

Frequency Domain Model Augmentation for Adversarial Attack

"For black-box attacks, the gap between the substitute model and the victim model is usually large, which manifests as a weak attack performance. Motivated by the observation that the transferability of adversarial examples can be improved by attacking diverse models simultaneously, model augmentati…