Improving Adversarial Transferability through Channel-wise Scaling and Frequency-random Dropping

Abstract

For black-box attacks, most existing attack methods exhibit weak transferability due to the significant discrepancy between substitute model and victim model. We argue that the model-specific discriminative regions are a key factor causing overfitting to the source model. However, existing model augmentation methods focus on augmentations within a single domain, thereby restricting the diversity of the simulated models. In this paper, we present a novel model augmentation method named CSFD, which combines our proposed channel-wise scaling(CS) and frequency-random dropping(FD) to enhance the diversity of simulated model. Specifically, we first scale the image by channel with CS, which augments them in spatial domain. Then we randomly remove specific frequency patterns of the image with our FD, further augmenting the image in frequency domain by introducing a loss-preserving transformation. This enables us to fully exploit the properties of image in different domains and largely increases the diversity of simulated models. Additionally, we inject random noise perturbations into the sample, effectively exploring the decision boundary within an extended data distribution space. Extensive experiments on ImageNet dataset show that the proposed method has better performance than the existing methods.