Transfer-based attack based on image frequency and adversarial subspace.

To address the issues such as overfilling of adversarial examples on while-box models and constraints on attackers when searching for adversarial subspaces, a method to improve the Transferability of adversarial examples from the perspectives of frequency domain and searchable adversarial subspaces is proposed. Firstly, in the process of generating adversarial examples, the overfitting effect of adversarial examples on the white-box model is mitigated by reducing the high-frequency components of the image. Secondly, by expanding the searching range of the adversarial subspace to capture more information, the transferability of adversarial examples is improved. It is worthy noting that the proposed method can be combined with existing attacks. A large number of experiments on the ImageNet dataset have verified the effectiveness of the proposed method. The black-box attack success rate of the proposed method is 8.6% (for normal training models) and 18.2% higher (for defensive models), respectively than the attack methods based on fast gradient sign method on average. [ABSTRACT FROM AUTHOR]