A Method for Enhancing the Transferability of Adversarial Examples Based on Mixed Transformations

Much current work has shown that adversarial samples generated on one model can achieve good attack success on other models as well, which has attracted a lot of attention. Enhancing adversarial sample transferability by transforming the inputs is an effective method, but all existing methods only transform in one kind of domain, limiting the image transformation diversity. In this paper, a new method based on hybrid transform (HTM) is designed. The proposed method and frequency domain coefficient scaling (CS) picture randomized reduced fill (RF) picture randomized reduced fill (RF), generates a set of augmented samples based on the training samples. Specifically, the DCT coefficients are scaled using CS in the frequency domain, and then, one of the regions of the input image is randomly selected in the spatial domain, randomly scaled down and random pixels are used to fill in the region vacated by the scaling. In this paper, a large number of experiments are conducted to demonstrate that the method in this paper effectively improves the transferability of the generated adversarial samples. In addition, the method in this paper can be combined with existing adversarial sample generation methods to further improve the success rate of the attack.