FreqAT: An Adversarial Training Based on Adaptive Frequency-Domain Transform
摘要
With the advancement and popularity of deep learning (DL), the complexity and black-box of its decision-making process have posed novel vulnerabilities. Adversarial attacks (AATs), which craft clean samples to adversarial examples (AEs), compromise the reliability of DL-based models. By failing adversarial perturbation, transformation-based adversarial defenses have emerged as effective strategies against AEs. While these transformations can filter out AEs, they fail to fundamentally enhance the robustness of models and ignore the interference of perturbations on the visual fidelity of images. Instead of spatial-domain, frequency-domain transformations provide an imperceptible transformation and defense strategy. This paper introduces a novel adaptive frequency-domain-based adversarial training (AT) mechanism (called FreqAT). FreqAT first leverages frequency-domain transformations to improve the robustness of models and reduce visual interference on clean images. It further enhances the generalization of models across architectures and datasets by an adaptive transformation. Experimental results show that by combining frequency-domain transformations and AT, we can enhance model robustness while mitigating the quality degradation of clean samples.