计算机科学

计算机科学 ›› 2026, Vol. 53 ›› Issue (10): 476-485.doi: 10.11896/jsjkx.260600130

• 信息安全 • 上一篇    

面向跨域迁移攻击的稳定结构表征与分布级相对优化方法

易晓银1, 陈龙2, 朱小飞3   

  1. 1 重庆邮电大学计算机科学与技术学院 重庆 400065
    2 重庆邮电大学网络空间安全与信息法学院 重庆 400065
    3 重庆理工大学计算机科学与工程学院 重庆 400054
  • 收稿日期:2026-06-18 修回日期:2026-08-24 发布日期:2026-10-13
  • 通讯作者: 陈龙(chenlong@cqupt.edu.cn)
  • 基金资助:
    重庆市教委科学技术研究青年项目(KJQN202302403)

Stable Structural Representation and Distribution-level Relative Optimization for Cross-domain Transferable Adversarial Attacks

YI Xiaoyin1, CHEN Long2, ZHU Xiaofei3   

  1. 1 School of Computer Science and Technology,Chongqing University of Posts and Telecommunications,Chongqing 400065, China
    2 School of Cyber Security and Information Law,Chongqing University of Posts and Telecommunications,Chongqing 400065, China
    3 College of Computer Science and Engineering,Chongqing University of Technology,Chongqing 400054, China
  • Received:2026-06-18 Revised:2026-08-24 Online:2026-10-13
  • About author:YI Xiaoyin,born in 1985,Ph.D candidate,associate professor.Her main research interests include artificial intelligence security and adversarial machine learning.
    CHEN Long,born in 1970,Ph.D,professor.His main research interests include computer forensics,cybersecurity,and intelligent digital content security.
  • Supported by:
    Scientific and Technological Research Youth Project of Chongqing Municipal Education Commission(KJQN202302403).

PDF (PC)

59

摘要： 跨数据域黑盒迁移攻击旨在使对抗扰动在未知目标域上保持稳定的攻击能力。然而,域偏移会破坏特征统计的一致性并诱发语义漂移,使现有生成式方法容易依赖源域特有的统计模式,难以学习跨域稳定的扰动表示;同时,标签级攻击目标过度依赖源域类别语义与判别边界,限制了扰动的跨域迁移能力。针对上述问题,提出一种结合跨域稳定结构表征建模与分布级相对优化的跨域可迁移对抗扰动生成框架。设计中值增强的通道-空间特征增强模块(MECS),通过稳健统计建模和多尺度空间建模,增强生成器对跨域相对稳定结构信息的表征能力。进一步提出相对KL散度损失(RKL),以干净样本预测分布为参考,在分布层面调整模型决策结构,从而降低攻击优化对显式标签监督的依赖。实验结果表明,所提方法在多种跨域与同域迁移设置下均优于现有方法。在不同扰动预算条件下,以 Paintings 和 Comics 为源域、ImageNet 为目标域的跨域攻击场景中,所提方法的平均 Fooling Rate 相比基于交叉熵优化的生成式基线方法分别提升 7.49 和 5.88 个百分点。

关键词: 跨域可迁移对抗攻击, 对抗扰动生成, 结构表征建模, 分布级相对优化, 相对KL散度

Abstract: Cross-domain black-box transfer attacks aim to maintain the effectiveness of adversarial perturbations on unknown target domains.However,domain shift disrupts the consistency of feature statistics and induces semantic drift,causing existing ge-nerative methods to rely heavily on source-domain-specific statistical patterns and making it difficult to learn perturbation representations that remain stable across domains.Meanwhile,label-level attack objectives depend strongly on source-domain class semantics and decision boundaries,which further limits the cross-domain transferability of adversarial perturbations.To address these issues,this paper proposes a cross-domain transferable adversarial perturbation generation framework that combines cross-domain stable structural representation modeling with distribution-level relative optimization.Specifically,it designs a median-enhanced channel-spatial(MECS) feature enhancement module,which integrates robust statistical modeling with multi-scale spatial modeling to strengthen the generator’s ability to capture structural information that remains relatively stable across domains.It further introduces a relative kullback-leibler(RKL) divergence loss,which uses the prediction distribution of clean samples as a reference and adjusts the model’s decision structure at the distribution level,thereby reducing the dependence of attack optimization on explicit label supervision.Experimental results show that the proposed method consistently outperforms existing methods under various cross-domain and within-domain transfer settings.Under different perturbation budgets,when Paintings and Co-mics are used as the source domains and ImageNet as the target domain,the proposed method improves the average Fooling Rate by 7.49 and 5.88 percentage points,respectively,compared with a generative baseline optimized using cross-entropy loss.

Key words: Cross-domain transferable adversarial attacks, Adversarial perturbation generation, Structural representation mode-ling, Distribution-level relative optimization, Relative KL divergence

中图分类号: 

  • TP309
[1] GU J,JIA X,DE JORGE P,et al.A survey on transferability of adversarial examples across deep neural networks[J/OL].Transactions on Machine Learning Research,2024.https://openreview.net/forum?id=AYJ3m7BocI.
[2] ZHU R,ZHANG Z,LIANG S,et al.Learning to transform dynamically for better adversarial transferability[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.IEEE,2024:24273-24283.
[3] WANG X,ZHANG Z,ZHANG J.Structure invariant transformation for better adversarial transferability[C]//Proceedings of the IEEE/CVF International Conference on Computer Vision.IEEE,2023:4607-4619.
[4] YANG H,JEONG J,YOON K J.FACL-Attack:Frequency-aware contrastive learning for transferable adversarial attacks[C]//Proceedings of the AAAI Conference on Artificial Intelligence.AAAI,2024:6494-6502.
[5] LI Z,WANG W,LI J,et al.UCG:A universal cross-domain ge-nerator for transferable adversarial examples[J].IEEE Transactions on Information Forensics and Security,2024,19:3023-3037.
[6] ZHOU K,LIU Z,QIAO Y,et al.Domain generalization:A survey[J].IEEE Transactions on Pattern Analysis and Machine Intelligence,2023,45(4):4396-4415.
[7] LI Q,GUO Y,ZUO W,et al.Improving adversarial transferabi-lity via intermediate-level perturbation decay[C]//Advances in Neural Information Processing Systems 36.Curran Associates,2023:32900-32912.
[8] LI T,MA X,JIANG Y G.AIM:Additional image guided generation of transferable adversarial attacks[C]//Proceedings of the AAAI Conference on Artificial Intelligence.AAAI,2025:4941-4949.
[9] DONG Y,LIAO F,PANG T,et al.Boosting adversarial attacks with momentum[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition.IEEE,2018:9185-9193.
[10] LIN J,SONG C,HE K,et al.Nesterov accelerated gradient and scale invariance for adversarial attacks[C]//International Conference on Learning Representations.2020.
[11] XIE C,ZHANG Z,ZHOU Y,et al.Improving transferability of adversarial examples with input diversity[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.IEEE,2019:2725-2734.
[12] DONG Y,PANG T,SU H,et al.Evading defenses to transferable adversarial examples by translation-invariant attacks[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.IEEE,2019:4307-4316.
[13] GUO Y,LIU W,XU Q,et al.Boosting adversarial transferability through augmentation in hypothesis space[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.IEEE,2025:19175-19185.
[14] REN Y,ZHAO Z,LIN C,et al.Improving integrated gradient-based transferable adversarial examples by refining the integration path[C]//Proceedings of the AAAI Conference on Artificial Intelligence.AAAI,2025:6731-6739.
[15] CHEN J,FENG Z,ZENG R,et al.Enhancing adversarial transferability with adversarial weight tuning[C]//Proceedings of the AAAI Conference on Artificial Intelligence.AAAI,2025:2061-2069.
[16] MI J X,ZHONG X,LI W.Improving adversarial transferabilitywith local perturbation augmentation[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.IEEE,2026:20639-20649.
[17] NASEER M,KHAN S H,KHAN M H,et al.Cross-domaintransferability of adversarial perturbations[C]//Advances in Neural Information Processing Systems 32.Curran Associates,2019:12905-12915.
[18] ZHANG Q,LI X,CHEN Y,et al.Beyond ImageNet attack:Towards crafting adversarial examples for black-box domains[C]//International Conference on Learning Representations.2022.
[19] LI Z,WU W,SU Y,et al.CDTA:A cross-domain transfer-based attack with contrastive learning[C]//Proceedings of the AAAI Conference on Artificial Intelligence.AAAI,2023:1530-1538.
[20] LI S,HE C,MA X,et al.Enhancing adversarial transferability with checkpoints of a single model’s training[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.IEEE,2025:20685-20694.
[21] YANG W,LIU G,MING D.SMP-Attack:Boosting the transferability of feature importance-based adversarial attack with semantics-aware multi-granularity patchout[C]//Proceedings of the IEEE/CVF International Conference on Computer Vision.IEEE,2025:4444-4454.
[22] POURSAEED O,KATSMAN I,GAO B,et al.Generative ad-versarial perturbations[C]//Proceedings of the IEEE Confe-rence on Computer Vision and Pattern Recognition.IEEE,2018:4422-4431.
[23] JEONG J,YANG H,JEONG J,et al.Semantic structure-aware generative attacks for enhanced adversarial transferability[PP/OL].arXiv(2025-06-23)[2026-06-18].https://arxiv.org/abs/2506.18248.
[24] LIU H,PENG B,DING P,et al.Rethinking target label conditioning in adversarial attacks:A 2D tensor-guided generative approach[C]//Proceedings of the AAAI Conference on Artificial Intelligence.AAAI,2026:7150-7158.
[25] Painter by Number[EB/OL].[2026-06-18].https://www.kaggle.com/c/painter-by-numbers/data.
[26] BIRCANOGLU C.Comic Books Classification[EB/OL].[2026-06-18].https://www.kaggle.com/cenkbircanoglu/comic-books-classification.
[27] DENG J,DONG W,SOCHER R,et al.ImageNet:A Large-Scale Hierarchical Image Database[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition.IEEE,2009:248-255.
[28] LI D,YANG Y,SONG Y Z,et al.Deeper,broader and artier domain generalization[C]//Proceedings of the IEEE International Conference on Computer Vision.IEEE,2017:5543-5551.
[29] SZEGEDY C,VANHOUCKE V,IOFFE S,et al.Rethinking the Inception Architecture for Computer Vision[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition.IEEE,2016:2818-2826.
[30] SIMONYAN K,ZISSERMAN A.Very Deep Convolutional Networks for Large-Scale Image Recognition[C]//International Conference on Learning Representations.2015.
[31] HE K,ZHANG X,REN S,et al.Deep Residual Learning for Image Recognition[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition.IEEE,2016:770-778.
[32] IANDOLA F N,HAN S,MOSKEWICZ M W,et al.Squeeze-Net:AlexNet-level Accuracy with 50x Fewer Parameters and <0.5MB Model Size[PP/OL].arXiv:(2016-02-24)[2026-06-18].https://arxiv.org/abs/1602.07360.
[33] HUANG G,LIU Z,VAN DER MAATEN L,et al.DenselyConnected Convolutional Networks[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition.IEEE,2017:2261-2269.
[34] SELVARAJU R R,COGSWELL M,DAS A,et al.Grad-CAM:Visual Explanations from Deep Networks via Gradient-based Localization[C]//Proceedings of the IEEE International Confe-rence on Computer Vision.IEEE,2017:618-626.
Viewed
Full text


Abstract

Cited
  Shared   
  Discussed   
No Suggested Reading articles found!
渝ICP备16013121号-4
地址：重庆市两江新区洪湖西路18号    邮编：401121  
电话：023-63500828（编辑部） 023-67039612（会议/专题） 023-67039623（财务/发票）
E-mail：jsjkx12@163.com
本系统由北京玛格泰克科技发展有限公司设计开发