Computer Science

Computer Science ›› 2026, Vol. 53 ›› Issue (10): 476-485.doi: 10.11896/jsjkx.260600130

• Information Security • Previous Articles    

Stable Structural Representation and Distribution-level Relative Optimization for Cross-domain Transferable Adversarial Attacks

YI Xiaoyin1, CHEN Long2, ZHU Xiaofei3   

  1. 1 School of Computer Science and Technology,Chongqing University of Posts and Telecommunications,Chongqing 400065, China
    2 School of Cyber Security and Information Law,Chongqing University of Posts and Telecommunications,Chongqing 400065, China
    3 College of Computer Science and Engineering,Chongqing University of Technology,Chongqing 400054, China
  • Received:2026-06-18 Revised:2026-08-24 Published:2026-10-13
  • About author:YI Xiaoyin,born in 1985,Ph.D candidate,associate professor.Her main research interests include artificial intelligence security and adversarial machine learning.
    CHEN Long,born in 1970,Ph.D,professor.His main research interests include computer forensics,cybersecurity,and intelligent digital content security.
  • Supported by:
    Scientific and Technological Research Youth Project of Chongqing Municipal Education Commission(KJQN202302403).

PDF (PC)

52

Abstract: Cross-domain black-box transfer attacks aim to maintain the effectiveness of adversarial perturbations on unknown target domains.However,domain shift disrupts the consistency of feature statistics and induces semantic drift,causing existing ge-nerative methods to rely heavily on source-domain-specific statistical patterns and making it difficult to learn perturbation representations that remain stable across domains.Meanwhile,label-level attack objectives depend strongly on source-domain class semantics and decision boundaries,which further limits the cross-domain transferability of adversarial perturbations.To address these issues,this paper proposes a cross-domain transferable adversarial perturbation generation framework that combines cross-domain stable structural representation modeling with distribution-level relative optimization.Specifically,it designs a median-enhanced channel-spatial(MECS) feature enhancement module,which integrates robust statistical modeling with multi-scale spatial modeling to strengthen the generator’s ability to capture structural information that remains relatively stable across domains.It further introduces a relative kullback-leibler(RKL) divergence loss,which uses the prediction distribution of clean samples as a reference and adjusts the model’s decision structure at the distribution level,thereby reducing the dependence of attack optimization on explicit label supervision.Experimental results show that the proposed method consistently outperforms existing methods under various cross-domain and within-domain transfer settings.Under different perturbation budgets,when Paintings and Co-mics are used as the source domains and ImageNet as the target domain,the proposed method improves the average Fooling Rate by 7.49 and 5.88 percentage points,respectively,compared with a generative baseline optimized using cross-entropy loss.

Key words: Cross-domain transferable adversarial attacks, Adversarial perturbation generation, Structural representation mode-ling, Distribution-level relative optimization, Relative KL divergence

CLC Number: 

  • TP309
[1] GU J,JIA X,DE JORGE P,et al.A survey on transferability of adversarial examples across deep neural networks[J/OL].Transactions on Machine Learning Research,2024.https://openreview.net/forum?id=AYJ3m7BocI.
[2] ZHU R,ZHANG Z,LIANG S,et al.Learning to transform dynamically for better adversarial transferability[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.IEEE,2024:24273-24283.
[3] WANG X,ZHANG Z,ZHANG J.Structure invariant transformation for better adversarial transferability[C]//Proceedings of the IEEE/CVF International Conference on Computer Vision.IEEE,2023:4607-4619.
[4] YANG H,JEONG J,YOON K J.FACL-Attack:Frequency-aware contrastive learning for transferable adversarial attacks[C]//Proceedings of the AAAI Conference on Artificial Intelligence.AAAI,2024:6494-6502.
[5] LI Z,WANG W,LI J,et al.UCG:A universal cross-domain ge-nerator for transferable adversarial examples[J].IEEE Transactions on Information Forensics and Security,2024,19:3023-3037.
[6] ZHOU K,LIU Z,QIAO Y,et al.Domain generalization:A survey[J].IEEE Transactions on Pattern Analysis and Machine Intelligence,2023,45(4):4396-4415.
[7] LI Q,GUO Y,ZUO W,et al.Improving adversarial transferabi-lity via intermediate-level perturbation decay[C]//Advances in Neural Information Processing Systems 36.Curran Associates,2023:32900-32912.
[8] LI T,MA X,JIANG Y G.AIM:Additional image guided generation of transferable adversarial attacks[C]//Proceedings of the AAAI Conference on Artificial Intelligence.AAAI,2025:4941-4949.
[9] DONG Y,LIAO F,PANG T,et al.Boosting adversarial attacks with momentum[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition.IEEE,2018:9185-9193.
[10] LIN J,SONG C,HE K,et al.Nesterov accelerated gradient and scale invariance for adversarial attacks[C]//International Conference on Learning Representations.2020.
[11] XIE C,ZHANG Z,ZHOU Y,et al.Improving transferability of adversarial examples with input diversity[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.IEEE,2019:2725-2734.
[12] DONG Y,PANG T,SU H,et al.Evading defenses to transferable adversarial examples by translation-invariant attacks[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.IEEE,2019:4307-4316.
[13] GUO Y,LIU W,XU Q,et al.Boosting adversarial transferability through augmentation in hypothesis space[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.IEEE,2025:19175-19185.
[14] REN Y,ZHAO Z,LIN C,et al.Improving integrated gradient-based transferable adversarial examples by refining the integration path[C]//Proceedings of the AAAI Conference on Artificial Intelligence.AAAI,2025:6731-6739.
[15] CHEN J,FENG Z,ZENG R,et al.Enhancing adversarial transferability with adversarial weight tuning[C]//Proceedings of the AAAI Conference on Artificial Intelligence.AAAI,2025:2061-2069.
[16] MI J X,ZHONG X,LI W.Improving adversarial transferabilitywith local perturbation augmentation[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.IEEE,2026:20639-20649.
[17] NASEER M,KHAN S H,KHAN M H,et al.Cross-domaintransferability of adversarial perturbations[C]//Advances in Neural Information Processing Systems 32.Curran Associates,2019:12905-12915.
[18] ZHANG Q,LI X,CHEN Y,et al.Beyond ImageNet attack:Towards crafting adversarial examples for black-box domains[C]//International Conference on Learning Representations.2022.
[19] LI Z,WU W,SU Y,et al.CDTA:A cross-domain transfer-based attack with contrastive learning[C]//Proceedings of the AAAI Conference on Artificial Intelligence.AAAI,2023:1530-1538.
[20] LI S,HE C,MA X,et al.Enhancing adversarial transferability with checkpoints of a single model’s training[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.IEEE,2025:20685-20694.
[21] YANG W,LIU G,MING D.SMP-Attack:Boosting the transferability of feature importance-based adversarial attack with semantics-aware multi-granularity patchout[C]//Proceedings of the IEEE/CVF International Conference on Computer Vision.IEEE,2025:4444-4454.
[22] POURSAEED O,KATSMAN I,GAO B,et al.Generative ad-versarial perturbations[C]//Proceedings of the IEEE Confe-rence on Computer Vision and Pattern Recognition.IEEE,2018:4422-4431.
[23] JEONG J,YANG H,JEONG J,et al.Semantic structure-aware generative attacks for enhanced adversarial transferability[PP/OL].arXiv(2025-06-23)[2026-06-18].https://arxiv.org/abs/2506.18248.
[24] LIU H,PENG B,DING P,et al.Rethinking target label conditioning in adversarial attacks:A 2D tensor-guided generative approach[C]//Proceedings of the AAAI Conference on Artificial Intelligence.AAAI,2026:7150-7158.
[25] Painter by Number[EB/OL].[2026-06-18].https://www.kaggle.com/c/painter-by-numbers/data.
[26] BIRCANOGLU C.Comic Books Classification[EB/OL].[2026-06-18].https://www.kaggle.com/cenkbircanoglu/comic-books-classification.
[27] DENG J,DONG W,SOCHER R,et al.ImageNet:A Large-Scale Hierarchical Image Database[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition.IEEE,2009:248-255.
[28] LI D,YANG Y,SONG Y Z,et al.Deeper,broader and artier domain generalization[C]//Proceedings of the IEEE International Conference on Computer Vision.IEEE,2017:5543-5551.
[29] SZEGEDY C,VANHOUCKE V,IOFFE S,et al.Rethinking the Inception Architecture for Computer Vision[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition.IEEE,2016:2818-2826.
[30] SIMONYAN K,ZISSERMAN A.Very Deep Convolutional Networks for Large-Scale Image Recognition[C]//International Conference on Learning Representations.2015.
[31] HE K,ZHANG X,REN S,et al.Deep Residual Learning for Image Recognition[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition.IEEE,2016:770-778.
[32] IANDOLA F N,HAN S,MOSKEWICZ M W,et al.Squeeze-Net:AlexNet-level Accuracy with 50x Fewer Parameters and <0.5MB Model Size[PP/OL].arXiv:(2016-02-24)[2026-06-18].https://arxiv.org/abs/1602.07360.
[33] HUANG G,LIU Z,VAN DER MAATEN L,et al.DenselyConnected Convolutional Networks[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition.IEEE,2017:2261-2269.
[34] SELVARAJU R R,COGSWELL M,DAS A,et al.Grad-CAM:Visual Explanations from Deep Networks via Gradient-based Localization[C]//Proceedings of the IEEE International Confe-rence on Computer Vision.IEEE,2017:618-626.
[1] WANG Shuyi, ZHANG Wei, XU Jianfeng, MIAO Duoqian, YAO Yiyu. Three-way Security Decision-making Based on Federated Learning [J]. Computer Science, 2026, 53(9): 385-394.
[2] LI Fulin, LI Hanxiao, WU Jiang, FENG Tanghao. Research on Key Management Scheme of Unmanned Aerial Vehicle Network Based on LKH andBlom [J]. Computer Science, 2026, 53(9): 414-420.
[3] LIANG Haotian, CAO Yan. R2Fuzz:Dependence Graph Repair Based Fuzzing Framework for Key-Value DBMS [J]. Computer Science, 2026, 53(9): 421-431.
[4] CHEN Quantao, ZHANG Yangsen, WANG Pu, GUO Yalong. Survey on Security Risks and Mitigation Strategies for Generative Artificial Intelligence [J]. Computer Science, 2026, 53(7): 381-396.
[5] CHEN Shanshan, JING Ningkang. OptimalFix:Complete Framework for Efficient Detection and Patch of Vulnerabilities in SmartContracts Automatically [J]. Computer Science, 2026, 53(7): 422-432.
[6] HUANG Shoumeng, YANG Boxiong, YANG Ming. Signature Scheme Based on Traceable Attributes [J]. Computer Science, 2026, 53(6A): 250300121-8.
[7] ZHANG Yuanyuan, LIU Tieming, LIU Guoan, GE Xueshuai. Symbolic Execution-based Automated Verification Method for Binary Vulnerabilities [J]. Computer Science, 2026, 53(6A): 250600035-7.
[8] LI Xiaogang, ZHAO Hui. HIBA:Verifiable and Efficient Query Architecture for Blockchain Based on Hybrid Index [J]. Computer Science, 2026, 53(6A): 250600212-7.
[9] ZHONG Hao, KONG Qingxuan, CAI Xianqing, LI Zhizhong, SUN Hao. Intelligent Recognition Method Based on Multimodal Feature Fusion [J]. Computer Science, 2026, 53(6A): 250700065-10.
[10] SHEN Yajie, WANG Jishu, JIN Kui, ZI Tong, TANG Mingjing. Second-order Multi-channel Directed Graph Convolution for Gene Regulatory Inference [J]. Computer Science, 2026, 53(6A): 250700116-10.
[11] YANG Xue, JIANG Bowen, LIU Yongxiang, ZHANG Likun, DENG Guiying. Review of Evaluation Methods for Resource Public Key Infrastructure Deployment Levels [J]. Computer Science, 2026, 53(6A): 251100048-7.
[12] ZHAO Rui, GAO Hancheng, HUANG Haiping, FENG Haoshi , LU Xinyi. Blockchain Scheme for Medical Data Sharing Based on Main-Side Chain and Traceable RingSignature [J]. Computer Science, 2026, 53(6A): 260100018-8.
[13] ZHANG Xin, CHEN Wen. CausalVulGNN:Framework for Software Vulnerability Explanation Based on Causal Inferenceand Graph Neural Networks [J]. Computer Science, 2026, 53(6): 427-436.
[14] ZHANG Qing, FENG Yan, ZHAO Hong, XIE Sijiang, FENG Yimeng. Certificateless Anonymous Authentication Key Agreement Protocol Based on Lattice [J]. Computer Science, 2026, 53(6): 437-445.
[15] LI Ruirui, GUO Rui, ZHANG Yinghui, LI Xuelei, LIU Guangjun. Edge Federated Learning Privacy Protection Scheme Based on Multi-key Homomorphic Encryption [J]. Computer Science, 2026, 53(6): 446-459.
Viewed
Full text


Abstract

Cited
  Shared   
  Discussed   
No Suggested Reading articles found!
渝ICP备16013121号-4
Add:18# Honghu West Rd., Yubei ,Chongqing,China    Post Code: 401121
Tel: 023-63500828/023-67039612/023-67039623
E-mail: jsjkx12@163.com
Powered by Beijing Magtech Co., Ltd.