---
title: Transferable Frequency-Aware Attacks
url: https://www.emergentmind.com/topics/transferable-frequency-aware-attacks
type: topic
---

# Transferable Frequency-Aware Attacks

Transferable frequency-aware attacks are adversarial methods that manipulate perturbations through an explicit frequency representation in order to improve black-box efficacy, cross-model generalization, cross-domain robustness, concealment, or all four simultaneously. In this literature, “frequency-aware” does not denote a single mechanism. It includes direct optimization in the Fourier, cosine, wavelet, or short-time Fourier domain; decomposition of inputs into low-, mid-, and high-frequency bands; spectral augmentation of surrogate inputs; frequency-conditioned feature alignment; and hybrid attacks that combine spatial and spectral gradients. The resulting attack family now spans standard image classification, automatic modulation classification, RF fingerprinting, face forgery detection, AI-generated image detection, closed-source multimodal large language models, and learned image compression systems [2207.05382] [2407.20653] [2503.04120] [2605.21541].

## 1. Conceptual foundations

Transferability is the property that an adversarial example optimized on a surrogate model also fools an unseen target. Frequency-aware methods address a recurring failure mode of purely spatial attacks: gradients computed on one model can over-specialize to that model’s decision boundary, whereas spectral structure often exposes feature biases that are more broadly shared across architectures or domains. Several papers make this claim operationally rather than rhetorically. “Frequency Domain Model Augmentation for Adversarial Attack” defines a spectrum transformation that simulates diverse substitute models in the frequency domain and argues that the resulting spectrum saliency maps span a larger subspace than spatial-domain transforms do [2207.05382]. “Towards Transferable Adversarial Attacks with Centralized Perturbation” similarly argues that concentrating perturbation on dominant frequency coefficients mitigates source-model overfitting [2312.06199].

A central point in the literature is that transferability is not tied to one privileged band. Different tasks and targets expose different spectral vulnerabilities. Weng et al. report that high-frequency perturbations tend to fool normally trained networks more readily, while low-frequency perturbations transfer better to defense models, motivating cross-frequency meta-optimization [2405.03193]. LFAA, despite its name, is motivated by the observation that replacing the high-frequency component of an image with that of another image can mislead deep models, yet it ultimately generates targeted perturbations that are added to the low-frequency component of the image [2310.20175]. FACL-Attack instead treats mid-frequency features as the domain-invariant “semantic core,” randomizing low and high bands while explicitly separating clean and perturbed mid-frequency features during training [2407.20653]. A wavelet-packet study goes further and reports that the worst-perturbed bands are not the global high-frequency extremes, but the high-frequency components of low-frequency bands such as “da,” “daa,” and “dad” [2404.10202].

This band dependence also appears outside vision. In RF fingerprinting, a transmitter can inject transferable time-domain perturbations, yet Theorem 1 in “Robust Eavesdropping in the Presence of Adversarial Communications for RF Fingerprinting” shows that the eavesdropper’s important mid-band short-time Fourier features can remain nearly unchanged because the adversarial power is confined to out-of-band frequencies [2503.04120]. A common misconception is therefore that “frequency-aware” means “high-frequency attack.” The literature supports a more conditional view: low-, mid-, and high-frequency emphasis each appear as transfer-promoting priors under different threat models [2310.20175] [2407.20653] [2505.21181] [2503.04120].

## 2. Spectral representations and perturbation parameterizations

The field is organized around a small set of transforms. Image attacks commonly use the 2-D DCT, FFT, DWT, or wavelet packet decomposition. RF and communication settings use STFT or signal-band-specific Fourier parameterizations. The representation is not merely diagnostic; it determines which coefficients are directly optimized, which are randomized, and which are suppressed.

| Representation | Representative use | Operational role |
|---|---|---|
| 2-D DCT | SSA, FACL-Attack, FRA-Attack, face forgery attacks | model augmentation, band masking, feature alignment, gradient regularization |
| FFT | FSA, FAMPE | stochastic spectral augmentation, LF/HF trade-off |
| DWT / WPD | MetaSSA, WaveTransform, WPD black-box attack | band decomposition, feature mixing, band-selective perturbation |
| STFT | RF eavesdropper | time-frequency feature extraction and robustness analysis |

Direct frequency-domain optimization appears clearly in SFFAA for automatic modulation classification. It restricts the perturbation spectrum to a known occupied band and formalizes the objective as minimizing the fraction of power leaked outside the band,
\[
\min_{\delta}\; \frac{\mathsf{energy}(\delta_{\mathrm{so}})}{\mathsf{energy}(\delta)}
\quad \text{s.t.} \quad
f(x+\delta)\neq y,\;
\|\delta\|_{\infty}\le\zeta,
\]
with iterative updates performed on the frequency-domain variable \(s_n\) and projection back to the time domain through IFFT and clipping [2208.01919]. By construction, the attack targets spectral concealment and decision failure simultaneously.

Other methods retain spatial-domain optimization but inject frequency-aware stochasticity or regularization. The 2025 Frequency-Space Attack defines a high-frequency augmentation module
\[
\widetilde{X}(\omega)=\bigl(X(\omega)+D_E(\omega)\bigr)\cdot M(\omega),\qquad
x_{hf}=\mathcal{F}^{-1}(\widetilde{X}),
\]
where \(M(\omega)\sim\mathcal{U}(1-p,1+p)\) and \(D_E(\omega)\) scales Gaussian noise toward higher frequencies through a linear weighting \(W(\omega)\) [2505.21181]. SSA uses a related DCT-domain transformation,
\[
T(x)=D_I\bigl((D(x+\xi))\odot M\bigr),
\]
with fresh Gaussian noise and multiplicative masks at every iteration, then averages gradients across multiple transformed inputs [2207.05382]. Centralized Perturbation takes a spatial step \(\Delta_t\), transforms it blockwise into YCbCr-DCT coefficients, multiplies by binary masks \(Q_{c,t}\), and learns those masks in parallel so that only dominant coefficients survive [2312.06199].

Wavelet-based attacks expose finer granularity. MetaSSA decomposes an image with single-level orthogonal DWT into \(x_l\) and \(x_h\), then mixes clean and adversarial features differently for standard and defense models [2405.03193]. WaveTransform updates selected wavelet subbands \(\{\text{LL},\text{LH},\text{HL},\text{HH}\}\) under an \(L_\infty\) constraint and reconstructs the image through IDWT [2010.15773]. The WPD-based decision attack narrows its search to the bands \(\{aaa, daa, dad\}\), chosen after cosine-similarity analysis identified those bands as carrying concentrated adversarial disturbance [2404.10202].

## 3. Transferability mechanisms

One major mechanism is spectral augmentation of the surrogate. SSA treats each transformed spectrum as a “simulated” substitute model and proves that the corresponding spectrum saliency map is perturbed by the random mask \(M\), which increases substitute diversity [2207.05382]. The 2025 Frequency-Space Attack pushes the same idea further by coupling High-Frequency Augmentation with Hierarchical-Gradient Fusion, a multi-scale gradient pyramid whose coarser levels receive larger weights. In its ImageNet-1000 evaluation, FSA reports an average attack success rate increase of \(23.6\%\) compared with BSR on eight black-box defense models [2505.21181].

A second mechanism is cross-frequency meta-learning. Meta-SFFAA constructs tasks over surrogate AMC models, using some models for “meta-train” and a held-out surrogate for “meta-test,” so that the perturbation update direction generalizes across architectures [2208.01919]. MetaSSA resolves a conflict between two feature-mixing strategies—AFM for normally trained models and LF-AFM for defense models—through a three-step meta-train, meta-test, and final update procedure [2405.03193]. This directly encodes the claim that different target classes of models prefer different spectral attack views.

A third mechanism is frequency-aware feature alignment. FACL-Attack introduces Frequency-Aware Domain Randomization, which randomizes low- and high-frequency components but leaves mid-frequency coefficients unchanged, and a contrastive loss
\[
\mathcal{L}_{\mathrm{FACL}}
=
-\mathrm{sim}(z_m,z'_m)+\mathrm{sim}(z_{lh},z'_{lh}),
\]
which pushes mid-frequency features of clean and perturbed inputs apart while pulling low/high features together [2407.20653]. FRA-Attack for closed-source MLLMs combines a high-pass DCT objective over patch features with Frequency-domain Gradient Regularization, a low-pass filter \(\phi(d)=(1-d)^p\) applied to the DCT of the surrogate gradient. The design is explicitly split: high-frequency alignment concentrates on intrinsic visual focus, while low-frequency gradient regularization removes surrogate-specific high-frequency artifacts [2605.21541].

A fourth mechanism is dual-domain importance fusion. The face forgery attack introduces a DCT-domain fusion module that captures salient adversarial regions in the frequency domain and then alternates frequency and spatial updates in a hybrid attack [2203.15674]. DuFIA for AI-generated image detectors computes a spatial feature-importance map through integrated gradients and a frequency feature-importance map through randomized DCT perturbation, then fuses them as
\[
\lambda=\gamma_s\lambda^{(s)}+\gamma_f\lambda^{(f)},
\]
before maximizing a mid-layer feature attack loss under an \(L_\infty\) constraint [2511.15571]. In both cases, transferability is attributed to complementary information captured in the two domains rather than to a purely spectral prior.

## 4. Domain-specific developments

In image classification, the field has moved from augmentation-based attacks toward structured spectral reasoning. SSA showed that frequency-domain model augmentation can be retrofitted to iterative attacks such as I-FGSM, MI-FGSM, DI-FGSM, TI-FGSM, and SI-FGSM [2207.05382]. FACL-Attack shifted the focus to cross-domain and cross-model generator training under strict black-box conditions, using DCT band partitioning and contrastive feature separation [2407.20653]. LFAA addressed a harder regime—transferable targeted attacks—by training a class-conditional generator that outputs perturbations added to the low-frequency component of the image [2310.20175]. FRA-Attack generalizes the same logic to closed-source MLLMs, where the surrogate is an open-source vision encoder but the victim is an unknown proprietary multimodal system [2605.21541].

Signal-processing applications adopt analogous ideas but with domain-specific constraints. In AMC, SFFAA and Meta-SFFAA explicitly exploit the known occupied spectrum of the communication signal, restricting perturbation energy to that band and measuring concealment through the Out-Spectrum Energy Ratio [2208.01919]. In RF fingerprinting, the adversary is the transmitter rather than an external attacker: it adds \(\delta\in\mathbb{C}^\ell\) to a complex baseband preamble under a power budget and crafts the perturbation with \(l_2\)-FGSM, \(l_\infty\)-FGSM, \(l_2\)-PGD, or \(l_\infty\)-PGD on the receiver’s surrogate model [2503.04120]. The eavesdropper then counters with an STFT-based architecture because the transmitter’s purely time-domain transferable perturbations remain spectrally localized away from the classifier’s important midbands [2503.04120].

Forensic and detection tasks reveal another use of frequency awareness: attacking detectors that themselves rely on spectral artifacts. The face forgery attack reports that its DCT-domain method fools spatial-based and frequency-based detectors, including F\(^3\)-Net and LRL [2203.15674]. DuFIA transfers across AI-generated image detectors by fusing spatially interpolated gradients with frequency-aware perturbation-derived feature importance [2511.15571]. In learned image compression, the objective changes from misclassification to trigger persistence and downstream task manipulation, but the spectral logic persists: backdoor triggers are embedded in selected DCT frequencies, robust frequency selection chooses Top-\(K\) coefficients that survive preprocessing, and boundary-shift interpolation improves cross-model and cross-domain transferability for downstream segmentation and face-recognition attacks [2412.01646].

## 5. Empirical patterns and evaluation criteria

Reported gains are substantial but heterogeneous because metrics differ by task. On ImageNet defenses, SSA reports an average success rate of \(95.4\%\) when attacking nine state-of-the-art defense models with an ensemble substitute [2207.05382]. The 2025 Frequency-Space Attack reports single-model average attack success rates of approximately \(68.9\%\) versus approximately \(55.3\%\) for BSR, and up to \(90.9\%\) ASR on Inc-v3 ens3 when combined with other input transforms [2505.21181]. Centralized Perturbation reports a mean improvement of \(+11.7\) percentage points over vanilla gradient baselines across five attacks and six black-box models [2312.06199]. FACL-Attack evaluates transfer in terms of post-attack top-1 accuracy and reduces the cross-model average from \(24.9\%\) to \(19.7\%\) and the cross-domain average from \(51.07\%\) to \(44.05\%\), where lower is better [2407.20653].

Targeted and structured black-box settings show similarly strong effects. LFAA reports targeted black-box success-rate improvements ranging from \(3.2\%\) to \(15.5\%\) over prior methods, with a black-box success of \(80.1\%\) on DenseNet-121 and \(66.6\%\) on VGG-19\(_{BN}\) when trained on ResNet-50 as surrogate [2310.20175]. The WPD-based decision attack reports an average attack success rate reaching \(99\%\), together with query counts, SSIM, and the proposed normalized disturbance visibility index [2404.10202]. In AMC, SFFAA confines more than \(99\%\) of perturbation energy inside the band, achieving OSER approximately \(-20\) dB and average FD \(0.05\) at SNR \(=0\) dB, while Meta-SFFAA improves black-box transfer beyond FGSM, PGD, and UAP [2208.01919].

The RF case is notable because it reveals a limit rather than a gain. On clean signals, the intended receiver achieves \(88.4\%\) on seen devices and \(84.3\%\) on unseen devices, while the eavesdropper achieves \(87.9\%\) and \(86.1\%\) [2503.04120]. Under single-step FGSM, an unaware time-domain eavesdropper collapses to approximately \(30\%\) at PSR \(=-20\) dB, but the STFT-based eavesdropper remains above \(75\)–\(80\%\) up to PSR \(=-16\) dB in Environment A and tracks the receiver in Environment B [2503.04120]. Under multi-step PGD, the unaware eavesdropper drops to \(20\%\) at PSR \(=-25\) dB, whereas the STFT-based model stays above \(60\%\) in Environment A and above \(75\%\) in Environment B [2503.04120]. This is a reminder that frequency-aware attacks and frequency-aware defenses co-evolve.

## 6. Limitations, misconceptions, and open directions

A common misconception is that spectral attacks are inherently more transferable simply because they occupy the frequency domain. The literature is more specific. Some methods succeed by amplifying high frequencies [2505.21181]; others by perturbing low-frequency structure [2310.20175]; others by isolating mid-frequency invariants [2407.20653]; and others by combining low-frequency bands with the high-frequency components nested inside them [2404.10202]. This suggests that the effective design variable is not “frequency-domain vs. spatial-domain” in the abstract, but the match between band selection and the invariances shared by surrogate and victim models.

The current literature also documents clear limitations. SFFAA assumes a direct-access scenario and does not model over-the-air effects [2208.01919]. The RF eavesdropping paper assumes that the transmitter knows the channel and noise distributions used to design \(\delta\), and it explicitly states that no joint time-frequency crafting is attempted [2503.04120]. The 2025 Frequency-Space Attack notes that its uniform random mask could be replaced by an adaptive mask and that alternative transforms such as DCT, wavelet, or learnable spectral bases may yield further gains [2505.21181]. MetaSSA acknowledges higher per-iteration cost due to the inner meta-train loop [2405.03193]. LFAA notes weaker performance against strong adversarially trained defenses [2310.20175].

Several future directions recur across papers. One is joint spatial-frequency or time-frequency optimization rather than single-domain perturbation with post hoc spectral interpretation [2503.04120] [2203.15674]. Another is stronger model-agnostic regularization: FRA-Attack’s low-pass gradient filter depends only on geometric frequency coordinates, while FACL-Attack’s training-only modules attempt to encode invariances that persist at inference [2605.21541] [2407.20653]. A third is extension across modalities and deployment settings, including audio, 3D, video, multimodal systems, federated or multiuser RF scenarios, and open-vocabulary vision models [2505.21181] [2503.04120] [2310.20175]. A plausible implication is that future transferable attacks will be less about choosing a single favored band and more about learning task-specific spectral priors together with surrogate-agnostic gradient structure.

Source: https://www.emergentmind.com/topics/transferable-frequency-aware-attacks