  Recent studies have shown that Deep Neural Networks (DNNs) are susceptible to
adversarial attacks, with frequency-domain analysis underscoring the
significance of high-frequency components in influencing model predictions.
Conversely, targeting low-frequency components has been effective in enhancing
attack transferability on black-box models. In this study, we introduce a
frequency decomposition-based feature mixing method to exploit these frequency
characteristics in both clean and adversarial samples. Our findings suggest
that incorporating features of clean samples into adversarial features
extracted from adversarial examples is more effective in attacking
normally-trained models, while combining clean features with the adversarial
features extracted from low-frequency parts decomposed from the adversarial
samples yields better results in attacking defense models. However, a conflict
issue arises when these two mixing approaches are employed simultaneously. To
tackle the issue, we propose a cross-frequency meta-optimization approach
comprising the meta-train step, meta-test step, and final update. In the
meta-train step, we leverage the low-frequency components of adversarial
samples to boost the transferability of attacks against defense models.
Meanwhile, in the meta-test step, we utilize adversarial samples to stabilize
gradients, thereby enhancing the attack's transferability against normally
trained models. For the final update, we update the adversarial sample based on
the gradients obtained from both meta-train and meta-test steps. Our proposed
method is evaluated through extensive experiments on the ImageNet-Compatible
dataset, affirming its effectiveness in improving the transferability of
attacks on both normally-trained CNNs and defense models.
  The source code is available at https://github.com/WJJLL/MetaSSA.
