Exploring Cross-Domain Transferable Attacks via Decoupling Features

Abstract

Most existing transferable adversarial attacks are fundamentally flawed because they assume attackers can access the training data of victim models, a premise that contradicts practical black-box scenarios. This issue is compounded in cross-domain attack setups, where inherent data distribution discrepancies hinder attack effectiveness by causing surrogate models to capture overly domain-specific features. To address these issues, we propose the Domain Decoupling Adversarial Attack (D2A), which enhances cross-domain transferability through two key perspectives: surrogate model disentanglement and adversarial perturbation optimization. Firstly, we decouple the pre-trained surrogate model into two models: coarse-grained and fine-grained domain-aware models. The former one is developed through model enhancement, specifically by filtering out domain-specific information with additional modules. Concurrently, the latter one is built via data augmentation, simulating diverse data distributions to fine-tune the original surrogate model. This enables each decoupled model to focus on capturing either coarse-grained or fine-grained features, respectively. Secondly, we introduce a dual-level perturbation optimization strategy. It jointly perturbs global and local features within both the coarse-grained and fine-grained models, thereby guiding the generator to produce adversarial examples with improved cross-domain transferability. Extensive experiments conducted on various datasets demonstrate that D2A achieves an average attack success rate improvement of 8.0% compared to SOTA transferable attacks, with particularly notable gains of 12.28% in fine-grained domains. Furthermore, D2A also exhibits substantial benefits in cross-architecture attack scenarios, further validating the effectiveness and robustness of the proposed method. The code is available at https://github.com/sdfdsdff/D2A.