Frequency-Domain Regularized Adversarial Alignment for Transferable Attacks against Closed-Source MLLMs

• URL: http://arxiv.org/abs/2605.21541v1
• Date: Wed, 20 May 2026 08:15:56 GMT
• Title: Frequency-Domain Regularized Adversarial Alignment for Transferable Attacks against Closed-Source MLLMs
• Abstract summary: A key challenge for improving adversarial transferability is to effectively capture the intrinsic visual focus shared across different models.<n>We propose FRA-Attack, which addresses both challenges from a unified frequency-domain regularization perspective.<n>For feature alignment, a high-pass DCT objective on patch features suppresses redundant global structures and concentrates the loss on the high-frequency band that carries the MLLMs' intrinsic visual focus.<n>For gradient optimization, we introduce Frequency-domain Gradient Regularization (FGR), a textitmodel-agnostic low-pass regularizer that modulates the surrogate gradient using
• Score: 59.973833105841685
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Multimodal large language models (MLLMs) remain vulnerable to transfer-based targeted attacks, where perturbations optimized on open-source surrogate encoders can generalize to closed-source MLLMs. A key challenge for improving adversarial transferability is to effectively capture the intrinsic visual focus shared across different models, such that perturbations align with transferable semantic cues rather than surrogate-specific behaviors. However, existing methods suffer from spatial-domain feature redundancy and surrogate-specific gradient signals, thereby hindering cross-model transferability. In this paper, we propose FRA-Attack, which addresses both challenges from a unified frequency-domain regularization perspective. For feature alignment, a high-pass DCT objective on patch features suppresses redundant global structures and concentrates the loss on the high-frequency band that carries the MLLMs' intrinsic visual focus. For gradient optimization, we introduce Frequency-domain Gradient Regularization (FGR), a \textit{model-agnostic} low-pass regularizer that modulates the surrogate gradient using only the geometric frequency coordinate, \textit{i.e.}, no surrogate-derived statistic is involved, so that FGR is model-agnostic by construction, removing surrogate-specific high-frequency artifacts while preserving transferable low-frequency directions. Together, the two components form a unified frequency-domain treatment of transferability. Extensive experiments on $15$ flagship MLLMs across $7$ vendors show that FRA-Attack achieves superior cross-model transferability, particularly with state-of-the-art performance on GPT-5.4, Claude-Opus-4.6 and Gemini-3-flash.

Related papers

• FAN-LoRA: A Fourier-Adaptive Nonlinear Low-Rank Adaptor for Medical Foundation Model Domain Adaptation [11.04143971119602]
  We present FAN-LoRA, a novel frequency-decoupled fine-tuning architecture.<n>We show that FAN-LoRA consistently outperforms state-of-the-art PEFT baselines.<n>Compared to the strongest competitors, our method achieves consistent improvements in average Dice scores and notable reductions in boundary errors.
  arXiv  Detail & Related papers  (2026-08-27T02:08:57Z)
• IDATA: Scalable Invertible Diffusion for Unrestricted Adversarial Transfer Attack [20.52296956891588]
  Unrestricted adversarial transfer attacks are important for evaluating the black-box robustness of deep visual models.<n>We propose Invertible Diffusion Module (IDM) and Low-Frequency Constraint Module (LFCM)<n>IDM reformulates adversarial optimization over diffusion trajectories as an invertible process, enabling constant-memory backpropagation.<n>LFCM decomposes latent variables into low- and high-frequency components, restricting perturbations to semantically stable low-frequency subspaces.
  arXiv  Detail & Related papers  (2026-08-09T14:26:42Z)
• ARMOR++: Agentic Orchestration of a Multi-Domain Primitive Set for Transferable Attacks on Deepfake Detectors [28.44035744358622]
  This paper introduces ARMOR++, a robust multi-agent framework designed for high-transferability deepfake evasion.<n>By integrating five complementary primitives, ARMOR++ effectively targets heterogeneous inductive biases.<n> Rigorous evaluation on the AADD-2025 benchmark demonstrates that ARMOR++ significantly outperforms existing agentic and non-agentic baselines.
  arXiv  Detail & Related papers  (2026-07-16T17:45:13Z)
• SpecGradFilter: A Spectral Gradient Filtering Framework for Taming Federated Heterogeneity [57.84199526590779]
  Federated Learning (FL) is fundamentally challenged by statistical heterogeneity, where non-identically distributed (non-IID) data induces client drift that hampers global convergence.<n>In this work, we revisit client drift from a novel frequency-domain perspective and uncover a critical Spectral Bias of Drift.<n>Motivated by this, we propose SpecGradFilter, a unified Spectral Filtering Gradient Framework that tames heterogeneity by suppressing discordant low-frequency signals.
  arXiv  Detail & Related papers  (2026-07-05T09:23:35Z)
• Adversarial Attacks Against MLLMs via Progressive Resolution Processing and Adaptive Feature Alignment [56.085182951399496]
  Adversarial perturbations can mislead Multimodal Large Language Models (MLLMs) recognize a benign image as a specific target object.<n>This makes transfer-based targeted attacks crucial for understanding and improving black-box MLLM robustness.<n>We propose PRAF-Attack, a targeted transfer-based attack framework that integrates multi-scale global semantic guidance with robust intermediate-layer local alignment.
  arXiv  Detail & Related papers  (2026-05-11T02:45:48Z)
• Physics-Aligned Spectral Mamba: Decoupling Semantics and Dynamics for Few-Shot Hyperspectral Target Detection [14.607792636586067]
  SpecMamba is a framework that decouples stable semantic representation from agile spectral adaptation.<n>It consistently outperforms state-of-the-art methods in detection accuracy and cross-domain generalization.
  arXiv  Detail & Related papers  (2026-04-07T08:04:18Z)
• Steering and Rectifying Latent Representation Manifolds in Frozen Multi-modal LLMs for Video Anomaly Detection [52.5174167737992]
  Video anomaly detection (VAD) aims to identify abnormal events in videos.<n>We propose SteerVAD, which advances MLLM-based VAD by shifting from passively reading to actively steering and rectifying internal representations.<n>Our method achieves state-of-the-art performance among tuning-free approaches requiring only 1% of training data.
  arXiv  Detail & Related papers  (2026-02-27T13:48:50Z)
• Cross-Domain Transfer with Self-Supervised Spectral-Spatial Modeling for Hyperspectral Image Classification [5.784164305429653]
  This paper proposes a self-supervised cross-domain transfer framework.<n>It learns transferable spectral-spatial joint representations without source labels.<n> Experimental results demonstrate stable classification performance and strong cross-domain adaptability.
  arXiv  Detail & Related papers  (2026-01-26T02:52:35Z)
• SKANet: A Cognitive Dual-Stream Framework with Adaptive Modality Fusion for Robust Compound GNSS Interference Classification [47.20483076887704]
  Global Navigation Satellite Systems (GNSS) face growing threats from sophisticated jamming interference.<n>We propose a cognitive deep learning framework built upon a dual-stream architecture that integrates Time-Frequency Images (TFIs) and Power Spectral Density (PSD)<n>We show that SKANet achieves an overall accuracy of 96.99%, exhibiting superior robustness for compound jamming classification.
  arXiv  Detail & Related papers  (2026-01-19T07:42:45Z)
• Efficient Dual-domain Image Dehazing with Haze Prior Perception [26.57698394898644]
  Transformer-based models exhibit strong global modeling capabilities in single-image dehazing, but their high computational cost limits real-time applicability.<n>We propose the Dark Channel Guided Frequency-aware Dehazing Network (DGFDNet), a novel dual-domain framework that performs physically guided degradation alignment.<n>Experiments on four benchmark haze datasets demonstrate that DGFDNet achieves state-of-the-art performance with superior robustness and real-time efficiency.
  arXiv  Detail & Related papers  (2025-07-15T06:56:56Z)
• Generate Aligned Anomaly: Region-Guided Few-Shot Anomaly Image-Mask Pair Synthesis for Industrial Inspection [53.137651284042434]
  Anomaly inspection plays a vital role in industrial manufacturing, but the scarcity of anomaly samples limits the effectiveness of existing methods.<n>We propose Generate grained Anomaly (GAA), a region-guided, few-shot anomaly image-mask pair generation framework.<n>GAA generates realistic, diverse, and semantically aligned anomalies using only a small number of samples.
  arXiv  Detail & Related papers  (2025-07-13T12:56:59Z)
• Improving Black-Box Generative Attacks via Generator Semantic Consistency [51.470649503929344]
  generative attacks produce adversarial examples in a single forward pass at test time.<n>We enforce semantic consistency by aligning the early generator's intermediate features to an EMA teacher.<n>Our approach can be seamlessly integrated into existing generative attacks with consistent improvements in black-box transfer.
  arXiv  Detail & Related papers  (2025-06-23T02:35:09Z)
• Generalizable Multispectral Land Cover Classification via Frequency-Aware Mixture of Low-Rank Token Experts [22.75047167955269]
  We introduce Land-MoE, a novel approach for multispectral land cover classification (MLCC)<n>Land-MoE comprises two key modules: the mixture of low-rank token experts (MoLTE) and frequency-aware filters (FAF)
  arXiv  Detail & Related papers  (2025-05-20T08:52:28Z)
• Calibrating Undisciplined Over-Smoothing in Transformer for Weakly Supervised Semantic Segmentation [51.14107156747967]
  Weakly supervised semantic segmentation (WSSS) has attracted considerable attention because it requires fewer annotations than fully supervised approaches.<n>We propose an Adaptive Re-Activation Mechanism (AReAM) to control deep-level attention to undisciplined over-smoothing.<n>AReAM substantially improves segmentation performance compared with existing WSSS methods, reducing noise while sharpening focus on relevant semantic regions.
  arXiv  Detail & Related papers  (2023-05-04T19:11:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.