# On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functions

arXiv: https://arxiv.org/abs/1809.04098 · HTML: https://mlsanity.com/paper/1809.04098/

## Key facts

- Cited by 32 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Sep 2018.

## Built on by (most cited first, 30 of 32)

- [On the Foundations of Shortcut Learning](https://mlsanity.com/paper/2310.16228/) (2023)
- [SpectralDefense: Detecting Adversarial Attacks on CNNs in the Fourier Domain](https://mlsanity.com/paper/2103.03000/) (2021)
- [A Frequency Perspective of Adversarial Robustness](https://mlsanity.com/paper/2111.00861/) (2021)
- [Relative stability toward diffeomorphisms indicates performance in deep nets](https://mlsanity.com/paper/2105.02468/) (2021)
- [How Does Frequency Bias Affect the Robustness of Neural Image Classifiers against Common Corruption and Adversarial Perturbations?](https://mlsanity.com/paper/2205.04533/) (2022)
- [Detecting AutoAttack Perturbations in the Frequency Domain](https://mlsanity.com/paper/2111.08785/) (2021)
- [FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attacks](https://mlsanity.com/paper/2407.20653/) (2024)
- [Fourier-Based Augmentations for Improved Robustness and Uncertainty Calibration](https://mlsanity.com/paper/2202.12412/) (2022)
- [Linear CNNs Discover the Statistical Structure of the Dataset Using Only the Most Dominant Frequencies](https://mlsanity.com/paper/2303.02034/) (2023)
- [Real-time Detection of Practical Universal Adversarial Perturbations](https://mlsanity.com/paper/2105.07334/) (2021)
- [Bridging the Gap Between Adversarial Robustness and Optimization Bias](https://mlsanity.com/paper/2102.08868/) (2021)
- [Frequency Centric Defense Mechanisms against Adversarial Examples](https://mlsanity.com/paper/2110.13935/) (2021)
- [Understanding robustness and generalization of artificial neural networks through Fourier masks](https://mlsanity.com/paper/2203.08822/) (2022)
- [F-Drop&Match: GANs with a Dead Zone in the High-Frequency Domain](https://mlsanity.com/paper/2106.02343/) (2021)
- [FourierNet: Shape-Preserving Network for Henle's Fiber Layer Segmentation in Optical Coherence Tomography Images](https://mlsanity.com/paper/2201.06435/) (2022)
- [Towards a Novel Perspective on Adversarial Examples Driven by Frequency](https://mlsanity.com/paper/2404.10202/) (2024)
- [On the Complexity-Faithfulness Trade-off of Gradient-Based Explanations](https://mlsanity.com/paper/2508.10490/) (2025)
- [Simple black-box universal adversarial attacks on medical image classification based on deep neural networks](https://mlsanity.com/paper/2108.04979/) (2021)
- [Adversarial amplitude swap towards robust image classifiers](https://mlsanity.com/paper/2203.07138/) (2022)
- [Robustness and invariance properties of image classifiers](https://mlsanity.com/paper/2209.02408/) (2022)
- [Universal Adversarial Directions](https://mlsanity.com/paper/2210.15997/) (2022)
- [Aliasing is a Driver of Adversarial Attacks](https://mlsanity.com/paper/2212.11760/) (2022)
- [Learning Frequency-Specific Quantization Scaling in VVC for Standard-Compliant Task-driven Image Coding](https://mlsanity.com/paper/2301.08533/) (2023)
- [Fourier Sensitivity and Regularization of Computer Vision Models](https://mlsanity.com/paper/2301.13514/) (2023)
- [Interpreting Global Perturbation Robustness of Image Models using Axiomatic Spectral Importance Decomposition](https://mlsanity.com/paper/2408.01139/) (2024)
- [DFT-Based Adversarial Attack Detection in MRI Brain Imaging: Enhancing Diagnostic Accuracy in Alzheimer's Case Studies](https://mlsanity.com/paper/2408.08489/) (2024)
- [Exploiting Frequency Spectrum of Adversarial Images for General Robustness](https://mlsanity.com/paper/2305.08439/) (2023)
- [Frequency maps reveal the correlation between Adversarial Attacks and Implicit Bias](https://mlsanity.com/paper/2305.15203/) (2023)
- [FREQuency ATTribution: benchmarking frequency-based occlusion for time series data](https://mlsanity.com/paper/2506.18481/) (2025)
- [Understanding Sensitivity of Differential Attention through the Lens of Adversarial Robustness](https://mlsanity.com/paper/2510.00517/) (2025)

## Abstract (arXiv)

Data-agnostic quasi-imperceptible perturbations on inputs are known to degrade recognition accuracy of deep convolutional networks severely. This phenomenon is considered to be a potential security issue. Moreover, some results on statistical generalization guarantees indicate that the phenomenon can be a key to improve the networks' generalization. However, the characteristics of the shared directions of such harmful perturbations remain unknown. Our primal finding is that convolutional networks are sensitive to the directions of Fourier basis functions. We derived the property by specializing a hypothesis of the cause of the sensitivity, known as the linearity of neural networks, to convolutional networks and empirically validated it. As a by-product of the analysis, we propose an algorithm to create shift-invariant universal adversarial perturbations available in black-box settings.