mlsanityData to 7 Oct 2026

Low Frequency Adversarial Perturbation

arXiv 1809.08758 ↗First posted 24 Sep 2018cs.CVcited by 80

Not on the map. Why?

Abstract (arXiv)

Adversarial images aim to change a target model's decision by minimally perturbing a target image. In the black-box setting, the absence of gradient information often renders this search problem costly in terms of query complexity. In this paper we propose to restrict the search for adversarial images to a low frequency domain. This approach is readily compatible with many existing black-box attack frameworks and consistently reduces their query cost by 2 to 4 times. Further, we can circumvent image transformation defenses even when both the model and the defense strategy are unknown. Finally, we demonstrate the efficacy of this technique by fooling the Google Cloud Vision platform with an unprecedented low number of model queries.

Key facts. Cited by 80 papers in the map (data through 7 Oct 2026). First posted on arXiv 24 Sep 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 17; 2022: 17; 2023: 14; 2024: 17; 2025: 7; 2026: 8.

80 papers.

Sort:

By area:

  1. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 128
  2. 2021Amplitude-Phase Recombination: Rethinking Robustness of Convolutional Neural Networks in Frequency Domaincited by 70
  3. 2021AdvDrop: Adversarial Attack to DNNs by Dropping Informationcited by 55
  4. 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
  5. 2022Exploring Frequency Adversarial Attacks for Face Forgery Detectioncited by 45
  6. 2023Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compressioncited by 39
  7. 2022Query-Efficient Black-box Adversarial Attacks Guided by a Transfer-based Priorcited by 38
  8. 2023Towards Trustworthy and Aligned Machine Learning: A Data-centric Survey with Causality Perspectivescited by 30
  9. 2021A Review of Adversarial Attack and Defense for Classification Methodscited by 29
  10. 2021A Frequency Perspective of Adversarial Robustnesscited by 28
  11. 2023Frequency Domain-based Dataset Distillationcited by 28
  12. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
38 more
  1. 2021Meta Adversarial Training against Universal Patchescited by 19
  2. 2021Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspectivecited by 18
  3. 2022Attacking deep networks with surrogate-based adversarial black-box methods is easycited by 18
  4. 2021On the Effectiveness of Small Input Noise for Defending Against Query-based Black-Box Attackscited by 17
  5. 2022Poisons that are learned faster are more effectivecited by 14
  6. 2022Saliency Attack: Towards Imperceptible Black-box Adversarial Attackcited by 12
  7. 2022LPF-Defense: 3D Adversarial Defense based on Frequency Analysiscited by 10
  8. 2024Artwork Protection Against Neural Style Transfer Using Locally Adaptive Adversarial Color Attackcited by 9
  9. 2021Deep Image Destruction: Vulnerability of Deep Image-to-Image Models against Adversarial Attackscited by 8
  10. 2022Practical No-box Adversarial Attacks with Training-free Hybrid Image Transformationcited by 8
  11. 2022Exploring Adversarial Robustness of Vision Transformers in the Spectral Perspectivecited by 8
  12. 2023Understanding the robustness difference between stochastic gradient descent and adaptive gradient methodscited by 8
  13. 2023LFAA: Crafting Transferable Targeted Adversarial Examples with Low-Frequency Perturbationscited by 8
  14. 2024Imperceptible Protection against Style Imitation from Diffusion Modelscited by 8
  15. 2024FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attackscited by 8
  16. 2024FaceShield: Defending Facial Image against Deepfake Threatscited by 8
  17. 2024GE-AdvGAN: Improving the transferability of adversarial samples by gradient editing-based adversarial generative modelcited by 7
  18. 2022Interactive Machine Learning: A State of the Art Reviewcited by 6
  19. 2024Nearly Zero-Cost Protection Against Mimicry by Personalized Diffusion Modelscited by 6
  20. 2021Bridging the Gap Between Adversarial Robustness and Optimization Biascited by 5
  21. 2023How many dimensions are required to find an adversarial example?cited by 5
  22. 2025BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editingcited by 5
  23. 2022Similarity of Neural Architectures using Adversarial Attack Transferabilitycited by 4
  24. 2024Low-Rank Adversarial PGD Attackcited by 4
  25. 2022Origins of Low-dimensional Adversarial Perturbationscited by 3
  26. 2023Robustmix: Improving Robustness by Regularizing the Frequency Bias of Deep Netscited by 3
  27. 2023Towards Transferable Adversarial Attacks with Centralized Perturbationcited by 3
  28. 2021Generating Black-Box Adversarial Examples in Sparse Domaincited by 2
  29. 2021Gradient Frequency Modulation for Visually Explaining Video Understanding Modelscited by 2
  30. 2024Low-Frequency Black-Box Backdoor Attack via Evolutionary Algorithmcited by 2
  31. 2024Towards a Novel Perspective on Adversarial Examples Driven by Frequencycited by 2
  32. 2024Query-Efficient Hard-Label Black-Box Attack against Vision Transformerscited by 2
  33. 2024LADDER: Multi-objective Backdoor Attack via Evolutionary Algorithmcited by 2
  34. 2025GSBAK: top-K Geometric Score-based Black-box Attackcited by 2
  35. 2021High-Robustness, Low-Transferability Fingerprinting of Neural Networkscited by 1
  36. 2021Simple black-box universal adversarial attacks on medical image classification based on deep neural networkscited by 1
  37. 2021Calibrated Adversarial Trainingcited by 1
  38. 2022Adversarial amplitude swap towards robust image classifierscited by 1

50 most cited of 80 All 80 (JSON)