# On the Effectiveness of Low Frequency Perturbations

arXiv: https://arxiv.org/abs/1903.00073 · HTML: https://mlsanity.com/paper/1903.00073/

## Key facts

- Cited by 56 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Feb 2019.

## Built on by (most cited first, 30 of 56)

- [Frequency Domain Model Augmentation for Adversarial Attack](https://mlsanity.com/paper/2207.05382/) (2022)
- [Diffusion Models for Imperceptible and Transferable Adversarial Attack](https://mlsanity.com/paper/2305.08192/) (2023)
- [Frequency-driven Imperceptible Adversarial Attack on Semantic Similarity](https://mlsanity.com/paper/2203.05151/) (2022)
- [Amplitude-Phase Recombination: Rethinking Robustness of Convolutional Neural Networks in Frequency Domain](https://mlsanity.com/paper/2108.08487/) (2021)
- [AdvDrop: Adversarial Attack to DNNs by Dropping Information](https://mlsanity.com/paper/2108.09034/) (2021)
- [Exploring Frequency Adversarial Attacks for Face Forgery Detection](https://mlsanity.com/paper/2203.15674/) (2022)
- [Reveal of Vision Transformers Robustness against Adversarial Attacks](https://mlsanity.com/paper/2106.03734/) (2021)
- [A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attacks](https://mlsanity.com/paper/2106.02105/) (2021)
- [A Frequency Perspective of Adversarial Robustness](https://mlsanity.com/paper/2111.00861/) (2021)
- [Frequency Domain-based Dataset Distillation](https://mlsanity.com/paper/2311.08819/) (2023)
- [Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey](https://mlsanity.com/paper/2410.23687/) (2024)
- [Meta Adversarial Training against Universal Patches](https://mlsanity.com/paper/2101.11453/) (2021)
- [Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspective](https://mlsanity.com/paper/2102.06479/) (2021)
- [Adversarial Examples Are Not Bugs, They Are Superposition](https://mlsanity.com/paper/2508.17456/) (2025)
- [How Does Frequency Bias Affect the Robustness of Neural Image Classifiers against Common Corruption and Adversarial Perturbations?](https://mlsanity.com/paper/2205.04533/) (2022)
- [LPF-Defense: 3D Adversarial Defense based on Frequency Analysis](https://mlsanity.com/paper/2202.11287/) (2022)
- [Practical No-box Adversarial Attacks with Training-free Hybrid Image Transformation](https://mlsanity.com/paper/2203.04607/) (2022)
- [Impact of Spatial Frequency Based Constraints on Adversarial Robustness](https://mlsanity.com/paper/2104.12679/) (2021)
- [Deep Image Destruction: Vulnerability of Deep Image-to-Image Models against Adversarial Attacks](https://mlsanity.com/paper/2104.15022/) (2021)
- [Exploring Adversarial Robustness of Vision Transformers in the Spectral Perspective](https://mlsanity.com/paper/2208.09602/) (2022)
- [On the Effectiveness of Spectral Discriminators for Perceptual Quality Improvement](https://mlsanity.com/paper/2307.12027/) (2023)
- [Understanding the robustness difference between stochastic gradient descent and adaptive gradient methods](https://mlsanity.com/paper/2308.06703/) (2023)
- [LFAA: Crafting Transferable Targeted Adversarial Examples with Low-Frequency Perturbations](https://mlsanity.com/paper/2310.20175/) (2023)
- [FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attacks](https://mlsanity.com/paper/2407.20653/) (2024)
- [FaceShield: Defending Facial Image against Deepfake Threats](https://mlsanity.com/paper/2412.09921/) (2024)
- [Face Encryption via Frequency-Restricted Identity-Agnostic Attacks](https://mlsanity.com/paper/2308.05983/) (2023)
- [Bridging the Gap Between Adversarial Robustness and Optimization Bias](https://mlsanity.com/paper/2102.08868/) (2021)
- [How many dimensions are required to find an adversarial example?](https://mlsanity.com/paper/2303.14173/) (2023)
- [Reconstruction Distortion of Learned Image Compression with Imperceptible Perturbations](https://mlsanity.com/paper/2306.01125/) (2023)
- [BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing](https://mlsanity.com/paper/2511.00143/) (2025)

## Abstract (arXiv)

Carefully crafted, often imperceptible, adversarial perturbations have been shown to cause state-of-the-art models to yield extremely inaccurate outputs, rendering them unsuitable for safety-critical application domains. In addition, recent work has shown that constraining the attack space to a low frequency regime is particularly effective. Yet, it remains unclear whether this is due to generally constraining the attack search space or specifically removing high frequency components from consideration. By systematically controlling the frequency components of the perturbation, evaluating against the top-placing defense submissions in the NeurIPS 2017 competition, we empirically show that performance improvements in both the white-box and black-box transfer settings are yielded only when low frequency components are preserved. In fact, the defended models based on adversarial training are roughly as vulnerable to low frequency perturbations as undefended models, suggesting that the purported robustness of state-of-the-art ImageNet defenses is reliant upon adversarial perturbations being high frequency in nature. We do find that under ℓ_∞ ε=16/255, the competition distortion bound, low frequency perturbations are indeed perceptible. This questions the use of the ℓ_∞-norm, in particular, as a distortion metric, and, in turn, suggests that explicitly considering the frequency space is promising for learning robust models which better align with human perception.