# Towards Frequency-Based Explanation for Robust CNN

arXiv: https://arxiv.org/abs/2005.03141 · HTML: https://mlsanity.com/paper/2005.03141/

## Key facts

- Cited by 29 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 May 2020.

## Built on by (most cited first, 29 of 29)

- [Frequency Domain Model Augmentation for Adversarial Attack](https://mlsanity.com/paper/2207.05382/) (2022)
- [When Does Contrastive Learning Preserve Adversarial Robustness from Pretraining to Finetuning?](https://mlsanity.com/paper/2111.01124/) (2021)
- [Learning Frequency Domain Approximation for Binary Neural Networks](https://mlsanity.com/paper/2103.00841/) (2021)
- [TCGL: Temporal Contrastive Graph for Self-supervised Video Representation Learning](https://mlsanity.com/paper/2112.03587/) (2021)
- [A Frequency Perspective of Adversarial Robustness](https://mlsanity.com/paper/2111.00861/) (2021)
- [Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey](https://mlsanity.com/paper/2410.23687/) (2024)
- [HybridAugment++: Unified Frequency Spectra Perturbations for Model Robustness](https://mlsanity.com/paper/2307.11823/) (2023)
- [Bag of Tricks to Boost Adversarial Transferability](https://mlsanity.com/paper/2401.08734/) (2024)
- [LPF-Defense: 3D Adversarial Defense based on Frequency Analysis](https://mlsanity.com/paper/2202.11287/) (2022)
- [Generalizable Deepfake Detection with Phase-Based Motion Analysis](https://mlsanity.com/paper/2211.09363/) (2022)
- [Prompt-Driven Contrastive Learning for Transferable Adversarial Attacks](https://mlsanity.com/paper/2407.20657/) (2024)
- [Impact of Spatial Frequency Based Constraints on Adversarial Robustness](https://mlsanity.com/paper/2104.12679/) (2021)
- [FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attacks](https://mlsanity.com/paper/2407.20653/) (2024)
- [Revisiting the Shape-Bias of Deep Learning for Dermoscopic Skin Lesion Classification](https://mlsanity.com/paper/2206.06466/) (2022)
- [Low-Mid Adversarial Perturbation against Unauthorized Face Recognition System](https://mlsanity.com/paper/2206.09410/) (2022)
- [Understanding robustness and generalization of artificial neural networks through Fourier masks](https://mlsanity.com/paper/2203.08822/) (2022)
- [Holistic Approach to Measure Sample-level Adversarial Vulnerability and its Utility in Building Trustworthy Systems](https://mlsanity.com/paper/2205.02604/) (2022)
- [Learning to Augment via Implicit Differentiation for Domain Generalization](https://mlsanity.com/paper/2210.14271/) (2022)
- [Towards a Novel Perspective on Adversarial Examples Driven by Frequency](https://mlsanity.com/paper/2404.10202/) (2024)
- [Shared & Domain Self-Adaptive Experts with Frequency-Aware Discrimination for Continual Test-Time Adaptation](https://mlsanity.com/paper/2507.00502/) (2025)
- [DFT-Based Adversarial Attack Detection in MRI Brain Imaging: Enhancing Diagnostic Accuracy in Alzheimer's Case Studies](https://mlsanity.com/paper/2408.08489/) (2024)
- [Disrupting Semantic and Abstract Features for Better Adversarial Transferability](https://mlsanity.com/paper/2507.16052/) (2025)
- [Fourier Transform Approximation as an Auxiliary Task for Image Classification](https://mlsanity.com/paper/2106.11478/) (2021)
- [DAD: Data-free Adversarial Defense at Test Time](https://mlsanity.com/paper/2204.01568/) (2022)
- [Robust Few-shot Learning Without Using any Adversarial Samples](https://mlsanity.com/paper/2211.01598/) (2022)
- [A Spectral Perspective towards Understanding and Improving Adversarial Robustness](https://mlsanity.com/paper/2306.14262/) (2023)
- [DAD++: Improved Data-free Test Time Adversarial Defense](https://mlsanity.com/paper/2309.05132/) (2023)
- [Invariance-powered Trustworthy Defense via Remove Then Restore](https://mlsanity.com/paper/2402.00304/) (2024)
- [FREQuency ATTribution: benchmarking frequency-based occlusion for time series data](https://mlsanity.com/paper/2506.18481/) (2025)

## Abstract (arXiv)

Current explanation techniques towards a transparent Convolutional Neural Network (CNN) mainly focuses on building connections between the human-understandable input features with models' prediction, overlooking an alternative representation of the input, the frequency components decomposition. In this work, we present an analysis of the connection between the distribution of frequency components in the input dataset and the reasoning process the model learns from the data. We further provide quantification analysis about the contribution of different frequency components toward the model's prediction. We show that the vulnerability of the model against tiny distortions is a result of the model is relying on the high-frequency features, the target features of the adversarial (black and white-box) attackers, to make the prediction. We further show that if the model develops stronger association between the low-frequency component with true labels, the model is more robust, which is the explanation of why adversarially trained models are more robust against tiny distortions.