# SpectralDefense: Detecting Adversarial Attacks on CNNs in the Fourier Domain

arXiv: https://arxiv.org/abs/2103.03000 · HTML: https://mlsanity.com/paper/2103.03000/

## Key facts

- Cited by 30 papers in the map (data through 14 Oct 2026).
- Builds on 24 of its 31 references that are in the map.
- First posted on arXiv 4 Mar 2021.

## Builds on (most cited first, 24 of 24)

- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [ImageNet Large Scale Visual Recognition Challenge](https://mlsanity.com/paper/1409.0575/) (2014)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks](https://mlsanity.com/paper/1807.03888/) (2018)
- [DeepFool: a simple and accurate method to fool deep neural networks](https://mlsanity.com/paper/1511.04599/) (2015)
- [On Adaptive Attacks to Adversarial Example Defenses](https://mlsanity.com/paper/2002.08347/) (2020)
- [Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods](https://mlsanity.com/paper/1705.07263/) (2017)
- [A Fourier Perspective on Model Robustness in Computer Vision](https://mlsanity.com/paper/1906.08988/) (2019)
- [Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality](https://mlsanity.com/paper/1801.02613/) (2018)
- [Watch your Up-Convolution: CNN Based Generative Deep Neural Networks are Failing to Reproduce Spectral Distributions](https://mlsanity.com/paper/2003.01826/) (2020)
- [Detecting Adversarial Samples from Artifacts](https://mlsanity.com/paper/1703.00410/) (2017)
- [On Detecting Adversarial Perturbations](https://mlsanity.com/paper/1702.04267/) (2017)
- [On the (Statistical) Detection of Adversarial Examples](https://mlsanity.com/paper/1702.06280/) (2017)
- [Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples](https://mlsanity.com/paper/1803.05787/) (2018)
- [Adversarial Examples Detection in Deep Networks with Convolutional Filter Statistics](https://mlsanity.com/paper/1612.07767/) (2016)
- [Detecting Adversarial Samples Using Influence Functions and Nearest Neighbors](https://mlsanity.com/paper/1909.06872/) (2019)
- [Early Methods for Detecting Adversarial Images](https://mlsanity.com/paper/1608.00530/) (2016)
- [Detection based Defense against Adversarial Examples from the Steganalysis Point of View](https://mlsanity.com/paper/1806.09186/) (2018)
- [On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functions](https://mlsanity.com/paper/1809.04098/) (2018)
- [Spectral Distribution Aware Image Generation](https://mlsanity.com/paper/2012.03110/) (2020)
- [Effective and Robust Detection of Adversarial Examples via Benford-Fourier Coefficients](https://mlsanity.com/paper/2005.05552/) (2020)

## Built on by (most cited first, 30 of 30)

- [Robust Models are less Over-Confident](https://mlsanity.com/paper/2210.05938/) (2022)
- [A Unified Game-Theoretic Interpretation of Adversarial Robustness](https://mlsanity.com/paper/2111.03536/) (2021)
- [Defenses in Adversarial Machine Learning: A Survey](https://mlsanity.com/paper/2312.08890/) (2023)
- [Is RobustBench/AutoAttack a suitable Benchmark for Adversarial Robustness?](https://mlsanity.com/paper/2112.01601/) (2021)
- [On the Robustness of Kolmogorov-Arnold Networks: An Adversarial Perspective](https://mlsanity.com/paper/2408.13809/) (2024)
- [Detecting AutoAttack Perturbations in the Frequency Domain](https://mlsanity.com/paper/2111.08785/) (2021)
- [An Extended Study of Human-like Behavior under Adversarial Training](https://mlsanity.com/paper/2303.12669/) (2023)
- [Calibration Attacks: A Comprehensive Study of Adversarial Attacks on Model Confidence](https://mlsanity.com/paper/2401.02718/) (2024)
- [Unfolding Local Growth Rate Estimates for (Almost) Perfect Adversarial Detection](https://mlsanity.com/paper/2212.06776/) (2022)
- [FIMBA: Evaluating the Robustness of AI in Genomics via Feature Importance Adversarial Attacks](https://mlsanity.com/paper/2401.10657/) (2024)
- [Input Space Mode Connectivity in Deep Neural Networks](https://mlsanity.com/paper/2409.05800/) (2024)
- [Frequency Centric Defense Mechanisms against Adversarial Examples](https://mlsanity.com/paper/2110.13935/) (2021)
- [DeepTaster: Adversarial Perturbation-Based Fingerprinting to Identify Proprietary Dataset Use in Deep Neural Networks](https://mlsanity.com/paper/2211.13535/) (2022)
- [Sample Attackability in Natural Language Adversarial Attacks](https://mlsanity.com/paper/2306.12043/) (2023)
- [Attack-Agnostic Adversarial Detection](https://mlsanity.com/paper/2206.00489/) (2022)
- [Adversarial Sample Detection Through Neural Network Transport Dynamics](https://mlsanity.com/paper/2306.04252/) (2023)
- [Adversarial Examples are Misaligned in Diffusion Model Manifolds](https://mlsanity.com/paper/2401.06637/) (2024)
- [DFT-Based Adversarial Attack Detection in MRI Brain Imaging: Enhancing Diagnostic Accuracy in Alzheimer's Case Studies](https://mlsanity.com/paper/2408.08489/) (2024)
- [Intriguing Frequency Interpretation of Adversarial Robustness for CNNs and ViTs](https://mlsanity.com/paper/2506.12875/) (2025)
- [A Unified Game-Theoretic Interpretation of Adversarial Robustness](https://mlsanity.com/paper/2103.07364/) (2021)
- [Fourier Transform Approximation as an Auxiliary Task for Image Classification](https://mlsanity.com/paper/2106.11478/) (2021)
- [DAD: Data-free Adversarial Defense at Test Time](https://mlsanity.com/paper/2204.01568/) (2022)
- [Inference Time Evidences of Adversarial Attacks for Forensic on Transformers](https://mlsanity.com/paper/2301.13356/) (2023)
- [Frequency maps reveal the correlation between Adversarial Attacks and Implicit Bias](https://mlsanity.com/paper/2305.15203/) (2023)
- [Graph-based methods coupled with specific distributional distances for adversarial attack detection](https://mlsanity.com/paper/2306.00042/) (2023)
- [DAD++: Improved Data-free Test Time Adversarial Defense](https://mlsanity.com/paper/2309.05132/) (2023)
- [Probabilistic Runtime Verification, Evaluation and Risk Assessment of Visual Deep Learning Systems](https://mlsanity.com/paper/2509.19419/) (2025)
- [A Mimetic Detector for Adversarial Image Perturbations](https://mlsanity.com/paper/2605.11492/) (2026)
- [A Convolutional Layer Activation Dimensionality Reduction for Out-of-Distribution and Adversarial Attack Detection Methods](https://mlsanity.com/paper/2608.10203/) (2026)
- [Detection of Adversarial Attacks on Super-Resolvers Using Spectral Features](https://mlsanity.com/paper/2609.35022/) (2026)

## Abstract (arXiv)

Despite the success of convolutional neural networks (CNNs) in many computer vision and image analysis tasks, they remain vulnerable against so-called adversarial attacks: Small, crafted perturbations in the input images can lead to false predictions. A possible defense is to detect adversarial examples. In this work, we show how analysis in the Fourier domain of input images and feature maps can be used to distinguish benign test samples from adversarial images. We propose two novel detection methods: Our first method employs the magnitude spectrum of the input images to detect an adversarial attack. This simple and robust classifier can successfully detect adversarial perturbations of three commonly used attack methods. The second method builds upon the first and additionally extracts the phase of Fourier coefficients of feature-maps at different layers of the network. With this extension, we are able to improve adversarial detection rates compared to state-of-the-art detectors on five different attack methods.