mlsanityData to 14 Oct 2026

A Frequency Perspective of Adversarial Robustness

arXiv 2111.00861 ↗First posted 26 Oct 2021cs.CV cs.LGcited by 28

Not on the map. Why?

Abstract (arXiv)

Adversarial examples pose a unique challenge for deep learning systems. Despite recent advances in both attacks and defenses, there is still a lack of clarity and consensus in the community about the true nature and underlying properties of adversarial examples. A deep understanding of these examples can provide new insights towards the development of more effective attacks and defenses. Driven by the common misconception that adversarial examples are high-frequency noise, we present a frequency-based understanding of adversarial examples, supported by theoretical and empirical findings. Our analysis shows that adversarial examples are neither in high-frequency nor in low-frequency components, but are simply dataset dependent. Particularly, we highlight the glaring disparities between models trained on CIFAR-10 and ImageNet-derived datasets. Utilizing this framework, we analyze many intriguing properties of training robust models with frequency constraints, and propose a frequency-based explanation for the commonly observed accuracy vs. robustness trade-off.

Key facts. Cited by 28 papers in the map (data through 14 Oct 2026). Builds on 32 of its 43 references that are in the map. First posted on arXiv 26 Oct 2021.

Builds on

32 of 43 references.

References · 32

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2013Intriguing properties of neural networkscited by 5,155
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  5. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  6. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  7. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  8. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  9. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  10. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 678
  11. 2019Adversarial Training for Free!cited by 643
  12. 2017One pixel attack for fooling deep neural networkscited by 582
20 more
  1. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 567
  2. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
  3. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  4. 2018Feature Denoising for Improving Adversarial Robustnesscited by 314
  5. 2019High Frequency Component Helps Explain the Generalization of Convolutional Neural Networkscited by 310
  6. 2019A Fourier Perspective on Model Robustness in Computer Visioncited by 288
  7. 2018Adversarial Logit Pairingcited by 224
  8. 2016A study of the effect of JPG compression on adversarial imagescited by 197
  9. 2017Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compressioncited by 87
  10. 2018Low Frequency Adversarial Perturbationcited by 80
  11. 2019On the Effectiveness of Low Frequency Perturbationscited by 56
  12. 2018On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functionscited by 32
  13. 2020Hold me tight! Influence of discriminative features on deep network boundariescited by 31
  14. 2020Towards Frequency-Based Explanation for Robust CNNcited by 29
  15. 2020Local Convolutions Cause an Implicit Bias towards High Frequency Adversarial Examplescited by 9
  16. 2021Impact of Spatial Frequency Based Constraints on Adversarial Robustnesscited by 8
  17. 2020A Singular Value Perspective on Model Robustnesscited by 7
  18. 2019Principal Component Properties of Adversarial Samplescited by 3
  19. 2020Frequency-Tuned Universal Adversarial Attackscited by 3
  20. 2020Toward Few-step Adversarial Training from a Frequency Perspectivecited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 4; 2023: 8; 2024: 11; 2025: 4; 2026: 1.

28 papers.

Sort:

By area:

  1. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  2. 2022Frequency-driven Imperceptible Adversarial Attack on Semantic Similaritycited by 77
  3. 2023Spatial-frequency channels, shape bias, and adversarial robustnesscited by 28
  4. 2023Towards Building More Robust Models with Frequency Biascited by 12
  5. 2022Generalizable Deepfake Detection with Phase-Based Motion Analysiscited by 10
  6. 2023An Extended Study of Human-like Behavior under Adversarial Trainingcited by 9
  7. 2023Improving Feature Stability during Upsampling -- Spectral Artifacts and the Importance of Spatial Contextcited by 8
  8. 2024FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attackscited by 8
  9. 2024FaceShield: Defending Facial Image against Deepfake Threatscited by 8
  10. 2025Diffusion-based Adversarial Purification from the Perspective of the Frequency Domaincited by 8
  11. 2025Adversarial Attacks Leverage Interference Between Features in Superpositioncited by 8
  12. 2024Low-Rank Adversarial PGD Attackcited by 4
16 more
  1. 2023Towards Transferable Adversarial Attacks with Centralized Perturbationcited by 3
  2. 2024Defense without Forgetting: Continual Adversarial Defense with Anisotropic & Isotropic Pseudo Replaycited by 3
  3. 2024Towards a Novel Perspective on Adversarial Examples Driven by Frequencycited by 2
  4. 2024On Evaluating Adversarial Robustness of Volumetric Medical Segmentation Modelscited by 2
  5. 2026Contrastive Spectral Rectification: Test-Time Defense towards Zero-shot Adversarial Robustness of CLIPcited by 2
  6. 2022Robustness and invariance properties of image classifierscited by 1
  7. 2024Robust width: A lightweight and certifiable adversarial defensecited by 1
  8. 2024Interpreting Global Perturbation Robustness of Image Models using Axiomatic Spectral Importance Decompositioncited by 1
  9. 2024DFT-Based Adversarial Attack Detection in MRI Brain Imaging: Enhancing Diagnostic Accuracy in Alzheimer's Case Studiescited by 1
  10. 2022Testing predictions of representation cost theory with CNNscited by 0
  11. 2023Exploiting Frequency Spectrum of Adversarial Images for General Robustnesscited by 0
  12. 2023A Spectral Perspective towards Understanding and Improving Adversarial Robustnesscited by 0
  13. 2024Invariance-powered Trustworthy Defense via Remove Then Restorecited by 0
  14. 2024Robust Network Learning via Inverse Scale Variational Sparsificationcited by 0
  15. 2025FREQuency ATTribution: benchmarking frequency-based occlusion for time series datacited by 0
  16. 2025Layer-wise Noise Guided Selective Wavelet Reconstruction for Robust Medical Image Segmentationcited by 0