# A Frequency Perspective of Adversarial Robustness

arXiv: https://arxiv.org/abs/2111.00861 · HTML: https://mlsanity.com/paper/2111.00861/

## Key facts

- Cited by 28 papers in the map (data through 14 Oct 2026).
- Builds on 32 of its 43 references that are in the map.
- First posted on arXiv 26 Oct 2021.

## Builds on (most cited first, 30 of 32)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Theoretically Principled Trade-off between Robustness and Accuracy](https://mlsanity.com/paper/1901.08573/) (2019)
- [Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks](https://mlsanity.com/paper/2003.01690/) (2020)
- [Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples](https://mlsanity.com/paper/1802.00420/) (2018)
- [Adversarial Examples Are Not Bugs, They Are Features](https://mlsanity.com/paper/1905.02175/) (2019)
- [Ensemble Adversarial Training: Attacks and Defenses](https://mlsanity.com/paper/1705.07204/) (2017)
- [Distillation as a Defense to Adversarial Perturbations against Deep Neural Networks](https://mlsanity.com/paper/1511.04508/) (2015)
- [Adversarial Training for Free!](https://mlsanity.com/paper/1904.12843/) (2019)
- [One pixel attack for fooling deep neural networks](https://mlsanity.com/paper/1710.08864/) (2017)
- [Provable defenses against adversarial examples via the convex outer adversarial polytope](https://mlsanity.com/paper/1711.00851/) (2017)
- [Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods](https://mlsanity.com/paper/1705.07263/) (2017)
- [Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks](https://mlsanity.com/paper/1704.01155/) (2017)
- [Feature Denoising for Improving Adversarial Robustness](https://mlsanity.com/paper/1812.03411/) (2018)
- [High Frequency Component Helps Explain the Generalization of Convolutional Neural Networks](https://mlsanity.com/paper/1905.13545/) (2019)
- [A Fourier Perspective on Model Robustness in Computer Vision](https://mlsanity.com/paper/1906.08988/) (2019)
- [Adversarial Logit Pairing](https://mlsanity.com/paper/1803.06373/) (2018)
- [A study of the effect of JPG compression on adversarial images](https://mlsanity.com/paper/1608.00853/) (2016)
- [Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression](https://mlsanity.com/paper/1705.02900/) (2017)
- [Low Frequency Adversarial Perturbation](https://mlsanity.com/paper/1809.08758/) (2018)
- [On the Effectiveness of Low Frequency Perturbations](https://mlsanity.com/paper/1903.00073/) (2019)
- [On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functions](https://mlsanity.com/paper/1809.04098/) (2018)
- [Hold me tight! Influence of discriminative features on deep network boundaries](https://mlsanity.com/paper/2002.06349/) (2020)
- [Towards Frequency-Based Explanation for Robust CNN](https://mlsanity.com/paper/2005.03141/) (2020)
- [Local Convolutions Cause an Implicit Bias towards High Frequency Adversarial Examples](https://mlsanity.com/paper/2006.11440/) (2020)
- [Impact of Spatial Frequency Based Constraints on Adversarial Robustness](https://mlsanity.com/paper/2104.12679/) (2021)
- [A Singular Value Perspective on Model Robustness](https://mlsanity.com/paper/2012.03516/) (2020)
- [Principal Component Properties of Adversarial Samples](https://mlsanity.com/paper/1912.03406/) (2019)

## Built on by (most cited first, 28 of 28)

- [A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinking](https://mlsanity.com/paper/2302.14301/) (2023)
- [Frequency-driven Imperceptible Adversarial Attack on Semantic Similarity](https://mlsanity.com/paper/2203.05151/) (2022)
- [Spatial-frequency channels, shape bias, and adversarial robustness](https://mlsanity.com/paper/2309.13190/) (2023)
- [Towards Building More Robust Models with Frequency Bias](https://mlsanity.com/paper/2307.09763/) (2023)
- [Generalizable Deepfake Detection with Phase-Based Motion Analysis](https://mlsanity.com/paper/2211.09363/) (2022)
- [An Extended Study of Human-like Behavior under Adversarial Training](https://mlsanity.com/paper/2303.12669/) (2023)
- [Improving Feature Stability during Upsampling -- Spectral Artifacts and the Importance of Spatial Context](https://mlsanity.com/paper/2311.17524/) (2023)
- [FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attacks](https://mlsanity.com/paper/2407.20653/) (2024)
- [FaceShield: Defending Facial Image against Deepfake Threats](https://mlsanity.com/paper/2412.09921/) (2024)
- [Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain](https://mlsanity.com/paper/2505.01267/) (2025)
- [Adversarial Attacks Leverage Interference Between Features in Superposition](https://mlsanity.com/paper/2510.11709/) (2025)
- [Low-Rank Adversarial PGD Attack](https://mlsanity.com/paper/2410.12607/) (2024)
- [Towards Transferable Adversarial Attacks with Centralized Perturbation](https://mlsanity.com/paper/2312.06199/) (2023)
- [Defense without Forgetting: Continual Adversarial Defense with Anisotropic & Isotropic Pseudo Replay](https://mlsanity.com/paper/2404.01828/) (2024)
- [Towards a Novel Perspective on Adversarial Examples Driven by Frequency](https://mlsanity.com/paper/2404.10202/) (2024)
- [On Evaluating Adversarial Robustness of Volumetric Medical Segmentation Models](https://mlsanity.com/paper/2406.08486/) (2024)
- [Contrastive Spectral Rectification: Test-Time Defense towards Zero-shot Adversarial Robustness of CLIP](https://mlsanity.com/paper/2601.19210/) (2026)
- [Robustness and invariance properties of image classifiers](https://mlsanity.com/paper/2209.02408/) (2022)
- [Robust width: A lightweight and certifiable adversarial defense](https://mlsanity.com/paper/2405.15971/) (2024)
- [Interpreting Global Perturbation Robustness of Image Models using Axiomatic Spectral Importance Decomposition](https://mlsanity.com/paper/2408.01139/) (2024)
- [DFT-Based Adversarial Attack Detection in MRI Brain Imaging: Enhancing Diagnostic Accuracy in Alzheimer's Case Studies](https://mlsanity.com/paper/2408.08489/) (2024)
- [Testing predictions of representation cost theory with CNNs](https://mlsanity.com/paper/2210.01257/) (2022)
- [Exploiting Frequency Spectrum of Adversarial Images for General Robustness](https://mlsanity.com/paper/2305.08439/) (2023)
- [A Spectral Perspective towards Understanding and Improving Adversarial Robustness](https://mlsanity.com/paper/2306.14262/) (2023)
- [Invariance-powered Trustworthy Defense via Remove Then Restore](https://mlsanity.com/paper/2402.00304/) (2024)
- [Robust Network Learning via Inverse Scale Variational Sparsification](https://mlsanity.com/paper/2409.18419/) (2024)
- [FREQuency ATTribution: benchmarking frequency-based occlusion for time series data](https://mlsanity.com/paper/2506.18481/) (2025)
- [Layer-wise Noise Guided Selective Wavelet Reconstruction for Robust Medical Image Segmentation](https://mlsanity.com/paper/2511.16162/) (2025)

## Abstract (arXiv)

Adversarial examples pose a unique challenge for deep learning systems. Despite recent advances in both attacks and defenses, there is still a lack of clarity and consensus in the community about the true nature and underlying properties of adversarial examples. A deep understanding of these examples can provide new insights towards the development of more effective attacks and defenses. Driven by the common misconception that adversarial examples are high-frequency noise, we present a frequency-based understanding of adversarial examples, supported by theoretical and empirical findings. Our analysis shows that adversarial examples are neither in high-frequency nor in low-frequency components, but are simply dataset dependent. Particularly, we highlight the glaring disparities between models trained on CIFAR-10 and ImageNet-derived datasets. Utilizing this framework, we analyze many intriguing properties of training robust models with frequency constraints, and propose a frequency-based explanation for the commonly observed accuracy vs. robustness trade-off.