mlsanityData to 14 Oct 2026

Detecting AutoAttack Perturbations in the Frequency Domain

arXiv 2111.08785 ↗First posted 16 Nov 2021cs.CV cs.CRcited by 10

Not on the map. Why?

Abstract (arXiv)

Recently, adversarial attacks on image classification networks by the AutoAttack (Croce and Hein, 2020b) framework have drawn a lot of attention. While AutoAttack has shown a very high attack success rate, most defense approaches are focusing on network hardening and robustness enhancements, like adversarial training. This way, the currently best-reported method can withstand about 66% of adversarial examples on CIFAR10. In this paper, we investigate the spatial and frequency domain properties of AutoAttack and propose an alternative defense. Instead of hardening a network, we detect adversarial attacks during inference, rejecting manipulated inputs. Based on a rather simple and fast analysis in the frequency domain, we introduce two different detection algorithms. First, a black box detector that only operates on the input images and achieves a detection accuracy of 100% on the AutoAttack CIFAR10 benchmark and 99.3% on ImageNet, for epsilon = 8/255 in both cases. Second, a whitebox detector using an analysis of CNN feature maps, leading to a detection rate of also 100% and 98.7% on the same benchmarks.

Key facts. Cited by 10 papers in the map (data through 14 Oct 2026). Builds on 23 of its 26 references that are in the map. First posted on arXiv 16 Nov 2021.

Builds on

23 of 26 references.

References · 23

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2016Wide Residual Networkscited by 3,070
  4. 2018A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attackscited by 1,485
  5. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  6. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  7. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
  8. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
  9. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 334
  10. 2019A Fourier Perspective on Model Robustness in Computer Visioncited by 288
  11. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 282
  12. 2017Detecting Adversarial Samples from Artifactscited by 245
11 more
  1. 2017On Detecting Adversarial Perturbationscited by 232
  2. 2017On the (Statistical) Detection of Adversarial Examplescited by 180
  3. 2016Technical Report on the CleverHans v2.1.0 Adversarial Examples Librarycited by 124
  4. 2016Adversarial Examples Detection in Deep Networks with Convolutional Filter Statisticscited by 77
  5. 2019Detecting Adversarial Samples Using Influence Functions and Nearest Neighborscited by 72
  6. 2019advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorchcited by 69
  7. 2016Early Methods for Detecting Adversarial Imagescited by 36
  8. 2018Detection based Defense against Adversarial Examples from the Steganalysis Point of Viewcited by 32
  9. 2018On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functionscited by 32
  10. 2021SpectralDefense: Detecting Adversarial Attacks on CNNs in the Fourier Domaincited by 30
  11. 2020Effective and Robust Detection of Adversarial Examples via Benford-Fourier Coefficientscited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 1; 2022: 2; 2023: 0; 2024: 5; 2025: 1; 2026: 1.

10 papers.

  1. 2022Robust Models are less Over-Confidentcited by 25
  2. 2021Is RobustBench/AutoAttack a suitable Benchmark for Adversarial Robustness?cited by 12
  3. 2024Prompt-Driven Contrastive Learning for Transferable Adversarial Attackscited by 9
  4. 2024FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attackscited by 8
  5. 2022Unfolding Local Growth Rate Estimates for (Almost) Perfect Adversarial Detectioncited by 5
  6. 2024Towards a Novel Perspective on Adversarial Examples Driven by Frequencycited by 2
  7. 2024Adversarial Examples are Misaligned in Diffusion Model Manifoldscited by 1
  8. 2024DFT-Based Adversarial Attack Detection in MRI Brain Imaging: Enhancing Diagnostic Accuracy in Alzheimer's Case Studiescited by 1
  9. 2025Robust Vision-Language Models via Tensor Decomposition: A Defense Against Adversarial Attackscited by 0
  10. 2026DE-FIVE: Detecting Malicious Image Prompts via Fourier Features and Image Vector Embeddingscited by 0