# Frequency-driven Imperceptible Adversarial Attack on Semantic Similarity

arXiv: https://arxiv.org/abs/2203.05151 · HTML: https://mlsanity.com/paper/2203.05151/

## Key facts

- Cited by 77 papers in the map (data through 14 Oct 2026).
- Builds on 40 of its 49 references that are in the map.
- First posted on arXiv 10 Mar 2022.

## Builds on (most cited first, 30 of 40)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [ImageNet Large Scale Visual Recognition Challenge](https://mlsanity.com/paper/1409.0575/) (2014)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Densely Connected Convolutional Networks](https://mlsanity.com/paper/1608.06993/) (2016)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Rethinking the Inception Architecture for Computer Vision](https://mlsanity.com/paper/1512.00567/) (2015)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Wide Residual Networks](https://mlsanity.com/paper/1605.07146/) (2016)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [Theoretically Principled Trade-off between Robustness and Accuracy](https://mlsanity.com/paper/1901.08573/) (2019)
- [Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks](https://mlsanity.com/paper/2003.01690/) (2020)
- [Ensemble Adversarial Training: Attacks and Defenses](https://mlsanity.com/paper/1705.07204/) (2017)
- [The Limitations of Deep Learning in Adversarial Settings](https://mlsanity.com/paper/1511.07528/) (2015)
- [Provable defenses against adversarial examples via the convex outer adversarial polytope](https://mlsanity.com/paper/1711.00851/) (2017)
- [Countering Adversarial Images using Input Transformations](https://mlsanity.com/paper/1711.00117/) (2017)
- [Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks](https://mlsanity.com/paper/1704.01155/) (2017)
- [Circle Loss: A Unified Perspective of Pair Similarity Optimization](https://mlsanity.com/paper/2002.10857/) (2020)
- [High Frequency Component Helps Explain the Generalization of Convolutional Neural Networks](https://mlsanity.com/paper/1905.13545/) (2019)
- [A Fourier Perspective on Model Robustness in Computer Vision](https://mlsanity.com/paper/1906.08988/) (2019)
- [Multi-level Wavelet-CNN for Image Restoration](https://mlsanity.com/paper/1805.07071/) (2018)
- [EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples](https://mlsanity.com/paper/1709.04114/) (2017)
- [Perceptual Adversarial Robustness: Defense Against Unseen Threat Models](https://mlsanity.com/paper/2006.12655/) (2020)
- [Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses](https://mlsanity.com/paper/1811.09600/) (2018)
- [Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training](https://mlsanity.com/paper/1907.10764/) (2019)
- [Generalizable Data-free Objective for Crafting Universal Adversarial Perturbations](https://mlsanity.com/paper/1801.08092/) (2018)
- [Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distance](https://mlsanity.com/paper/1911.02466/) (2019)
- [Wavelet Integrated CNNs for Noise-Robust Image Classification](https://mlsanity.com/paper/2005.03337/) (2020)

## Built on by (most cited first, 30 of 77)

- [Frequency-aware Feature Fusion for Dense Image Prediction](https://mlsanity.com/paper/2408.12879/) (2024)
- [A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attacks](https://mlsanity.com/paper/2310.00633/) (2023)
- [Towards Benchmarking and Assessing Visual Naturalness of Physical World Adversarial Attacks](https://mlsanity.com/paper/2305.12863/) (2023)
- [Boosting Adversarial Transferability across Model Genus by Deformation-Constrained Warping](https://mlsanity.com/paper/2402.03951/) (2024)
- [Unified Physical-Digital Face Attack Detection](https://mlsanity.com/paper/2401.17699/) (2024)
- [NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectors](https://mlsanity.com/paper/2412.16955/) (2024)
- [LipSim: A Provably Robust Perceptual Similarity Metric](https://mlsanity.com/paper/2310.18274/) (2023)
- [PB-UAP: Hybrid Universal Adversarial Attack For Image Segmentation](https://mlsanity.com/paper/2412.16651/) (2024)
- [Forging and Removing Latent-Noise Diffusion Watermarks Using a Single Image](https://mlsanity.com/paper/2504.20111/) (2025)
- [Imperceptible Adversarial Attack via Invertible Neural Networks](https://mlsanity.com/paper/2211.15030/) (2022)
- [Vulnerabilities in AI-generated Image Detection: The Challenge of Adversarial Attacks](https://mlsanity.com/paper/2407.20836/) (2024)
- [Adversarial Infrared Blocks: A Multi-view Black-box Attack to Thermal Infrared Detectors in Physical World](https://mlsanity.com/paper/2304.10712/) (2023)
- [SpectralAR: Spectral Autoregressive Visual Generation](https://mlsanity.com/paper/2506.10962/) (2025)
- [PointCAT: Contrastive Adversarial Training for Robust Point Cloud Recognition](https://mlsanity.com/paper/2209.07788/) (2022)
- [Imperceptible Protection against Style Imitation from Diffusion Models](https://mlsanity.com/paper/2403.19254/) (2024)
- [Joint Physical-Digital Facial Attack Detection Via Simulating Spoofing Clues](https://mlsanity.com/paper/2404.08450/) (2024)
- [FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attacks](https://mlsanity.com/paper/2407.20653/) (2024)
- [AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks](https://mlsanity.com/paper/2503.09124/) (2025)
- [Adversarial Attacks and Defenses for Semantic Communication in Vehicular Metaverses](https://mlsanity.com/paper/2306.03528/) (2023)
- [Nearly Zero-Cost Protection Against Mimicry by Personalized Diffusion Models](https://mlsanity.com/paper/2412.11423/) (2024)
- [QAVA: Query-Agnostic Visual Attack to Large Vision-Language Models](https://mlsanity.com/paper/2504.11038/) (2025)
- [Face Encryption via Frequency-Restricted Identity-Agnostic Attacks](https://mlsanity.com/paper/2308.05983/) (2023)
- [GhostEncoder: Stealthy Backdoor Attacks with Dynamic Triggers to Pre-trained Encoders in Self-supervised Learning](https://mlsanity.com/paper/2310.00626/) (2023)
- [SITA: Structurally Imperceptible and Transferable Adversarial Attacks for Stylized Image Generation](https://mlsanity.com/paper/2503.19791/) (2025)
- [Scale-free and Task-agnostic Attack: Generating Photo-realistic Adversarial Patterns with Patch Quilting Generator](https://mlsanity.com/paper/2208.06222/) (2022)
- [Adversarial Attacks and Defenses in Machine Learning-Powered Networks: A Contemporary Survey](https://mlsanity.com/paper/2303.06302/) (2023)
- [Meta Invariance Defense Towards Generalizable Robustness to Unknown Adversarial Attacks](https://mlsanity.com/paper/2404.03340/) (2024)
- [Adversarial purification for no-reference image-quality metrics: applicability study and new methods](https://mlsanity.com/paper/2404.06957/) (2024)
- [Guardians of Image Quality: Benchmarking Defenses Against Adversarial Attacks on Image Quality Metrics](https://mlsanity.com/paper/2408.01541/) (2024)
- [Benchmarking Unified Face Attack Detection via Hierarchical Prompt Tuning](https://mlsanity.com/paper/2505.13327/) (2025)

## Abstract (arXiv)

Current adversarial attack research reveals the vulnerability of learning-based classifiers against carefully crafted perturbations. However, most existing attack methods have inherent limitations in cross-dataset generalization as they rely on a classification layer with a closed set of categories. Furthermore, the perturbations generated by these methods may appear in regions easily perceptible to the human visual system (HVS). To circumvent the former problem, we propose a novel algorithm that attacks semantic similarity on feature representations. In this way, we are able to fool classifiers without limiting attacks to a specific dataset. For imperceptibility, we introduce the low-frequency constraint to limit perturbations within high-frequency components, ensuring perceptual similarity between adversarial examples and originals. Extensive experiments on three datasets (CIFAR-10, CIFAR-100, and ImageNet-1K) and three public online platforms indicate that our attack can yield misleading and transferable adversarial examples across architectures and datasets. Additionally, visualization results and quantitative performance (in terms of four different metrics) show that the proposed algorithm generates more imperceptible perturbations than the state-of-the-art methods. Code is made available at.