mlsanityData to 7 Oct 2026

Towards a Novel Perspective on Adversarial Examples Driven by Frequency

arXiv 2404.10202 ↗First posted 16 Apr 2024cs.LG cs.AIcited by 2

Not on the map. Why?

Abstract (arXiv)

Enhancing our understanding of adversarial examples is crucial for the secure application of machine learning models in real-world scenarios. A prevalent method for analyzing adversarial examples is through a frequency-based approach. However, existing research indicates that attacks designed to exploit low-frequency or high-frequency information can enhance attack performance, leading to an unclear relationship between adversarial perturbations and different frequency components. In this paper, we seek to demystify this relationship by exploring the characteristics of adversarial perturbations within the frequency domain. We employ wavelet packet decomposition for detailed frequency analysis of adversarial examples and conduct statistical examinations across various frequency bands. Intriguingly, our findings indicate that significant adversarial perturbations are present within the high-frequency components of low-frequency bands. Drawing on this insight, we propose a black-box adversarial attack algorithm based on combining different frequency bands. Experiments conducted on multiple datasets and models demonstrate that combining low-frequency bands and high-frequency components of low-frequency bands can significantly enhance attack efficiency. The average attack success rate reaches 99%, surpassing attacks that utilize a single frequency segment. Additionally, we introduce the normalized disturbance visibility index as a solution to the limitations of L2 norm in assessing continuous and discrete perturbations.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 36 of its 44 references that are in the map. First posted on arXiv 16 Apr 2024.

Builds on

36 of 44 references.

References · 36

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2016Densely Connected Convolutional Networkscited by 6,691
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  7. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  9. 2016Adversarial examples in the physical worldcited by 1,762
  10. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,430
  11. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  12. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
24 more
  1. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  2. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  3. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  4. 2019High Frequency Component Helps Explain the Generalization of Convolutional Neural Networkscited by 310
  5. 2019A Fourier Perspective on Model Robustness in Computer Visioncited by 288
  6. 2019Simple Black-box Adversarial Attackscited by 249
  7. 2021Efficient Deep Learning: A Survey on Making Deep Learning Models Smaller, Faster, and Bettercited by 153
  8. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 139
  9. 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
  10. 2018Query-Efficient Hard-label Black-box Attack:An Optimization-based Approachcited by 130
  11. 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
  12. 2023Anti-DreamBooth: Protecting users from personalized text-to-image synthesiscited by 114
  13. 2019NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networkscited by 94
  14. 2018Low Frequency Adversarial Perturbationcited by 80
  15. 2020GeoDA: a geometric framework for black-box adversarial attackscited by 66
  16. 2019Black-Box Adversarial Attack with Transferable Model-based Embeddingcited by 57
  17. 2019On the Effectiveness of Low Frequency Perturbationscited by 56
  18. 2019Curls & Whey: Boosting Black-Box Adversarial Attackscited by 37
  19. 2018On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functionscited by 31
  20. 2020Towards Frequency-Based Explanation for Robust CNNcited by 29
  21. 2021A Frequency Perspective of Adversarial Robustnesscited by 28
  22. 2021Detecting AutoAttack Perturbations in the Frequency Domaincited by 10
  23. 2020Local Convolutions Cause an Implicit Bias towards High Frequency Adversarial Examplescited by 9
  24. 2020Toward Few-step Adversarial Training from a Frequency Perspectivecited by 3

Built on by

Cited by year

Citing papers per year: 2025: 2.

2 papers.

  1. 2025T-MLA: A targeted multiscale log-exponential attack framework for neural image compressioncited by 1
  2. 2025VERITAS: Verification and Explanation of Realness in Images for Transparency in AI Systemscited by 0