Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: The paper proposes that applying a low pass filter on the input data improves the robustness of the model. 
•	Filtering out the high frequency component of the signal can be very application dependent. In many applications, e.g. Time-frequency image of the signals such as radar signals or vibration signals, the high frequency component contains the information that the modeler of the DNN is seeking to model. Therefore, the authors should specify the applications in which the filtering is actually useful. Please elaborate more in what application this technique can be useful. Image processing is a very general term that may not be necessarily descriptive about the domain where the proposed technique is applicable. 
•	Can the authors specify in the paper if the frequency dependence of the DNN depends on the structure (length and width) of the designed DNN? Is there recommendations for modelers? 
•	Can the authors provide more details on the design of the low pass filter? Is it FIR or IIR? How do they come up with the design of the filter? 

review_title: The paper proposes that applying a low pass filter on the input data improves the robustness of the model. 

final_score: rating: 5: Marginally below acceptance threshold
review_content: This submission deals with understanding the gradient based adversarial examples. For this means, it analyzes the adversarial examples in the frequency domain, where it identifies that the ratio of high-frequency and low frequency parts is quite large in adversarial examples compared with the natural ones. As a result, it proposes to apply a low-pass filtering to the data that can significantly improve the model robustness. Some experiments for CIFAR-10 classification are performed to support the main conclusions.


Strong points
The frequency domain perspective to analyzing adversaries is interesting and useful.


Weak points
Several assumptions are made. In particular, the assumption about the weights {a_r} being random is unrealistic. 
It is not clear how much the accuracy can deteriorate because of low pass filtering. It would be important to show that reducing the cut-off frequency to the desired value that rejects the adversaries is not going to significantly hurt the accuracy. 
The theoretical results and analysis relies on several assumptions. It particularly considers a very simple single-layer neural network, where the weights for the classification weights are assumed random and not learnable. The theoretical perspective is of high importance. However, the tightness of the final thresholds in Theorems 1 and 2 are not clear. There is no empirical evidence designed specifically to support the Theorems. 


Suggestions
Specific experiments to support the models and assumption and results in Theorem 1 and 2 would increase the value of this work.


Reproducibility
The code is not provided, but the details of the experiments are listed.


review_title:   

final_score: rating: 4: Ok but not good enough - rejection
review_content: This paper analyzes the frequency spectrum of adversarial perturbations during normal training. The authors show that the low frequency component (LFC) of adversarial perturbation is increasing during training, but it is not increasing fast enough, so the LFC of adversarial perturbation is not as dense as the input natural images which obey the power law. Therefore, the log-spectrum difference of adversarial examples will express a HFC-concentrated phenomenon. The authors used theory and experiments to demonstrate this point.

The theoretical analyses look correct to me and they look useful since rigorous understanding of frequency spectrum is useful to the robustness research community. However, I have the following concerns:

1) This paper analyzes the frequency spectrum of normal training. Thus it aims to understand the adversarial perturbation for naturally-trained (i.e., non-robust model). The authors indeed provide an iterative equation showing how the frequency pattern changes across training, but it is only for a very specific case: the network is two-layer, trained with gradient descent algorithm, and the adversarial perturbation is FGM. As we know, the naturally trained models are very non-robust, which means that there are potentially many different ways to attack the model. If we constrain the attack direction to low/high frequency matrices, we may always be able to find a direction to attack the model. In fact, Ford et al (Adversarial Examples Are a Natural Consequence of Test Error in Noise) show that the existence of adversarial example is equivalent to test error under Gaussian noise, and therefore an adversarial perturbation that has uniform Fourier spectrum may be a valid perturbation direction (although it is not necessarily a direction computed from FGM). Therefore, I don't think the theory and experimental observation can be applied in a wide range of problems.

2) I think the paper is not written very clearly. When I read the second paragraph on page 2, I found the three main contributions kind of contradicting with each other. The first point says the adversarial perturbation concentrates on the low frequency domain and the second point says it concentrates on the high frequency domain. I was only able to roughly understand it when reading page 6, the paragraph after Theorem 2. I think the authors should spend more effort to make their main point clearly delivered.

3) I think the most misleading part in this paper is the claim that low pass filter improves robustness. This experiment was done by first attack the natural images on normal models, without knowing that there will be a low pass filter, and then pass the attacked images to the low pass filter. This is not consistent with the commonly used white box attack protocol, i.e., the adversary should know all the components of the model. The authors got the results by hiding the low pass filter from the adversary, and thus I think claiming the filtering improves robustness is very misleading to the readers.

===============

After author response:
I would like to thank the authors for providing response. For the second point, I am still a bit confused about spectrum of perturbations vs log-spectrum of adversarial examples. The authors agreed that my third point was correct, i.e., the current results do not give enough insights on how to improve robustness against adversarial examples, in the real-world white box setting. Given the above reasons, I decided to keep my score.


review_title: Interesting results but the paper needs improvement

final_score: rating: 3: Clear rejection
review_content: The paper shows formally (under somewhat restricted conditions, like 2-layer NN and for "natural images") that adversarial perturbations mainly affect high-frequency content of the images. This is also shown empirically, and it is shown that low-pass filtering improves robustness against adversarial examples. 

The core idea of the paper (low-pass filtering improves robustness against AEs) is actually old. Several methods have been proposed that in one way or another perform a low-pass filtering of the image to reduce the perturbation noise and thus improve robustness to AEs. The core idea of the paper is, therefore, not novel. That perturbations must be mainly impinging on high-frequency content is an obvious conclusion. The effect of low-pass filtering on clean image classification is also, once again, neglected. What is the value of a defense method if it decreases accuracy for clean images?

Besides, the experiments are rather limited in only using CIFAR-10 (which is a subset of CIFAR) and PGD attack. The experiments are also limited insofar as a comparison is made with adversarial training, without consideration for any of the dozens other defense methods available.

Minor: On p. 1 there is a sentence "...that human can only perceive LFC." that sounds too categorical, it has to be rephrased.
review_title: A frequency domain analysis of gradient-based adversarial examples

Meta-review: This work performs a frequency domain analysis on gradient-based adversarial perturbations. The authors argue that the perturbation deltas are largely concentrated in the high frequency domain and suggest a low pass filtering technique to improve the robustness of image classifiers. Reviewers raised several concerns as to how broadly applicable the given claims will hold, noting that these findings will be largely dependent on how the model was trained, what data the model is trained on, and how the adversarial perturbation will be constructed. Additionally, the proposal to apply a low pass filter to improve robustness is not new---it has been attempted in several works in the past and current consensus is this only provides improved robustness to high frequency perturbations/corruptions. As a recent example, Yin et. al. studied the robustness properties of models trained with a low pass filter and found that while robustness to high frequency noise and perturbations is improved, this procedure also degrades robustness to low frequency corruptions and perturbations. By focusing the analysis quite narrowly to restricted l2-perturbations the work is missing critical nuances that are well known in the literature studying distribution shift. This AC recommends the authors connect their analysis to the broader issue of distribution shift, for example can the theory provide understanding into how to improve robustness to both high and low frequency corruptions?
Decision: Reject