Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper presents a frequency-based understanding of adversarial examples in deep neural networks. The main observation is that the adversarial examples are neither in high-frequency or low-frequency components but dataset dependent. The authors also analyse the properties of training robust models with frequency constrains, and propose a frequency-based explanation for accuracy and robustness tradeoff.
main_review: Strengths:

There is a debate whether the higher or lower frequency components are more vulnerable to adversarial attacks. This paper confirms that adversarial examples are dataset dependent. This paper presents some interesting observations of adversarial examples in the frequency domain. A new measure of noise gradient is proposed to study the frequency properties of adversarial examples. The importance of frequency components is also studied with extensive experiments.

Weaknesses:
1.	This work is motivated by “the common misconception that adversarial examples are high-frequency noise”; however, such an understanding has already been questioned in the literature. For example, in (Tsuzuku & Sato, 2019), it shows “adversarial perturbations do not necessarily lie in high-frequency spots” by experiments; in (Yin et al. 2020), it says “adversarial examples are not strictly a high frequency phenomenon”; particularly in Bernhard et al. (2021), it questions “some preconceived hypothesis” that “adversarial perturbations as a pure HSF phenomenon with data-agnostic spatial frequency characteristics”. Therefore, the motivation should be better justified. The contribution is more like additional evidence of the ongoing debate, but rather a new frequency-based understanding of the “common misconception”. This should not be overclaimed.
2.	This work reveals that adversarial examples are dataset dependent; however, this is a commonly accepted point in the community, and therefore the idea and the conclusion do not seem new. In addition, the demonstration of this point with only CIFAR-10 and ImageNet-derived datasets does not seem sufficient. More datasets should be considered including the simplest one (MNIST), and others such as CIFAR-100, SVHN, Fashion-MNIST.
3.	Only PGD attacks are investigated – it is unclear if the observations also occur with other attacks, e.g., C&W, auto-attack.
4.	It claims the “observations overlap with insights from the concurrent work by Bernhard et al. (2021)”; however Bernhard et al. (2021) appeared on arXiv in April 2021. The authors may want to highlight the differences and justify this point. According to my understanding, the main messages of two papers are the same. This will dwarf the contribution of this paper.
5.	When measuring the importance of different frequency components and attacking low-frequency components, how to guarantee the imperceptibility? Should not the threat models be re-defined? How to make the trade-off between imperceptibility and attack successfulness?
6.	The measure of average noise gradient over the entire dataset should be further justified. Why is not the average noise gradient of a specific class, given the intuition that the frequency properties of images from different classes may be so different that the averaging may be misleading. 
7.	When designing adversarial training with frequency-based perturbation, how to find the frequency subspace? How is PGD attack restricted to the same frequency bands?

summary_of_the_review: The conclusion that adversarial examples are dataset dependent is too general: (1) this is already observed in the literature so that it does not say anything new; and (2) the validation of such conclusion is not sufficient. That being said, the experiments and the corresponding observations are interesting to the community. A major revision with sufficient validations and refined and more specific statements/arguments is recommended.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: In the paper, authors investigate the questions of adversarial robustness through the lens of spatial frequencies. In particular, contrary to a popular misconception, adversarial examples are not always related to high frequency components. Instead, they can encompass a wide range of spatial frequencies and are largely dataset dependent. The paper further studies adversarial training using different frequencies to better understand an accuracy vs robustness tradeoff. Carefully crafted experiments validate their findings and suggest a more effective approach for adversarial training. 

main_review: Strengths:
1) Interesting experimental setups and findings
2) Insightful conclusion and practical takeaway for better and more efficient adversarial training

Weaknesses:
1) Minor grammatical errors - “vs˙robustness”
2) Presentation of figures is a little inconvenient, they are usually presented earlier than when mentioned in the text, so one has to go back to previous pages each time to see them while reading.

summary_of_the_review: The paper negates the widely held belief about high-frequency nature of adversarial examples through interestingly designed experiments with practical consequences of more effective adversarial training, and, therefore, I recommend an acceptance. However, the presentation of figures and minor grammatical errors should be addressed.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper intends to investigate and analyze the phenomena of adversarial examples through the perspective of Fourier Analyses. It claims three major contributions:
1) they claim that adversarial examples is neither high frequency nor low frequency.
2) they adapt adversarial training with Fourier Analyses
3) they provide a new framework to measure robustness
main_review: Generally speaking, I think the author is very knowledgable for the corresponding field of adversarial robustness. They put a lot efforts to analyze the intriguing phenomena of adversarial examples. And I also agree with using the perspective of frequency  to understand this unsolved problem.

However, the content of this paper really confuses me. Currently, I cannot tell the level of its contribution. In particular, the author list three contributions in the 1st Section. Yet, most content in this section is about related works. The author only bring up their own work at the end of this section with three very brief descriptions. The first contribution (neither high nor low) is somewhat interesting but not well-supported. The author explain this argument in Section3 but I cannot understand their claim. What do you mean by "as one cannot verify the con- verse setting of blocking low frequency components. This is because low frequency components are inherently tied with labels (Wang et al., 2020b), conflating the two phenomena." Is there any other evidences that can support your claim? For the other two contributions, I think the authors themselves did not know how their work can help the community. Simply introducing the Fourier perspective into adversarial robustness or defenses is not enough to become a good work. After all, adopting the Fourier perspective is not the original idea of this paper. To help others understand the actual contribution, the authors should provide more details about how the analyses in this paper can help existing research and future works. Currently, I cannot find such claims. If there is any, the author should highlight these parts during rebuttal or maybe put them into the 1st Section.
summary_of_the_review: I decide to reject this paper for now. However, if the author can properly highlight their contributions during rebuttal, I may well reconsider my recommendation.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This work explores adversraial robustness from a frequency perspective. While this had been done before, this work challenges the commonly held notions, that adversarial perturbations are mainly a high-frequency phenomenon. The authors provide insight that the frequency properties of adversarial examples are dependant on the underlying training dataset. Additionally, the impact of different frequency properties in adversarial training is explored.
main_review: # Strong points 
* This work provides valuable insights to the adversarial machine learning community regarding the frequency-properties of adversarial examples and I believe other researchers in the field will find the insights in this work useful. In fact, I previously observed similar phenomena in my personal research. 
* The paper is well written, easy to follow, and provides extensive supplementary material. 
* The experimental design in section 6.1 (Weighing the contributions of different frequency components) is a nice idea providing interesting results.
* Similarly, the results from section 6.2 are interesting and give new insights for the adversarial training community. 
* The authors performed extensive experiments to support their claims, even providing many results on ImageNet.

# Weak points
* In some sense, the finding that the frequency properties of adversarial perturbations are dependant on the dataset is somewhat common sense. This work mainly explores adversarial examples for models trained on natural images, which are generally more low frequency. I assume that the frequency property of adversarial examples would be different for models trained on relatively more high-frequency images, such as radar signals or vibration signals. Such an experiment could also be insightful to further support one of the main points of this work. 
Additionally, it would have been interesting to see in addition to Figure 1, in which frequency range the natural images are located. This could allow a comparison of the frequency properties of adversarial examples to the natural images and maybe insights if adversarial perturbations exploit different frequency areas or overlapping frequency areas of the natural images. 
* The authors solely examine the frequency properties of adversarial perturbations for ResNet18 (and VGG16 in Figure A.9), however, other influence factors are not considered, such as other network architectures (DenseNet, ViT, MLP-Mixer), optimization properties (learning rate, optimizer choice). Hence, this work also provides only a partial view of the frequency perspective of adversarial robustness. The authors should discuss or point out this limitation of their work.
* [1] also observes that “In low-res datasets, higher frequencies tend to be disproportionately important, but the effect is less prominent on high-res ones.”, which is similar to the finding in this work: “We see that for normally trained CIFAR-10 models, the DCT of noise gradient activations are towards the higher frequencies [...] Whereas for TinyImageNet and ImageNet models, we observe that the activations are already in lower-mid frequencies”. This slightly limits the provided insight of this work. The authors should discuss the differences. 

[1] Dissecting the High-Frequency Bias in Convolutional Neural Networks; CVPRW 2021

summary_of_the_review: Accept. This work provides beneficial insights to the community and the strong points outweigh the weaknesses of this work.
review_title: null

Meta-review: The paper investigates adversarial examples in deep neural networks from a frequency-based perspective. Their main conclusion is that adversarial examples are neither in high- or low-frequency components, but instead depend on data. The topic is clearly important and the paper is overall clearly written and makes some interesting observations, backed up by empirical evidence.

However, the reviewers raised a number of critical concerns, including:
- Discussion of prior work is not adequate. The paper should better explain their contribution in contrast to prior work. Specifically, the authors mention Bernhard et al. (2021) as concurrent work, although the reviewers note that the work was published 5 months before. I realize the authors most likely develop their own line of work without knowing about Bernhard et al. (2021), but I would still suggest focusing more on the differences between them. I did not take this factor into account in the final decision.
- Novelty. Prior work has already shown adversarial examples are data-dependent
- Concerns about experimental setup (only investigate one particular attack, measure of average noise gradient not completely justified, ...)

After discussion, one reviewer downgraded their score and two others kept a more negative score. Only one reviewer was more positive with somewhat low confidence.

Overall, the paper is more on the reject side for now. Further work is needed and I strongly encourage the authors to clearly highlight the contributions of the paper in contrast to prior work. On the plus side, the work clearly has some potential and addresses an interesting topic.
Decision: Reject