A frequency domain analysis of gradient-based adversarial examples
Authors: Bochen Lv
Pu Yang
Zehao Wang
Zhanxing Zhu
Venue:  (2021)

Abstract: It is well known that deep neural networks are vulnerable to adversarial examples. We attempt to understand adversarial examples from the perspective of frequency analysis. Several works have empirically shown that the gradient-based adversarial attacks perform differently in the low-frequency and high-frequency part of the input data. But there is still a lack of theoretical justification of these phenomena. In this work, we both theoretically and empirically show that the adversarial perturbations gradually increase the concentration in the low-frequency domain of the spectrum during the training process of the model parameters. And the log-spectrum difference of the adversarial examples and clean image is more concentrated in the high-frequency part than the low-frequency part. We also find out that the ratio of the high-frequency and the low-frequency part in the adversarial perturbation is much larger than that in the corresponding natural image. Inspired by these important theoretical findings, we apply low-pass filter to potential adversarial examples before feeding them to the model. The results show that this preprocessing can significantly improve the robustness of the model.

Under review as a conference paper at ICLR 2021
A FREQUENCY DOMAIN ANALYSIS OF GRADIENT- BASED ADVERSARIAL EXAMPLES
Anonymous authors Paper under double-blind review
ABSTRACT
is well known that deep neural networks are vulnerable adversarial examples. We attempt to understand adversarial examples from the perspective of frequency analysis. Several works have empirically shown that the gradient-based adver- sarial attacks perform differently in the low-frequency and high-frequne fre.ueneyyuyyyy part of the input data. But there is still a lack of theoretical justification of these phenom- ena. In this work, we both theoretically and empirically show that the adversarial perturbations gradually increase the concentration in the oow-frequency domain of the spectrum during the training process of the model parameters. And the log-spectrum difference of the adversarial examples and clean image is more con- centrated in the high- high-frequency part than the low-frequency part. We also find out that the ratio of the high-frequency and the low-frequency part in the adversarial perturbation is much larger than that in the corresponding natural image. Inspired by these important theoretical findings, we apply low-pass filter to potential ad- versarial examples before feeding them the model. The results show that this preprocessing can significantly improve the robustness of the model.
INTRODUCTION
Recently, deep neural networks (DNN) have achieved great success in the field of image process- ing, but it was found that DNNs are vulnerable to some synthetic data called adversarial examples (Szegedy al. 2013), (Kurakin al., (016)). Adversarial examples are natural samples plus ad- versarial perturbations, and the perturbations between natural samples and adversarial examples are imperceptible to human but able to fool the model. Typically, generating an adversarial example can be considered finding example in an e-ball around a natural image that could be misclassified by the classifier. Recent studics designed Fast Gradient Sign Method (FGSM, (Goodfellow et al, 2014), Fast Gradient Method (FGM, (Miyato al.) (016)) Projected Gradient Descent (PGD, (Madry et al. (017)) and other algorithms (Carlini & Wagner (2017). (Su et al. 2019), (Xiao et al., 2018). Kurakin
2016), (Chen al. (017)) to attack the model.
Since the phenomenon of adversarial examples was discovered, many related works have made progress study why they exist. Several works studied this phenomenon from the perspective of feature representation. īlyas et al. (2019) divided the features into non-robust ones that are respon- sible for the model's vulnerability adversarial examples, and robust ones that are close human perception. Further, they showed that adversarial vulnerability arises from non-robust features that are useful for correct classification.
Another way to characterize adversarial examples is to investigate them in the frequency domain via Fourier transform. |Wang al. (2020a) divided an image into low-frequency component (LFC) and high-frequency component (HFC) and they empirically showed that human can only perceive LFC, but convolutional neural networks can obtain useful information from both LFC and HFC. [Yin et al.) (2019) filters out the input data with low-pass or high-pas pass filters to study the sensitivity of the ad- ditive noise with different frequencies. WWan et al. (2020b) claimed that existing adversarial attacks mainly concentrate in the high-frequenc part. [Sharma et al. (2019) found that when perturbations are constrained to the owwffrquuecc subspace, they are generated faster and are more transferable, and will be effective to fool the defended models, but not for clean models.
All of these works showed that spectrum in frequency domain is an reasonable way to study the adversarial examples.

---

Under review as a conference paper at ICLR 2021
However, there is lack of theoretical understanding about the dynamics of the adversarial pertur- bations in frequency domain along the training process the model parameters. In this work, we focus on the frequency domain of the adversarial perturbations to explore the spectral properties of the adversarial examples generated by FGM (Miyato et al. 2016) and PGD) (Madry et al. 2017).
In this work, we give theoretical analysis in frequency domain of natural images for the adversarial examples.
For a two-layer neural network with non-linear activation function, we prove that adversar- ial perturbations by FGM and 12-PGD attacks gradually increase the concentration in the low foe-uequyncyy part of the spectrum during the training process over model parameters.
Meanwhile, the log-spectrum difference of the adversarial examples (the definition will be clarified in Section 2.2) will be more concentrated in the high-frequency part than the
low-frequency part.
Furthermore, we show that the ratio of the -ree-fryyenny and the low-frequency part in the adversarial perturbation is much larger than that in the corresponding clean image.
Empirically.
we design several experiments the two-layer model and Resnet-32 with CIFAR-10 to verify the above findings.
Based on these phenomena, we filter out the high-frequency part of the adversarial ex- amples before feeding them to the model improve the robustness. Compared with the adversarially trained model with the same architecture, our method achieves comparable robustness with the similar computational cost of normal training and almost no loss of accuracy.
The rest of the paper is organized as follows: In Section 2 we present preliminaries and some theoretical analysis on the calculation of the spectrum and log-spectrum. Then we provide our
main results about the frequency domain analysis of gradient-based adversarial examples in Section
3 Furthermore, some experiments for supporting our theoretical findings are shown in Section Finally we conclude our work and conduct discussion about the future work in Section All the details about the proof and experiments are shown in the Appendix.
2 BACKGROUND
2.1 PRELIMINARIES
Notations We use {0, I,..., d} to denote the set of all integers between 0 and d and use || I| to denote 4p norm. Specifically, denote by || the l2 norm. For a d-dimensional vector æ, use E to denote its y-th component with index starting at O. For scalar function f fæx): Rd + R. V / and J, denote the gradient vector and its p-th component. We let sgn(æ) = 1 for > 0 and -1 for x 0. Normal training refers to training the original training data for learning the optimal weights for the neural networks. t = F(x) denotes the Discrete Fourier Transform (DFT) of x.
Discrete Fourier Transform The k-th frequency component g[k] of one-dimensional DFT of vector g is defined by
[k]==(()]kk Σ gue ck
where is E 1/2/2.-d/2+1..... d/2) if d is and h E {-(d 1)/2, 1))2 if d is odd. For convenience, we always consider an odd d and one can easily generalize the case to even dimensions. For integer cut-off (cutoff frequency) k, (0, (d 1)/2), the Low Frequency Components (LFC) and High Frequency Components (HFC) of ğ are denoted by
[[] (
if k. < 5 ker otherwise
if hi < ke:
9i [k]
[k]
[]
otherwise.
2

---

Under review as a conference paper at ICLR 2021
Then the frequency space I. can be decomposed St O S₁. where ğI St and ğn. Sh. Let Ng- VE d/2 []]] then the ratio of frequency component with respect the whole frequency spectrum is denoted by
5
[o(kk)
N
and the ratio of LFC is denoted by
ko
|
7 E Si)
Setup In this paper, we consider two-layer neural network f RRd RR
f(x, 0
0 (w, x))
(1)
where a is an activation function, (a1, .2,,... am) )T is an m-dimensional vector and w, are d-dimensional weight vectors.
Van der Schaal & van Hateren 1996) showed that natural images obey power law in the frequency domain. Therefore, to make our settings closer to widely studied image related tasks, we also assume our input æ obey the power law
[ k
to imitate LJCC-concentrated images, where the constant 2 and E [0]] = Oo is another constant. Besides, we choose the cut-off kg such a way that
(d-1)/2
Σ
2
12a
k=ke+1
which indicates that 7(@ E St) > ( E Sn)) and can be easily satisfied for a small ki-
Gradient-based adversarial attack For a loss function we find -o-norm e-bounded adversarial perturbations by solving the optimization problem
max ((f(x 5), SI
where yxr E R&d x d-dimensional input and output following the joint distribution D.
To solve the above optimization problem, Goodfellow et al. (2014) proposed FGSM, an attack for an
bounddd adversary, and computed an adversarial example as Wady = x + e sgn (Vzz(0,, y))-
Miyato et al. (2066) proposed FGM with an bo-bounded adversary, Eady = x + [
(x)(w.)) Madry
et al.
(201)) introduced PGD which training adversarial examples an iterative way that x (a: T
V=((w.y) sgn (V,l(0, æ v))) or (+1 I s(x + 0 [V (=..))
To simplify the analysis, we make the following assumptions the normal training process:
Assumption There exist B¹, > O such that B' < /00/0/1 S
Assumption E = ( 0))² |at/Of| should be a small quantity such that |Øt/Of| 1+e if network is well trained in the end stage of normal training, where 0 < 1.
Assumption 3 There exist X, > 0 such that 0 s o' S > and O S o <
Assumption 4 a, are i.i.d drawn from a distribution and will not be updated during the training.
'e.g. A= = 1 and y = 1 if = In(1 + e*).
Pegg. Bernouli distribution.
3

---

Under review as a conference paper at ICLR 2021
2.2 EXPLORING THE LOG-SPECTRUM AND SPECTRUM
Wang et al. 22000a considered the log-spectrum of an image: 20 log ((F(x))), where æ is 2d- dimensional matrix representing image. One way to calculate the "log-spectrum difference of the adversarial examples" is to consider the difference between the log-spectrum of the adversarial and natural image and as follows,
F(
[(
20 [o + 6)1) log([F(()) Ro 20 log( 1 +
R3 20 = [F(x)]
(3)
[F(x))
We can observe that this quantity is approximately proportional to the ratio of the perturbation's 's over the natural image's 's frequency. Moreover, the average Relative Change in discrete cosine Transforms (RCT) in (Wang et al. (0206)) approximately equals to it. Fig. empirically shows that this ratio large for high frequency component but small for low frequency one. However, Van der Schaaf & van Hateren (1996) claimed that the LFC of F(x) is much bigger than its HFC, and the right side of Eq. S is inversely proportional to F(z). The denominator
the right side of Eq. in low-frequency part is much larger than it in high frequency part, so it may be imprudent to consider the frequency distribution of the adversarial perturbations only based on the ratio in the right side of E3.
Yin et al. (2019) provided another spectral measurement for adversarial examples. They considered the "spectrum of the adversarial perturbation" [F())], which directly reflects the distribution of adversarial perturbations in the frequency domain. Unfortunately. they claimed that "The ad- versarial perturbations for the normally trained model uniformly distributed across frequency components' without sufficient empirical and theoretical justification. In this work, we provide totally different theoretical finding that the adversarial perturbations for the normally trained model are gradually concentrated in the low-freee www-frequency domain, further verified by extensive experiments.
Fig. D visually shows the calculation methods of the spectrum of perturbations F(6) and the log- [_(
spectrum difference of adversarial examples log([F(x + 8)1) - log([F(x)) F(2)
MAIN RESULTS
show that, for well trained two-layer neural network described in Eq. with LFC-concentrated inputs, lz- norm adversarial perturbations generated by FGM (Theorem ! prefer to concentrate in the low frequency domain. Section 3.2 theoreti- cally proves the HFFC-concetraation of the log- spectrum difference of adversarial examples. Section 3.3 attempts demonstrate the effec- tiveness of masking the HFC of the adversar- ial examples improve model's robustness de- spite that perturbations low frequency domain. All technical proofs are deferred to Appendix A. Results on la PGD per- turbations are presented in Appendix B.
In Section 3.1
Image:
L 1 53
[F(0]
Spectrumc
000
Log spectrum:
concentrate in the
Figure 1: Visualization of spectrum and log-
spectrum for adversarial attacks Section 3. fo- cuses on the center picture F(8) prove that the LFC ratio of F(8) is increasing. Section 3.2 fo- cuses on the third-line center picture log( [ 5)1) log(I_F(( smaller than its HFC.
In this work, consider the two-layer neu- ral networks and the loss function =
(y - ())² For any in this setting, have
and shows that its LFC is
aw x²) ow, os
ØS
d.ar VaI= w.
oa,
where a', a (wo x) and a' (at, alg amm). At the 1)-th step of gradient descent in the normal training process of the classifier, weight w is updated as
ae (1)
(1 wo! " af
(4)

---

Under review as a conference paper at ICLR 2021
We use Lg and H₂ to denote the LFC and HFC of the clean input
(d 11/11/2
La =
[]k]] and H. = Σ
(5)
3.1 SPECTRAL TRAJECTORIES OF 12- NO-M FGM PERTURBATIONS
Consider the 12-norm FGM perturbation ò and its DFT
[KK]
V=f Øf
Oe
6
V
8[k]
sgn 0f
Vafll
(6)
where V =V(a)) [8]. Since the coefficient before [)( in (6) same for different frequen- cies k, we only need to analyze the spectrum of [k] to investigate the ratio of certain frequency component over the whole frequency speetrum, i.e.
(81k) (.)lk))
In this subsection, we explore the evolving of T(((k)) along the normal training process. For a randomly initialized network, the FGM -ataattack perturbation will not have bias towards either HFC or LFC. We attack this model with FGM at each step of the normal training to study the trajectory of these perturbations in the frequency domain. According Eq. 4). Va. updated to the order of at the (t + 1)-th step as
m
V (141)
Σ (1
(1) )a (1) ( 7 O(1²),
where n/ = n|r||==1? oe (1) m(t) (w) (0T x) and 7 = no
(2) la 112 are composite learning rates
3f
for casing our notation. For ReLU activation function (xx) max(0, æ), we have that T/p (1. J, therefore, considering that Softplus has similar shape as ReLU, we derive that (1)T
" = 17(0) + O(7)), where n7(9 n/|==11 ar (1) 87 (1.2(122....)) a, "(t) (w,, ( m²] In this way, the
1d-DFT of a ((++1) has the following form,
[k] (1 - (
(4)
[k]] 7 [kk).
(8)
We are now ready to study the trajectory of ((8(k)) along the training step t. Let Dyp denote the difference of phases between V notation, denote
(0)
(1) [k] and [[]b] for frequency k at the t-th step. And for ease of
(d-1)/22
AT (8)
(+)
[+]]| cos (A)
ATH
[&]] [[b]]] cos (Ap)
A7(") (9) and 7 AT (1) are approximately changed amounts for LFC and HFC of |V at the t-th step of the normal training of the network, respectively. Since the network is randomly initialized and the clean inputs z are highly concentrated in the low frequency domain, we always
where 77
study the case where 7 7(5(0) E Si) < 7(ā E Si). We now, taking Eq. into consideration, present our main theorem about 22 norm FGM perturbations as follows.
Theorem (The spectral trajectory of l2 FGM perturbation) During the training process of the two-layer neural network f(x) in Z the la norm FGM adversarial perturbation will change its ratio of LFC, T(5 E Si), at the (t + 1)-th step as follows.
AT (1) T (810) E Shh) - (5()) E Ss
T(8((-1) E Si) (6 Si) + 17(
(9)
Σ = V [k]]2
((d-1)/
(t
there will be a 11 s.t. Vt 2 t1, we have
T(8(1+1) Si) ((((() Ei).
(10)
5

---

Under review as a conference paper at ICLR 2021
Remark According to theorem | during the normal training process for randomly initialized network with LFCC-concentrated input, there will be to s.t. Vt 2 to, we have Ar, > ArA
and (g(++1) E Si) > ((8t) E if (00 St < r (00) Sh). For ReLU activa- tion function, starting with T()(0) E St) 1/2 < and AT (0) ATh + bi, we have &C
to max {0.-m-pp'ts "n H. where
minrejo.._]] 11 Besides, given such net- work trained with least to steps, there will be 1 > to such that AT( (ōth) Sn AT (t1) (B(() E E. and FGM perturbation will increase ratio of LFC for all > 4 no matter whether smaller than 1/2. Finally, if (ōth)) E si) (glz) E Sh)) for some t2 > to. this relation will hold for any t 2 f22
3.2 HIGH-FREQUENCY CONCENTRATION FOR LOG-SPECTRUM DIFFERENCE OF ADVERSARIAL EXAMPLES
In this subsection, we explore spectral trajectories log-spectrum difference (2 FGM adversarial examples
8 [
R
T k]]
[
along normal training step in Section 3.1 study their HFC-concentration phenomenon. Since
[Vf [k]] for randomly initialized network (1) has no bias towards high frequency or low fre-
quency while |æ] k-a, we adopt the following setting
(0) k R
without loss of generality and present below our result on the log speestectrum difference of the adver- sarial examples.
Theorem (Concentration of the log spectrum difference) For l2 FGM perturbations of the net- work in 11. for any k > K' > O which satisfies that R. > R there exists a t' such that
R( > R for all < l' steps of the normal training. For ReLU activation function, we have
L' 11 cos cos ( R cos( (os(
(11)
1/ 11112112
while if the initialization satisfies that R cos( (ppp)) S R cos cos(Ap(2) then cc.
The theorem shows that although ă itself can concentrate in the low frequency domain, does not concentrate dense in the low frequency domain the inputs z which obey the power law. Therefore, the log-spectrum difference (i.e. equivalent to spectrum of the ratio of the perturbation the clean data) of adversarial examples will express HFCC-concentrated phenomenon instead (Fig
3.3 MASKING HFC OF THE ADVERSARIAL EXAMPLES TO IMPROVE ROBUSTNESS
In this subsection, we compare the ratio of LFC of the adversarial perturbations 7(5 E St) and the ratio of LFC of original images T é E Si).
Theorem (Comparison on the LFC ratio of clean data and perturbations) For l2 FGM per-
turbation of the two-layer neural network in 77. the 1-th step of normal training, let (= r(@ Si) - (5 E Si) > O, then we will have ( Si) < E for all t. if the initilization of the netowrk satisfies that
AT! (0) < 7 (AT (0) + (0))
(12)

---

Under review as a conference paper at ICLR 2021
(0) Remark When both ÂTi and ATH are positive, condition 12 states that the ratio of low fre-
(0)
quency component of AT) + ATh, is smaller than that of clean data, which can be easily satisfied for randomly initialized network. The ratio of LFC of the perturbations will be less than that of clean data if the condition { is satisfied for l2 FGM perturbations during the normal train- ing process. Masking the HFC of an adversarial example æ + Å will then erase more amount of the perturbation than that of the clean data which leads to a new "not-peni tet--ertureddmuule adversarial example. As a result, one can expect the improvement for robustness of the model, as demonstrated in Section 4.3 later.
EXPERIMENT
In this section, we conduct several experiments validate our theoretical conclusions.
Setup. We use the Resnet-32 (He et al. 2016), a fully connected network as the last layer and cross entropy loss, and train all the parameters on the CIFAR- 10 dataset with Adam optimizer (Kingma & Ba 2014 We use PGD-attack with 8/ 8/255, 40 iterations and step size & = 4/255.
We supplement more experiments in Appendix too fill the gap between our theory and more com- plicated settings: we use the MSE loss and keep other conditions unchanged to resolve the discrep- ancy of loss function; experiments to support our theorems on two-layer neural network with fixed outer-layer parameters are also provided.
4.1 THE INCREASE OF LFC CONCENTRATION
In this part, we empirically verify the theorem in Section 3.1 to show that adversarial perturbations gradually concentrate more the low-frequency part the spectrum during the training process. Consider neural network with random initialization, each time before updating all the parameters of neural network, we randomly sample 100 images and apply the l2 FGM / PGD attack to them. For
each iteration in PGD attack, we calculate their ratios of LFFC and plot them in Fig. 2 It shows that the LFC ratios of the perturbations r St) are gradually increasing along the normal training.
Gloffied
0.3
0.8
0.7
58
0.8
off officn
0.3
out bw12
0.6
0.4
0.3
02
0.2
0.
756
3300
1550
338
1250
2030
(b)
Figure 2: The LFC ratio of the adversarial perturbations in the training process. (a) The attack method is 1a FGM. (b) The attack method is la PGD
Figure 3: The spectrum of adversarial perturbations. The first line the original examples in CIFAR- 10 dataset. The second line is the spectrum of the adversarial perturbations corresponding to the above images.

---

Under review as a conference paper at ICLR 2021
For sufficiently trained neural network, choose im- age, use PGD-attack to obtain its adversarial examples and perturbations, and calculate its spectrum. We randomly lect 10 images in the test set and show the original images and the spectrum of perturbations in Fig. [ We also ran- domly select 1000 images in the test set and average their spectrum show the expectation of the spectrum in Fig. 4(a) They show that the spectrum of adversarial perturba- the low-frequency domain after a sufficient training. Ortiz-Jimenez et al.) (2020) show that the distance to the boundary (margin) different fre- quency bands is heavily dependent of the distribution used for training, which also supports our claims.
(a)
(b)
tions are more concentrated
Figure 4: The expectation of: (a) the spectrum of adversarial perturbations; (b) the log -eg-ppctrum difference of ad- versarial examples.
4.2 HFC CONCENTRATION OF L.G-SPECTRRM DIFFERENCE
We first use PGD-attack to get the adversarial example of image for sufficiently trained neural network. We then make the log-spectrum of the original image and its adversarial example and calculate the difference of their log-spectrum (Fig (b) displays dissplay the expectation of the spec- trum for 1000 random images in the test set. They both show that the log-spectrum difference of adversarial examples is generally concentrated around.
Figure 5: The log-spectrun difference of adversarial examples. In each 3 3 part, the first line the original example, the adversarial example attacked by PGD in normally trained Resnet-32 and the perturbation. The second line is the log-spectrum of the original example, the log- spectructr of the adversarial example and the difference the two log-spectrum.
4.3 LOW-PASS FILTER IMPROVES ROBUSTNESS
In this part, we empirically show how low-pass filter (which filters HFC of the inputs) can improve the robustness of the model with cheat sheet in the sense that the attacker does not know the existence of the filter while the model aware of the frequency distribution of the gradient-based adversarial examples.
The procedure our low-pass filter basically has three steps: performing DFT on the inputs, then masking their high frequency components (set as 0) in the frequency domain and finally performing inverse DFT on them to give the desired inputs with only low frequency components preserved.
We evaluate two types of accuracy. One is filtering the clean images out of high frequencies and feed them into the model test accuracy, named as "no-attack accuracy". The other firstly PGD-attacking the input images in the normally trained model, and then check the test accuracy of filtered adversarial images, called "PGD-attack accuracy".
Here, use data augmentation to train the model to the best. We show the results in Fig. 6 As the cut-off increases, the no-attack accuracy gradually increases, and the PGD-attack accuracy first increases and then decreases. The highest robustness achieves 51.7% when the cut-off & 12 and
its robustness accuracy is 81.7%. And the normal accuracy (no filter, no attack) is 93.03%. We also adversarially train the model with PGD-attacks. Its normal accuracy is 79% and PGD-attack
8

---

Under review as a conference paper at ICLR 2021
accuracy is 48% without the filtering. Our low-pass filter model not only performs better on both no-attack accuracy and PGD-attack accuracy, but also does not need computationally expensive adversarial training.
100
attack
PGD attack
no attack accuracy - 61.81%
Mccuracy/rebaaleees
60
PGD attack accuracy 51.7%
15
20
cut-off
Figure 6: Normally trained model's performance and robustness after a low-pass filter with cut-off from to 22.
Theorem S provides a reasonable explanation for the above results. When the cut-off is low, filter masks most of the original image and the adversarial perturbation, both of the no-attack and PGD-attack models perform not well. When the cut-off is proper, there remains enough information of original images but little of perturbations, the PGD attacker cannot fool the model thoroughly. Therefore, with a suitable cut-off, the low-pass filter can indeed improve the model's robustness without computationally expensive adversarial training.
5 CONCLUSION
We investigate the adversarial examples through the lens of frequency analysis. Our work both theoretically and empirically clarifies the definition of log-spectrun difference of the adversarial examples in existing literature. Besides, versarial examples: l2 FGM perturbations gradually increase the concentration in the low-frequency part of the spectrum but their ratios of LFC will never exceed that of clean data during the training process over model parameters. Inspired by these findings, we find that low-pass filter can improve the robustness of the model and give a reasonable explanation for this phenomenon.
devote understanding the spectral trajectories of ad-
Future work can focus on analysis of other perturbations in the frequency domain such as FGSM and loc PGD perturbations or providing theoretical understanding of the phenomenon that the ratio of the LFC of the perturbation for adversarially trained model is much higher than that for normally trained model (Appendix D)).
REFERENCES
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee sympositm on security and privacy (sp), pp. 39-57. IEEE, 2017.
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv: 2017.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572. 2014.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 770-778, 2016.

---

Under review as a conference paper at ICLR 2021
Andrew Hyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. In Advances in Neural Information Processing Systems, pp. 125-136, 2019.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint 141.69041,,6980 2014.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint 1607.026 2016.
Alcksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:/706.000 2017.
Takeru Miyato, Andrew M Dai, and Ian Goodfellow. Adversarial training methods for semi- supervised text classification. arXiv preprint arXiv:1605.077255 2016.
Guillermo Ortiz-Jimenez. Apostolos Modas, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard. Hold me tight! influence of discriminative features deep network boundaries. arXiv preprint arXiv:2002.066: 06349, 2020.
Yash Sharma, Gavin Weiguang Ding, and Mareus A Brubaker. On the effectiveness of low frequency perturbations. In Proceedings of the 28th International Joint Conference on Artificial Intelligence, pp. 3389-3396. AAAI Press, 2019.
Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation, 23(5):828 841, 2019.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv: 1312.6131 2013.
A Van der Schaaf and JH statistics and information. Vision research, 36(17):759-27700 1996.
Hateren. Modelling the power spectra of natural images:
Haohan Wang. Xindi Wu, Zeyi Huang, and Eric P Xing. High-frequency component helps explain the generalization of convolutional neural networks. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8684-8694, 2020a.
Zifan Wang, Yilin Yang, Ankit Shrivastava, Varun Rawal, and Zihao Ding. Towards frequency-based explanation for robust enn. arXiv preprint arXiv:2005.03144 /41, 2020b.
Chaowei Xiao, Bo Li, Jun- Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adver- sarial examples with adversarial networks. arXiv preprint arXiv: 1001v 02000002600 2018.
Dong Yin, Raphael Gontijo Lopes, Jon Shlens, Ekin Dogus Cubuk, and Justin Gilmer. A fourier per- spective model robustness in computer vision. In Advances in Neural Information Processing Systems, pp. 13276 13286, 2019.
10

---

Under review as a conference paper at ICLR 2021
A PROOFS
A. PROOF OF THEOREM 1
According to (8 the update of r r(o(k]) for k-th frequency component of l2 norm FGM adversarial perturbation at the (t + 1) step is proportional to
(1 - 27
|+ - (
[k]
[|]]
cos (Appk
(13)
We adopt the following representations to see trends of cos (Apk") through the training process:
[k] c (le(e)) cos 0, (o(e)l sin 0)
[[k] : =T(k) (1a())) cos (T sin
then V (1+1)
[k]] [k]] cos A (9) will have the form of
(c(t+)) 2(1s) (1 (7()) (a() =(²)) 7/(0)
+ (00)))+)))+))
at the (1 1)-th step. At the (1 + 1) step, we have
(++1) Ar( AT (t+1) - (AT) - AT) () Ha),
(14)
which means that if AT! (t) > ATP then we must have AT(")) > ATD (t') for all t' 2 t. Besides,
there must be step which leads this condition since L3 > Hg. Let L - [f[ and
(1)) = -Dd-)/1 [k]. At the (1 + 1)-th step, the changed amount of r(ō Si) is
(1 - 27
1( ATT")
(()
(1 (L()) + Hi 7(()) (T (1) +
L H
ATR0) (810= E &Sh)) - T (8()) E
-pp(t)
(15)
E/e-1// 11/2 (++1) [x:]
If 1 > to and - (810 Sn) > (1() E si) then the above changed amount will be pos-
itive and gradient descent will increase (5 E Si) at this step. If AT (5w) E S..) ATH (0) 7 (000 Si). then gradient descent will increase (ōt0) E Sh) untill the step at which AT( ( (B(h) E Sh) 2 Art (i)) (Bth)) E si). then for any f1, we have (ōuth) e Si) >
(110 E Si).
A.2 PROOF OF THEOREM
We provide the proof for ReI.U activation function for positive eda, the case for negative is similar. The update rules of R2 at the (t + 1)-th step are
R( [t+1)2 R2(1)2 (n) R((1) cos (AIP!") (1)
R(O cos (AP! (1) (((-1) cos (Ap!! 11(11-1).
For any k > W/' > 0 with
R (0)
> R we have
R (b+122 R2 R(, (1)2
[t+
R
(t)2 (7)())
R2th cos (App REO cos (Au)")]
-12(0)2
0)) Σ (((²) (0) cos (App10) R cos (Aple))
==0

---

Under review as a conference paper at ICLR 2021
at the (t + 1) step. If R cos (Apl p cos (Ap (0)) > 0, considering the case 17
Mma for any t' and the condition that the left L.H.S of the above equation larger than 0 gives us
Eq.11 11 On the other hand, if R/g cos (Ap% (0)) R
cos (4p) (0)
O, then R > R(() for all
A.3 PROOF OF THEEREM
We consider the case for l2 FGM perturbations with 0, the case for negative fj is similar. Let the initialization of the network always satisfy the condition
L ( + (1)0 = T(8 E Si) < T( E Si) = La + Hs
(
(16)
such that r( E St) T(8(0) Si) Ç > 0. Then the (t)-th step, we can express T(8(0) S)) as follows
((
( + Ev-0 7(1)) AT (t)
((0) + ((0)
(i + H + Σx 0 17(0) (ATh)) (1P)
+ AT(
()) + Σ Ei=00 5(( (t)) 1Ei"= (((")) Lo + AT) (0)
(01) + Hi)) + Σ = 7) (2
p² =0 1) (Lx + H²) + ATI + ATp 00)
Let
4-
1-1
((()
n (1()
L Σ
H
Σ ((())
AT
AT
(0)
Σ
((t)) AT/ 10)
0==0
0"=0
p==0
then
AT (0)
T( E Si);
a a+b
c+d
AT
(0)
+ AT (0)
and
((0)
[() +a+c
((0 + H())
( + H +a+b+cto
1+ (0)
= = E Si)
1
[10] +10 ctd a+b
a+b
If
(0))
(0) + (0)
c c+6
0
a+b
a a
C
+ T
E E < T Si)
|+ [(0) + (00)
ctd
[(0] H()
AT, (0)
r( E (i)
(0)
AT < 1 + 11)
then we must have
-(810) E Si) < - E Si)
(17)
the t-th step. A stronger condition is that
A < T(ē E (()( (0) + A7
then we will have 7(5(0) E S) < 7 E Si) for all t. This condition approximately states that the Ar (0) is smaller than that of clean data.
"ratio" of low frequency component of AT(())
12

---

Under review as a conference paper at ICLR 2021
B l2 PGD PERTURBATIONS
The PGD update rule for finding perturbations of a with learning rate at step j + + is:
de ( 8(+ -BB(o.)) 800) + 5 of (a
(18)
where (O,, c) is a ball centered at 0 with radius e Euclidean space and the projection operator defined as
PB(O,))
[6]
argmin 118' -
((0.)))
Note that in this part quantities removing the step script (e.g. de and v= refers to not involving perturbations. For convenience, the same learning rate & for all steps and instead explore the update of
10 80)
(19)
5
to the order of to see trends of PGD perturbations frequency domain alongside PGD iterations since r(([k)) = [A][k)) For ease of notation, we adopt the following representations: Let Adk denote the difference of phases between [[[k] and [M] let (D) = 00/05 + 5 / where
((0) > 0 and one can drive similar results for ((0) we denote
(d-1)/2
AF( &
Oe [k] V cos (D0 and A #
Σ
R [[]][]]]]]]]]]]]]]]]]]]]]]]]]]]] cos (D
k=
k=ke+1
where 363 A=( and 3 AF) changed amounts of LFC and HFC of |x| the + 1)- th step of PGD iteration. We provide below our results on frequency spectrum of l2-norm PGD perturbations.
Theorem (The spectral trajectory of l2 PGD perturbation) At the + 1)-th step of PGD, it- eration of PGD will change the ratio of LFC of l2 norm PGD adversarial perturbation for neural as follows,
network 7 which satisfies |ōe/Ofl 2 with
1 (86) E S,, A+ (ōt) E &S))
7(ō E + 7(6 Si) + B00
(20)
Σ kk=
(d-1)/2 [
Remark If the two-layer neural network in ① is trained with at least 2 steps (h1 determined by theorem 1) such that T(V E Si) +VV Sr), then, according to theorem there exists
AF (0) AF(") (0)
jo max
0,
(21)
3
kk k=
[
L
k= 1)/2 / [{]p)
where 3 sa such that r(81+11) Si) -(80) Si) for all j > jo if -(80)
3(0,,
Si) < 7(86) E Sn).
B.1 PROOF OF THEOREM 4
At the (j + 1)-th step of PGD update for xe (J+1), if
1. p()) B(0.c) 1:
K ((+1) = (() + ai
di Σ a,o" W. W.r
vaf +
W 86) Ve/vo/+0(6))
05
05
13

---

Lemma (Dynamies of l2 Norm PGD in the Frequency Domain) If the initialization of norm de Under review as a conference paper at ICLR 2021
2. p(i) B(0,e) 1:
0e () 0s
x0+11
Valli)
[ +
Vzl0i1
In either case, the quantity (Fi(k:] is proportional to
σ de ()
Varla)
1|15(())
(x()))
de vn + 805) V V
F
of
os
since the term 50t/0f < and can be dropped. Therefore, we now consider
Of + 5(6) + 0f
2 [c] = [
Vaf [
(22)
at the (j + 1)-th step of PGD in the frequency domain to explore ratio of frequency k to the whole
frequency spectrum of perturbations
(5 x [M] + 2 55' +6)) Vaf) R
R [b)] [+]]]] cos (
(23)
PGD adversarial perturbation satisfies of (()), v O, then it will be positive at every iteration
of PGD
Similar to Eq.(15) one derive the changed amount of r(8 Si) in theorem 4 at the (j + 1)-th step and find the necessary condition.
C SUPPLEMENTARY EXPERIMENT
In this part, we present experiments models with MSE loss and two-layer neural networks with fixed outer-layer parameters in Section
C.I
MSE LOSS
We show the supplementary experiment of Section 4.1 in Fig. and Fig. S They have similar results to show that the spectrum of adversarial perturbations more concentrated in the low- low-frequency domain after a sufficient training.
Figure 7: The difference of the spectrum between original and adversarial examples. The model are trained with MSE loss.
Then we show the supplementary experiment of Section 4.2 in Fig. and Fig. 10 They have
similar results to show the log-spectrum difference of adversarial examples generally concentrated around.
In general, there is little empirical gap between MSE loss and CrossEntropy loss.
AA similar conclusion exists when (0) Vaf
14

---

Under review as a conference paper at ICLR 2021
Figure 8: The expectation of spectrum of adversarial perturbations. The model are trained with MSE loss.
Figure 9: The difference of the log-spectrum between original and adversarial examples. The model are trained with MSE loss.
Figure 10: The expectation of the log-spectrum of adversarial perturbations. The model are trained with MSE loss.
C.2 TWO-LAYER NEURAL NETWORK
We use two-layer neural networks with fixed outer-layer parameters. The input layer is of size 32 * 32 followed by a ReLU activation function, and the hidden layer is size 500 followed by sigmoid activation function. The dataset is still CIFARIO. We use random initialization and SGD optimizer without any training tricks. This setting can be used in practice and get higher than 40% test accuracy. The attack method the same the setup in Section 4
We show the LFC ratio of the adversarial perturbations during the training process in Fig 11 After sufficient training, we show the expectation of the spectrum in Fig 12(a) and the expectation of the log-spectrum difference in Fig 12(b)
(a)
(b)
Figure 11: The LFC ratio of the adversarial perturbations for two-layer neural networks in the training process. (a) The attack method is la FGM; (b) The attack method is l PGD.
15

---

Under review as a conference paper at ICLR 2021
(a)
(b)
Figure 12: For two-layer neural network, the expectation of: (a) the spectrum of adversarial pertur- bations; (Due to the large value gap between LFC and HFC, it is hard to see the trend in original result, so we show the logarithm of the result which will change the size relationship.) (b) the log-spectrum difference of adversarial examples.
D PERTURBATIONS OF PGD-ATTACE ADVERSARIAL TRAINED MODEL ARE MORE CONCENTRATED IN LFC
adversarial training is also PGD-attack with 8/255, 40 iterations and step size & = 4/255 in each training step. Then we test the ratio of IFFC of original images, perturbations attack adversarially trained model. The results are shown in Fig. [3] It shows that the LFC ratio of perturbations in PGD-attack adversarially trained model is generally higher than that normally trained model.
We do use the same setup in Section and the
normally trained model and perturbations in a PGD-
0.2
oighall images penuttert ooe normally triieed mosel
pettiibtiste uttuc adversarialy buined mode
2.5
5.
15
16.0
12.5
15.0
17.5
Figure 13: the ratio of LFC of original images, perturbations in normally trained model and per- turbations a PGD-attack adversarially trained model
16


Reviews:
[{"review_id": "s9_GLwmOeld", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper shows formally (under somewhat restricted conditions, like 2-layer NN and for \"natural images\") that adversarial perturbations mainly affect high-frequency content of the images. This is also shown empirically, and it is shown that low-pass filtering improves robustness against adversarial examples. \n\nThe core idea of the paper (low-pass filtering improves robustness against AEs) is actually old. Several methods have been proposed that in one way or another perform a low-pass filtering of the image to reduce the perturbation noise and thus improve robustness to AEs. The core idea of the paper is, therefore, not novel. That perturbations must be mainly impinging on high-frequency content is an obvious conclusion. The effect of low-pass filtering on clean image classification is also, once again, neglected. What is the value of a defense method if it decreases accuracy for clean images?\n\nBesides, the experiments are rather limited in only using CIFAR-10 (which is a subset of CIFAR) and PGD attack. The experiments are also limited insofar as a comparison is made with adversarial training, without consideration for any of the dozens other defense methods available.\n\nMinor: On p. 1 there is a sentence \"...that human can only perceive LFC.\" that sounds too categorical, it has to be rephrased.", "extra_scores": {}, "extra_text": {}}, {"review_id": "PQ6TETYyHAr", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This submission deals with understanding the gradient based adversarial examples. For this means, it analyzes the adversarial examples in the frequency domain, where it identifies that the ratio of high-frequency and low frequency parts is quite large in adversarial examples compared with the natural ones. As a result, it proposes to apply a low-pass filtering to the data that can significantly improve the model robustness. Some experiments for CIFAR-10 classification are performed to support the main conclusions.\n\n\nStrong points\nThe frequency domain perspective to analyzing adversaries is interesting and useful.\n\n\nWeak points\nSeveral assumptions are made. In particular, the assumption about the weights {a_r} being random is unrealistic. \nIt is not clear how much the accuracy can deteriorate because of low pass filtering. It would be important to show that reducing the cut-off frequency to the desired value that rejects the adversaries is not going to significantly hurt the accuracy. \nThe theoretical results and analysis relies on several assumptions. It particularly considers a very simple single-layer neural network, where the weights for the classification weights are assumed random and not learnable. The theoretical perspective is of high importance. However, the tightness of the final thresholds in Theorems 1 and 2 are not clear. There is no empirical evidence designed specifically to support the Theorems. \n\n\nSuggestions\nSpecific experiments to support the models and assumption and results in Theorem 1 and 2 would increase the value of this work.\n\n\nReproducibility\nThe code is not provided, but the details of the experiments are listed.\n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "HxBeYiYABTh", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper analyzes the frequency spectrum of adversarial perturbations during normal training. The authors show that the low frequency component (LFC) of adversarial perturbation is increasing during training, but it is not increasing fast enough, so the LFC of adversarial perturbation is not as dense as the input natural images which obey the power law. Therefore, the log-spectrum difference of adversarial examples will express a HFC-concentrated phenomenon. The authors used theory and experiments to demonstrate this point.\n\nThe theoretical analyses look correct to me and they look useful since rigorous understanding of frequency spectrum is useful to the robustness research community. However, I have the following concerns:\n\n1) This paper analyzes the frequency spectrum of normal training. Thus it aims to understand the adversarial perturbation for naturally-trained (i.e., non-robust model). The authors indeed provide an iterative equation showing how the frequency pattern changes across training, but it is only for a very specific case: the network is two-layer, trained with gradient descent algorithm, and the adversarial perturbation is FGM. As we know, the naturally trained models are very non-robust, which means that there are potentially many different ways to attack the model. If we constrain the attack direction to low/high frequency matrices, we may always be able to find a direction to attack the model. In fact, Ford et al (Adversarial Examples Are a Natural Consequence of Test Error in Noise) show that the existence of adversarial example is equivalent to test error under Gaussian noise, and therefore an adversarial perturbation that has uniform Fourier spectrum may be a valid perturbation direction (although it is not necessarily a direction computed from FGM). Therefore, I don't think the theory and experimental observation can be applied in a wide range of problems.\n\n2) I think the paper is not written very clearly. When I read the second paragraph on page 2, I found the three main contributions kind of contradicting with each other. The first point says the adversarial perturbation concentrates on the low frequency domain and the second point says it concentrates on the high frequency domain. I was only able to roughly understand it when reading page 6, the paragraph after Theorem 2. I think the authors should spend more effort to make their main point clearly delivered.\n\n3) I think the most misleading part in this paper is the claim that low pass filter improves robustness. This experiment was done by first attack the natural images on normal models, without knowing that there will be a low pass filter, and then pass the attacked images to the low pass filter. This is not consistent with the commonly used white box attack protocol, i.e., the adversary should know all the components of the model. The authors got the results by hiding the low pass filter from the adversary, and thus I think claiming the filtering improves robustness is very misleading to the readers.\n\n===============\n\nAfter author response:\nI would like to thank the authors for providing response. For the second point, I am still a bit confused about spectrum of perturbations vs log-spectrum of adversarial examples. The authors agreed that my third point was correct, i.e., the current results do not give enough insights on how to improve robustness against adversarial examples, in the real-world white box setting. Given the above reasons, I decided to keep my score.\n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "H0Zs2LvhRLz", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper proposes that applying a low pass filter on the input data improves the robustness of the model. \n•\tFiltering out the high frequency component of the signal can be very application dependent. In many applications, e.g. Time-frequency image of the signals such as radar signals or vibration signals, the high frequency component contains the information that the modeler of the DNN is seeking to model. Therefore, the authors should specify the applications in which the filtering is actually useful. Please elaborate more in what application this technique can be useful. Image processing is a very general term that may not be necessarily descriptive about the domain where the proposed technique is applicable. \n•\tCan the authors specify in the paper if the frequency dependence of the DNN depends on the structure (length and width) of the designed DNN? Is there recommendations for modelers? \n•\tCan the authors provide more details on the design of the low pass filter? Is it FIR or IIR? How do they come up with the design of the filter? \n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This work performs a frequency domain analysis on gradient-based adversarial perturbations. The authors argue that the perturbation deltas are largely concentrated in the high frequency domain and suggest a low pass filtering technique to improve the robustness of image classifiers. Reviewers raised several concerns as to how broadly applicable the given claims will hold, noting that these findings will be largely dependent on how the model was trained, what data the model is trained on, and how the adversarial perturbation will be constructed. Additionally, the proposal to apply a low pass filter to improve robustness is not new---it has been attempted in several works in the past and current consensus is this only provides improved robustness to high frequency perturbations/corruptions. As a recent example, Yin et. al. studied the robustness properties of models trained with a low pass filter and found that while robustness to high frequency noise and perturbations is improved, this procedure also degrades robustness to low frequency corruptions and perturbations. By focusing the analysis quite narrowly to restricted l2-perturbations the work is missing critical nuances that are well known in the literature studying distribution shift. This AC recommends the authors connect their analysis to the broader issue of distribution shift, for example can the theory provide understanding into how to improve robustness to both high and low frequency corruptions?
Decision: Reject