Improving Adversarial Robustness via Frequency Regularization
Authors: Binxiao Huang
Chaofan Tao
Rui Lin
Ngai Wong
Venue: Submitted to ICLR 2023 (2023)

Abstract: Deep neural networks (DNNs) are incredibly vulnerable to crafted, human-imperceptible adversarial perturbations. While adversarial training (AT) has proven to be an effective defense approach, the properties of AT for robustness improvement remain an open issue. In this paper, we investigate AT from a spectral perspective, providing new insights into the design of effective defenses. Our analyses show that AT induces the deep model to focus more on the low-frequency region, which retains the shape-biased representations, to gain robustness. Further, we find that the spectrum of a white-box attack is primarily distributed in regions the model focuses on, and the perturbation attacks the spectral bands where the model is vulnerable. To train a model tolerant to frequency-varying perturbation, we propose a frequency regularization (FR) such that the spectral output inferred by an attacked input stays as close as possible to its natural input counterpart. Experiments demonstrate that FR and its weight averaging (WA) extension could significantly improve the robust accuracy by 1.14% ~ 4.57%, across multiple datasets (SVHN, CIFAR-10, CIFAR-100, and Tiny ImageNet), and various attacks (PGD, C&W, and Autoattack), without any extra data.

Under review as a conference paper at ICLR 2023
IMPROVING ADVERSARIAL ROBUSTNESS VIA FRE- QUENCY REGULARIZATION
Anonymous authors Paper under double-blind review
ABSTRACT
Deep neural networks (DNNs) are incredibly vulnerable to crafted, human- imperceptible adversarial perturbations. While adversarial training (AT) has proven to be an effective defense approach, the properties of AT for robustness improvement remain an open issue. In this paper, we investigate AT from spec- tral perspective, providing new insights into the design of effective defenses. Our analyses show that AT induces the deep model to focus more on the low-frequency region, which retains the thape-biased representations, to gain robustness. Further, we find that the spectrum of a white-box attack is primarily distributed in regions the model focuses on, and the perturbation attacks the spectral bands where the model is vulnerable. To train a model tolerant to frequency-varyinn we propose frequency regularization (FR) such that the spectral output inferred by an attacked input stays as close as possible to its natural input counterpart. Experiments demonstrate that FR and its weight averaging (WA) extension could significantly improve the robust accuracy by 1.14% ~ 4.57% relative to the AT, across multiple datasets (SVHN, CIFAR-10, CIFAR-100 100, and Tiny ImageNet), and various attacks (PGD, C& W. and Autoattack), without any extra data.
perturbation,
INTRODUCTION
DNNs have exhibited strong capabilities in various application such as computer vision He et al. (2016), natural language processing [Dellnn et al. (2018), recommendation systems Covington et al. 20166) etc. However, researches in adversarial learning show that even well-trained DNNs are highly susceptible to adversarial perturbations [Godffllow et al. (2014); Szegedy et al. (2013).
These perturbations are nearly indistinguishable to human eyes but can mislead neural networks to completely erroneous outputs, thus endangering safety-critical application. Among various de- fense methods for improving robustness Das et al. (2018); Mao et al. (2019); Zheng et al. 2020)) adversarial training (AT) Madry et al. (2017), which feeds adversarial inputs into a DNN to solve a min-max optimization problem. proves to be effective means without obfuscated gradients prob- lems Athaaye et al. (2018). Some recent results inspired by AT are also in place to further boost the robust accuracy: Zhhng et al. a (2019) identify trade-off between standard and robust accuracies that serves as a guiding principle for designing the defenses. [Wu et al. (2020) claim that the weight loss landscape is closely related to the robust generalization gap, and propose an effective adversarial weight perturbation method to overcome the robust overfitting problem Rice et al. (2020). JJia et al. 2022) introduce a learnable attack strategy to automatically produce the proper hyperparameters for generating the perturbations during training to improve the robustness.
On the other hand, frequency analysis provides new lens on the generalization behavior of DNNs. WWang et al. (2020a) claim that convolutional neural networks (CNNs) could capture human- imperceptible high-frequency components of images for predictions. is found that robust models have smooth convolutional kernels in the first layer, thereby paying more attention to low-frequenc, information. (Yin et al. (2019) establish a connection between the frequency common corruptions and model performance, especially for high-frequence corruptions. It views AT as data augmenta- tion method to bias the model toward wwwfrequency information, which improves the robustness to figg-ffreuency corruptions at the cost of reduced robustness to low- now-frequency corruptions. Zhhag & Zhu (2019) find that AT-CNNs are better at capturing long-range correlations such as shapes, and less biased towards textures than normally trained CNNs in popular object recognition datasets. Our

---

Under review as a conference paper at ICLR 2023
findings are similar, but learn them from spectral perspective. Wang al. (020b) state that perturbations mainly focus on the high-frequency information in natural images, and low- frequency information is more robust than the high feghffreueeccy part. It is claimed that developing stronger association between wwwfrequency information with true labels makes the model robust. However, our study shows that building this connection alone cannot render the model adversarial robustness. The closest work to ours is Maiya et al. (202I), which discovers that the adversarial perturbation data-dependent and analyses many intriguing properties of AT with frequency constraints. Our research goes one step further to show that the perturbation is also model-dependent, and explains why it behaves differently across the datasets and models, Besides, we propose frequency regular- ization (FR) to improve robust accuracy.
These breakthroughs motivate us to zoom in on deeper AT analysis from spectral viewpoint. Specifically, we obtain models with different frequency biases and study the distribution of their corresponding white-box attack perturbations across different datasets. We then propose a simple yet effective FR to improve the adversarial robustness and perform validation on multiple datasets. Our main contributions are:
We find that AT facilitates the model to focus robust low- www.rreuuency information, which contains the shape-biases biased representation to improve the robustness. In contrast, simply focusing on low- frequency information does not lead to adversarial robustness.
We reveal for the first time that the white-box attack is primarily distributed in the frequencies where the model focuses on, and can adapt its aggressive frequency distribution to the model's sensitivity to frequency corruptions. This explains why white-box attacks are hard to defend.
We propose a FR that enforces alignment of the outputs of natural and adversarial examples in the frequency domain, thus effectively improving the adversarial robustness.
PRELIMINARIES
Typically, AT updates the model weights to solve the min- max saddle point optimization problem:
min TI
max L (So (x; + 6) ,3)), 18
where n is the number of training examples, x is the adversarial input within the e-ball (bounded by an Ly-norm) centered at the natural input x,, ö is the perturbation, y; is the true label, fo the DNN with weight 0, [()) is the classification loss, e.g., cross-entropy (CE).
We refer to the adversarially trained model as the robust model and the naturally trained model as the natural model. The accuracy achieved on natural and adversarial inputs is denoted as standard accuracy and robust accuracy, respectively. We define the high-pass filtering (HPF) with bandwidth k as the operation that after Fast Fourier Transform (FFT), only the k x k patch in the center (viz. high frequencies) is preserved, and all external values are zeroed, and then applies inverse FFT. Low-pass filtering (LPF) is defined similarly except that the low-frequency part is shifted to the center after FFT, to be preserved by the center x & patch as in Yin et al. (0199).
EMPIRICAL OBSERVATION AND ANALYSES
3.1 FREQUENCY ATTENTION LOW-FREQUENCY INFORMATION
Attention to the Frequency Domain. Since the labels are inherently tied with the low-frequency information Wang al.] (2020a), to maintain high standard accuracy and explore the connection between the low-frequency information and adversarial robustness, L-models) with the natural inputs after the LPF with a bandwidth 16 for multiple datasets (32 for Tiny ImageNet), cf. Table I Then, we feed natural inputs processed by LPF with different bandwidths into models to evaluate the accuracy, which reflects how much attention the models pay to low- www-freuency information. Results shown in Table
train models (denoted as
For natural models, the standard accuracy gradually increases as the bandwidth increases, indicat- ing that the models utilize both low- and high-frequency information, consistent with the findings
2

---

Under review as a conference paper at ICLR 2023
Table 1: Top-1 aceuracy(%) of natural, L.- and robust ResNet18 models. The bandwidth row denotes the LPF bandwidth (k) applied to the inputs. The higher the value, the more information retained (i.e.. 32 or 64 means no filtering). The last column shows the robust accuracy against PGD-20 attack. Bold numbers indicate the best.
Dataset
Bandwidth
8
12
16
20
24
28
32
PGD-20
Natural
49.07
83.87
94.82
95,41
95.50
95.53
95.60
95.58
0.38
SVHN
L-model
49.29
90.11
94.99
95.64
95.69
95.71
95.70
95.69
0.41
Robust
40.47
81.54
88.43
89.30
89.36
89.38
89.38
89.39
53.74
Natural
12.60
17.93
26.67
46.71
80.58
90.31
92.94
94.43
0.0
CIFAR-10
L-model
18.41
45.29
84.87
91.45
92.02
92.06
92.03
92.03
0.05
Robust
29.74
57.82
73.25
78.63
80.71
81.41
81.79
81.98
51.66
Natural
3.20
7.52
19.91
45,46
62.34
69.24
71.33
74.95
0.0
CIFAR-100
L-model
4.74
22.29
60.38
68.92
69.31
68.56
68.20
67.94
0.0
Robust
13.99
33.94
45.30
50.27
52.56
53,42
54.1
54.18
27.7
Dataset
Bandwidth
8
16
24
32
40
48
56
64
PGD-20
Natural
1.52
2.98
9.47
18.42
33,61
48.50
56.74
60.48
0.0
Tiny ImageNet
L-model
2.78
4.97
35.48
56.80
56.28
55.77
55.88
55.76
0.0
Robust
6.36
14.99
24.26
32.18
38.12
42.57
45.35
46.64
23.33
of Wang al. (2020a). SVHN is an exception. the information in this dataset mainly concen- trated in low- www-freuueccy region Bernhard et al.) (202)). So the models trained on SVHN all primarily rely on the low- low-frequency information for predictions. For L-modees, when the bandwidth increases to beyond 16 (32 for Tiny ImageNet), the standard accuracy no longer improves much, which is in line with the expectation that a model trained with low-frequency information focuses mainly on the low cow-frequency region for predictions. As for robust models, even though a large amount of high-firequncyy information is removed, there is only a negligible reduction in standard accuracy in the SVHN and CIFAR datasets. For Tiny ImageNet, the high-frequency content can further improve the standard accuracy a little, but the accuracy improvement relies mainly on low-frequency part.
Comparing the natural, L- and robust models across different datasets leads to the conclusion that AT enforces the AT-trained model to focus primarily on cow-frequeccy information. Taking the CIFAR- 10 an example, the standard accuracy (81.98) of the robust model is similar to that of the natural model at a LPF bandwidth of 20 (80.58%). Such observation indicates that the low standard accuracy of natural dataset in the robust model is due to the inder-uillization of frequecyyy components.
Robust Features in the Low-frequency Region. Although both the L-model and robust model rely on low-frequency information for predictions, the L-model has no resistance to PGD-20 (last column in Table D). suggesting that learning the low-frequency information alone does not con- tribute to robust accuracy. Besides, when the input retains limited low-frequency information, the robust model is more accurate than the natural model, and even in particularly small bandwidth (c.g., 4, 8) except for SVHN. This implies the robust model can extract useful information from the particularly low-frequency region. To explore what robust information the model is concerned with, we visualize the images after LPF with a small bandwidth of 8, the natural images, and the perturbed images of the CIFAR-I0 dataset in Fig. Other datasets show similar performance, as depicted in Appendix A.]
accurate than the L-model
At k: 8, the robust model achieves much higher standard accuracy (57.82% than the natural model (17.93% with very limited low-frequency information. Compared to natural images, the filtered images retain the outer contours, but the detailed textures are heavily blurred. And for the perturbed images, the texture of the foreground and background is disturbed, while the shapes are al- most unaffected. Indeed, Geirhos et al. (2018) show that naturally trained CNNs are strongly biased toward recognizing textures rather than shapes, which accounts for the low standard accuracy for the filtered images and their vulnerability. The robust model can maintain a certain level standard and robust accuracies, when the texture is heavily smoothed whereas the shape profile is partially preserved. This indicates that AT enables the model to learn a more Shape-biased representation, which is more human-lit like and consistent with the finding of Zhang & Zhu (2019): AT-CNNs focus more on shape information. Learning chase- features improves robustness, and ww-frrquency information preserves objects' shapes while blurring textures. Consequently, AT induces models to
3

---

Under review as a conference paper at ICLR 2023
primarily focus on low low-frequency information to learn shape-biased representation, which gains the robustness.
Figure 1: Visualization of the CIFAR-10 images after LPF with bandwidth of 8 (top), natural images (middle), and the perturbed images X+6 (bottom).
The results shown above indicate two points: 1) AT induces the model to focus more low- frequency region to learn a more shape-biased representation for improved robustness. 2) Simply paying more attention to the low-frequency region without recognizing shapes does not yield adver- sarial robustness, which explains why some data augmentation schemes applicd to the low- cow-frequency region do not lead to higher robustness Yin et al. 2019
3.2 FREQUENCY DISTRIBUTION OF PERTURBATIONS
Frequency Distribution of Perturbations. Frequency analysis provides new perspective on the understanding of network behaviors. A deep understanding of the perturbation's 's frequency distri- bution can provide new insights towards the design of effective defensive methods. Some defenses have been proposed motivated specifically by the hypothesis that adversarial perturbations lie pri- marily in the high-frequency region. However, other researches |Berhhard et al. (2021): Maiya al. (20T have refuted this hypothesis and claimed the frequency distribution is related to the dataset.
To this end, the white-box attack and analyse the frequency distribution of the perturbations. Since the generation of adversarial examples is determined by two main components, the target model and the input images, we propose a hypothesis that the frequency distribution of the perturbations is related not only to the dataset but also to the model's frequency bias. To verify this hypothesis, we take 2000 test examples to compute the average Fourier spectra of the PGD-20 attack perturbation for the natural, L- and robust models. The results are shown in Fig. 2
the PGD attack with the maximum perturbation 8/255 representative of
CIFAR-10
OFAR 100
Tity Image/ici
Figure Visualization of perturbations in the frequency domain, with low frequency the center.
4

---

Under review as a conference paper at ICLR 2023
Across the datasets, for the natural and L-models, the frequency distribution of the perturbations differ significantly. Robust models bias the perturbations towards the particular low regions, which is consistent with the observation that robust models extract more information from particularly low-frequency parts. The frequency distribution of the I--model is more concentrated in the low- frequency region compared to the natural one. There clear square contours in the CIFAR-I 1-10 and Tiny ImageNet datasets, indicating that the attacks are mainly concentrated within the central square. High-amplitude values are largely concentrated in the centre for robust models. These observations prove that the perturbation's 's frequency distribution is related to both the dataset and the model's s frequency bias. Frequency distributions of adversarial perturbations of randomly selected images across the datasets are shown in Appendix
A.4 A.4
Aggressiveness of Perturbation. To further explore the perturbation's aggressiveness of different frequency bands, apply LPF and HPF to the perturbations and then add it to the natural exam- ples to check the robust accuracy performance. The greater the drop in robust accuracy, the more aggressive the perturbation is in that spectral band. Besides, add standard accuracy curves for natural examples filtered by LPF with different bandwidth to reflect the robust model's 's attention to the low- wwwfrequency information. The results are shown Fig.
100
SVHN
CIFAR.10
CIFA-100
Thyy ImageNet
20
15 80
Natural model
Accuncot9a
82
(15)
Accunecytu
Acunscylia
B
15
30
banchhedtt
bandwidth
bandwicth
bandwidhh
Limode
Acurssyy())
Ncuaneyll 16
8
10
15
25
30
30
35
25
30
10
35
20
30
30
20
35
45
50
8.
Rotust model
%
8
8
8
Lffll
+115500 0190770 bandwitt
UTT10
Uffil LHL00)
Menchettth
bandwitth
bandarith
Figure 3: Standard accuracy and robust accuracy against PGD-20 attacks for natural, L- and robust ResNet18 models across different datasets. As the bandwidth increases, more input or perturbation information is retained.
SVHN is a unique dataset wherein the information is primarily concentrated in the low-frequency region. The models obtained on by either training method rely mainly on low-frequency in- formation for predictions. Perturbations also rely on low-frequency information to maintain their aggressiveness, while high-frequency perturbations barely degrade robust accuracy.
For the natural models of CIFAR and Tiny ImageNet datasets, whether the perturbations are pro- cessed by LPF or HPF, the robust accuracy decreases as the bandwidth increases until it reaches almost zero. It indicates that perturbations maintain their aggressiveness in both low- and high- frequency parts, which corresponds to the fact that natural models use both low- and high-frequency information for predictions. In CIFAR-10. 10, the perturbation after HPF (green curve) leads more accuracy degradation compared to LPF (orange curve) at the same bandwidth, which means the figh-frequency perturbation is ImageNet. In particular, in Tiny ImageNet, the aggressiveness of the perturbation is mainly concen- trated at low frequencies. For natural models utilizing low- and high-frequency information, why is
aggressive. The opposite is true in the CIFAR- 1-0 and Tiny
5

---

Under review as a conference paper at ICLR 2023
the distribution of perturbation aggressiveness different across different datasets? We propose sensitivity hypothesis that white-box attacks can detect spectral bands where the model sensitive and formulate the attack correspondingly.
To prove this assumption, we investigate the sensitivity models to frequency corruptions via the Fourier heat maps Yin et al. (2019) shown in Fig. 4 The definition is described in Appendix A.. A high error rate means that the model is vulnerable to the attacks with the corresponding frequency. The first of Fig. 4 shows the Fourier heat maps of natural models across different datasets. The CIFAR-10 10 and CIFAR- 100 are sensitive to the low- and high-frequency perturbations, which is con- sistent with the phenomenon that the perturbations after LPF or HPF can significantly degrade the robust accuracy. Tiny ImageNet is much more vulnerable to the low-frequency perturbations, which corresponds to the fact that perturbation aggressiveness mainly concentrated at low frequencies. These phenomena validate our assumption: white-box attacks can detect model-sensitive band of the spectrum and attack it.
SVHN
CIFAR-10
CIFAR-100
Tiny ImageNer
Natural model
04
00
L-model
Robust model
Figure 4: Error rate of models the images perturbed with the spectral perturbations. We evaluate three models on Four datasets. e is the norm the perturbation. The high error rate represents the high sensitivity to the spectral noise.
For the L-models shown in Fig. 3 which extract information from the low-frequency region, the perturbation relies heavily on low-frequency information to ensure the success of attacks. As for the robust models, there is somewhat symmetry between the red and orange curves. In the CIFAR dataset, the model relics mainly on low-frequency information for predictions, and the perturbation similarly relies low-frequency parts degrade the robust accuracy. For the Tiny ImageNet dataset, the model can improve standard accuracy by small margin with the help of high-frequency information. There is a small decrease in robust accuracy both the high bandwidth region for LPF and the low bandwidth region for HPF of the perturbation, indicating that the perturbation is somewhat aggressive high frequencies. The aggressive frequency distribution of the perturbations basically corresponds to the model's attention to the frequency domain. The L-models and robust models are sensitive the low-frequency perturbations shown in the 2nd and 3rd rows of Fig. which again concurs with our sensitivity hypothesis.
Comparing the Fourier heat maps of the natural and robust models on multiple datasets, it can be concluded that the robust model is less sensitive to spectral perturbations. This suggests methods that reduce the model's sensitivity to frequency corruptions should help improve adversarial robustness. Based on the above experiments, we claim that the white-box attacks primarily distributed in the frequency domain where the model attends to, and can adjust their aggressive frequency distribution according the model's sensitivity frequency corruptions. In short, the white-box attacks can strike the frequency regions where the model's 's defenses are weak. Indeed, this is a first-ever spectral perspective to explain why white-box attacks hard defend.

---

Under review as a conference paper at ICLR 2023
4 FREQUENCY REGULARIZATION
Although AT improves robustness, there is still large gap between standard and robust accuracies. Kannan et al. (2018) propose ad adversarial logit pairing that forces the logits of paired natural and adversarial examples to be similar. Zhhag et al., (2019) utilize the classification to minimize the difference between the prediction of natural and adversarial inputs, [Bernhard et al. (202T) apply LPF and HPF to the inputs, and then minimize the output difference between natural and filtered inputs. (aac al. 2202 improve the robustness by foreing the predictive distributions after attacking from two different augmentations of the same input to be similar.
loss
For the first time in literature, we have demonstrated in Section 3.2 that the frequeney distribution of a perturbation is related to both the dataset and model, which is not a simple low- or eigh-freuencc phenomenon, and the white-box attack can adapt its aggressive frequency distribution to the target model. Intuitively, a natural idea is to drive the model to limit or tolerate this spectral difference between the outputs subject to a natural input and its adversarial counterpart, and to achieve similar frequency domain outputs for both types of imputs. By updating the weights through the back- propagation mechanism, this constraint makes the model extract similar spectral features from the adversarial inputs the natural inputs. Then the robust accuracy will gradually approach the stan- dard accuracy and thus be improved. To achieve this goal, we devise simple yet effective frequency regularization (FR) to align the difference of the outputs between the natural and adversarial inputs in the frequency domain, as shown in Fig.
[ The optimization goal of the proposed AT with FR is:
1 Σ (is() F(22(x; + 6))),
LAT = LCE + A
[=1
where A (defaulted 0.1) denotes the FR coefficient, f1. f2 are the DNNs (same model for the basic FR) and f2 is used for prediction, Dis denotes the distance function (L1 norm is used), LCE is the Cross-Entropy loss and F denotes FFT. The distance function is applied to the real and imaginary parts of the complex numbers after FFT, respectively, and the results are summed. FR consists of two branches, one dealing with natural inputs and the other with adversarial inputs. Because the standard accuracy is higher than the robust accuracy, it may reduce the standard accuracy while increasing the robustness. To control the degradation of standard accuracy while maintaining robustness, we need to find the proper model to handle natural inputs.
Weight averaging (WA) Izmailov et al. (2018) depicted in Appendix A.3 which averages the weight values over epochs along the training trajectory, proves to be effective means to improve the generalization of models. In AT, it could be combined with other methods Gowal et al. (2020): Chen al. (2020) mitigate the robust overfitting problem Rice et al. (2020). These works use WA to generate the final model for evaluation. During AT, the WA model maintains a similar standard and robust accuracies the current training model, and its weights are fixed. If we utilize the WA model to deal with natural inputs, the branch of FR/WA processing natural inputs (cf. WA branch in Fig will not update the weights force the standard accuracy approach the robust accuracy. Therefore, instead of using the WA model for the final evaluation, we utilize the WA model to deal with natural inputs. In simple terms, we replace the fi model in Eqn. 2 with the WA model generated during AT.
5 EXPERIMENTS
Datasets. Without loss of generality, we select four common image datasets: SVHN Netzer et al. (011). 100 CIFAR-100 Krizhevsky et al. (2009) and Tiny ImageNet. We apply 4-pixel padding with 32 x 32 random crop (not for SVHN and Tiny ImageNet) and random horizontal flip (not for SVHN) for data enhancement. All natural images are normalized to J0, 1]. SVHN, CIFAR- 10, and CIFAR- 100 image resolution is 32 x 32 x 3, corresponding to the length, width, and channel, respectively. Tiny ImageNet image resolution is 64 x 64 x 3.
Experimental Settings. We take 18 as a default model and adopt a SGD optimizer with a momentum of 0.9 and a global weight decay of 5 x 10-4, The model is trained with PGD-10 for 100 (30 epochs with a batch size of 128 on one 3090 GPU. The initial learning rate is 0.1 (0.01), which
'The numbers in brackets the hyperparameters for SVHN.
7

---

Under review as a conference paper at ICLR 2023
FR
FR/WA
Cross Entropy
dis(T(s,))
dis(T(,)))
Logits
Logits
Logits
Logits
Logits
Model
Model
WA
Model
Troe Labels
1
+
+6
+
Forward
Forward and Back Propagation
Figure 5: An overview of the standard AT, the proposed FR, and its WA extension. 8 denotes the perturbation, F denotes the FFT, dis denotes the distance function.
decays one-tenth at 75th (15th) and 90th (25th) epochs, respectively. The robust accuracy of the PGD-20 attack equipped with a random-start is taken as the main basis for robustness analysis. The attack step size is 2/255 and maximum Loo norm-bounded perturbation
8/255. FR and WA are used since the first epoch where the learning rate drops, and continues until the end with a cycle length We also show our method is suitable for large-scale models in Appendix A.5
Evaluated Attacks. The model with the highest robust accuracy against PGD-20 is selected for further evaluation. To avoid false sense security caused by the obfuscated gradients, we evaluate the robust accuracy against several popular white-box attack methods, including PGD Madry et al. (2017), C&W Carlini & Wagner (017), and AutoAttack [Coce & Hein (2020) (denoted AA, consists of APGD-CE, APGD-DLR, FAB, and Square). Following the default setting of AT, the attack step size is 2/255, and the maximum lo norm-bounded perturbation 8/255.
5.1 ABLATION STUDIES
Distance Function in FR. For the distance function defines in Eqn. 2 there are three frequently used methods, including &i norm, Le norm, and cosine similarity. We measure their performance on CIFAR-10. 10. For fair comparison, the different distance functions, respectively. As shown in Figs. and 6(b) in terms of improving robustness, L1 norm is more effective at the expense of a slightly reduced standard accuracy.
the same checkpoint from the 74th epoch and then apply
CHAN-32
Q1AR10
CIM8--10
03.0
52.5
020
6,65
03
0.15
(a) Standard Accuracy
(b) Robust Accuracy
(c) SA & RA
Figure 6: Ablation of distance functions and coefficient X on 10. SA and RA denote the standard and robust accuracy. (a) and (b) show the SA and RA of different distance functions, represents the standard AT without FR. (c) shows the impact of À on SA and RA.
Sensitivity to Regularization Coefficient. We further investigate the impact of the parameter À in FR defined in Eqn. 2 which modifies the strength of the regularization. The results for different [0, 0.2) are shown Fig. 6(c). 0 represents the standard AT. Results show a trade-off between the standard and robust accuracies when the À is within a proper limit [0, 0.1]. When À is outside this range, FR dominates the loss function, resulting overall decrease in accuracy.
8

---

Under review as a conference paper at ICLR 2023
Table Top-1 robust accuracy against diverse attacks with maximum (x norm norm-bounded pertur- bation c 8/255 of ResNet18 8 models. Bold numbers indicate the best on different datasets.
Dataset
Method
Clean
PGD-20
PGD-50
C&W W
PGD-AT
90.88
53.28
52.26
50.62
47.57
SVHN
AT+FR
90.43
56.87
56.29
51.89
49.46
AT+FR/WA
90.49
56.95
56.35
51.76
49.36
PGD-AT
81.98
51.69
51.46
50.44
48.19
CIFAR-10
AT+FR
80.04
55.39
55.13
51.61
50.02
AT+FR/WA
81.74
55.12
54.88
52.21
50.16
PGD-AT
54.18
27.81
27.49
25.82
23.77
CIFAR-100
AT+FR
49.23
31.27
31.20
27.60
26.09
AT+FR/WA
53.66
31.49
31.36
28.24
26.06
PGD-AT
46.64
23.33
23.18
20.44
18.34
Tiny ImageNet
AT+FR
42.92
25.32
25.25
21.35
19.71
AT+FR/WA
46.55
25.64
25.47
21.90
19.64
Table 3: Top-1 robust accuracy(S0) %) of the WideResNee-34-10 model on the CIFAR-10. Bold num-
bers indicate the best.
Method
Clean
PGD-20
PGD-50
C&W
AA
PGD-AT Rice
(2020)
84.62
55.01
54.88
53.32
51.42
TRADES Zhang et al (2019)
84.92
56.33
56.13
54.20
53.08
MART Wang et al. 20199
84.17
58.56
58.06
54.58
51.10
AWP Wu et al. (2020)
85.57
58.14
57.92
55.96
54.04
A1 + FR (ours)
82.66
59.38
59.15
55.72
54.33
AT + FR/WA (ours)
84.57
59.27
58.90
56.92
54.80
5.2 EXPERIMENTAL RESULTS AND ANALYSES
Superior Performance across Datasets. As shown in Table we incorporate the FR and FR/WA into AT to improve the robustness against various attacks on multiple datasets. In particular, for AT, the FR/WA version relatively improves 3.27% and 1.84% of robust accuracy on average against the PGD-20 and AA, respectively, with a much smaller degradation (0.31%) %) in standard accuracy. These results indicate that our methods are versatile across various datasets. Experiments in Appendix A.66 indicate the FR and FR/WA can be plugged into other defenses to further improve the robustness.
Benchmark with Other Defenses. Table further compares the impact of FR with famous de- fenses (details of the defenses reviewed in the Appendix A.7) the CIFAR-10 dataset. Wide ResNet-34-1 10 Zagoruyko & Komodakis (2016) the popular model for comparison. The results show that the FR and FR/WA substantially improve robust accuracy compared to the AT and outper- form other defenses. Besides, FR/WA improves robustness while maintaining standard accuracy.
CONCLUSION
This work explores the appealing properties of adversarial perturbation and AT from a spectral lens. We find that AT renders the model more focused shape-biased representation in the low- frequency region to gain robustness. Using systematic experiments, we show for the first time that the white-box attack can adapt its aggressive frequency distribution the target model's sensitivity to frequency corruptions, making it hard to defend. To enhance tolerance to frequency-varyinn perturbations, we further devise a frequency regularization (FR) to align the outputs with respect to natural and adversarial inputs in the spectral domain. Experiments show that FR can substantially improve robust accuracy without extra data. It believed these novel insights can advance our knowledge about the frequency behavior of AT and shed more light robust network design.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense se- curity: Circumventing defenses adversarial examples. In International conference on machine learning, pp. 274-283, PMLR, 2018.
Rémi Bernhard, Pierre-Alain Moëllic, Martial Mermillod, Yannick Bourrier, Romain Cohendet, Miguel Solinas, and Marina Reyboz. Impact of spatial frequency based constraints adversarial robustness. 202/ International Joint Conference on Neural Networks (IJCNN), pp. 1-8. IEEE, 2021.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pp. 39-57. IEEE, 2017.
Tianlong Chen, Zhenyu Zhang, Sijia Liu, Shiyu Chang, and Zhangyang Wang. Robust overfitting may be mitigated by properly learned smoothening. In International Conference Learning Representations, 2020.
Paul Covington, Jay Adams, and Emre Sargin. Deep neural networks for youtube recommendations. In Proceedings of the 10th ACM conference on recommender systems, pp. 191-198, 2016.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pp. 2206- 2216. PMLR. 2020.
Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Fred Hohman, Siwei Li, Li Chen, Michael E Kounavis, and Duen Horng Chau. Shield: Fast, practical defense and vaccination for deep learn- ing using jpeg compression. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pp. 196- 204, 2018
Jacob Devlin, Ming-Was Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint 1xXi::1810004805 2018.
Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias im- proves accuracy and robustness. arXiv preprint urXiv:1811.122331 2018.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.660 2014.
Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593, 2020.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 770-778, 2016.
Pavel Izmailov, Dmitrii Podoprikhin, Timur Garipov, Dmitry Vetrov, and Andrew Gordon Wil- son. Averaging weights leads to wider optima and better generalization. arXiv preprint veXiv:1803.083 2018
Xiaojun Jia, Yong Zhang, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. Las-at: Adversarial training with learnable attack strategy. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.
2022.
Harini Kannan, Alexey Kurakin, and Ian Goodfellow. Adversarial logit pairing. arXiv preprint 1803v31803.06373, 2018
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint 17X6:170060668. 2017.
10

---

Under review as a conference paper at ICLR 2023
Shishira R Maiya, Max Ehrlich, Vatsal Agarwal, Ser-Nam Lim, Tom Goldstein, and Abhinav Shri- vastava. A frequency perspective of adversarial robustness. arXiv preprint arXiv:211 2021.
Chengzhi Mao, Ziyuan Zhong, Junfeng Yang. Carl Vondrick, and Baishakhi Ray. Metric learning for adversarial robustness. Advances in Neural Information Processing Systems, 32, 2019.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
Leslic Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In International Conference Machine Learning, pp. 1193-8104, PMLR, 2020.
Christian Szegedy, Wojeiech Zaremba, Ily Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.66 6199, 2013.
Jihoon Tack, Sihyun Yu, Jongheon Jeong, Minseon Kim, Sung Ju Hwang, and Jinwoo Shin. Con- sistency regularization for adversarial robustness. Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pp. 8414-8422 2022.
Haohan Wang, Xindi Wu, Zeyi Huang, and Eric P Xing. figh-frequency component helps explain the generalization of convolutional neural networks. Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 8684-8694 2020a.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations, 2019.
Zifan Wang, Yilin Yang, Ankit Shrivastava, Varun Rawal, and Zihao Ding. Towards frequency-based explanation for robust cnn. arXiv preprint 2001:1 2020b.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust gener- alization. Advances in Neural Information Processing Systems, 33:2958-2961 2020.
Dong Yin, Raphael Gontijo Lopes. Jon Shlens, Ekin Dogus Cubuk, and Justin Gilmer. A fourier perspective on model robustness in computer vision. Advances in Neural Information Processing Systems, 32, 2019.
Sergey Zagoruyko and Nikos Komodakis. arXiv: 1605.07144 2016.
Wide residual networks.
arXiv preprint
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pp. 7472-7482. PMLR, 2019.
Tianyuan Zhang and Zhanxing Zhu. Interpreting adversarially trained convolutional neural net- works. In International Conference on Machine Learning, pp. 7502-7511. PMLR, 2019.
Haizhong Zheng, Ziqi Zhang, Juncheng Gu, Honglak Lee, and Atul Prakash. Efficient adversarial training with transferable adversarial examples. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 1181-1190, 2020.

---

Under review as a conference paper at ICLR 2023
A
APPENDIX
A.1 VISUALIZATION OF THE FILTERED, NATURAL AND PERTURBED IMAGES FROM DIFFERENT DATASETS.
5
2
5
3
5
1
2
5
3
5
5
5
Figure 7: Visualization of the SVHN images after LPF with bandwidth of 8 (top), natural images
X (middle), and the perturbed images X+Ō (bottom).
X-6
Figure 8: Visualization of the CIFAR-100 images after LPF with bandwidth of 8 (top), natural images X (middle), and the perturbed images X+o (bottom).
Figure 9: Visualization of the Tiny ImageNet images after LPF with a bandwidth of 8 (top), natural images (middle), and the perturbed images X+8 (bottom).
12

---

Under review as a conference paper at ICLR 2023
A.2 FOURIER HEAT MAP
Fourier heat map provides a perturbation analysis method to investigate the sensitivity of models to the frequency corruptions. More precisely, U2,5 E RRd xd2 be a real-valued matrix such that ||Ut,112 = 1, and F FUU()))) only has up to two non-zero elements located at (i and its symmet- ric coordinate with respect to the center. These matrices are denoted as 2D Fourier basis matrices.
Given a model, we can generate the perturbed image = X + reU:,j from the natural image X, where r is chosen uniformly at random from {-1,1}, and is the norm magnitude of the pertur- bation. For multi-channel images, we perturb every channel independently. We can then calculate the eπror rate of the model under Fourier basis noises and visualize how the error rate changes as a function of the spectral indices. The visualization result is called a Fourier heat map. In this paper, We move the low-frequency region to the center of the image. high error rate means the model vulnerable to attacks with the corresponding frequency.
A.3 WEIGHTT AVERAGING
Following the definition Izmailov et al. (2018), the equation of WA is:
W 1 x l: + W
W
k +
where is denotes the number of past checkpoints to be averaged, n denotes the index of the epoch during the training, W denotes the weights of the WA model at n-th epoch, W denotes the current model's weights. In this paper, The WA model is viewed as a teacher dealing with the natural inputs, and the model that we evaluate the accuracy is viewed as a student. We hope the teacher (WA) helps the student extract useful information from the perturbed images, and we evaluate the robustness of the student model not on the teacher (WA) model.
A.4 ADVERSARIAL PERTURBATIONS AND SPECTRAL DISTRIBUTION
Figures TO 13 show the natural images, adversarial images, and the spectral distribution (low fre- quency in the center) of the perturbations across the datasets. denotes the natural images, &am- 6tm and 8rm denote the PGD-20 attack perturbations generated according to the natural, L- and robust models, respectively. FFT denotes the Fast Fourier Transform. Jet color map is used to highlight perturbations for clear visualization. For the natural models, the perturbations are jum- ble of noise points within the picture and have large magnitudes in the high-frequency region. The perturbations for the adversarial models are significantly more ordered and mainly concentrated in the low-frequency region. These visualizations prove that the adversarial perturbation is not simple nigh-frequency phenomenon and is model- and detaset-dependent.
4
4
5re
FFT(O..)
Km0m
FFTIOw))
X+0m
FFTLO..)
Figure 10: Visualization of the natural and perturbed images SVHN.
13

---

Under review as a conference paper at ICLR 2023
FFT(0.))
5FT10m)
Figure 11: Visualization the natural and perturbed images on CIFAR- 10.
5ie
(TT6
X
FFT16..)
x16...
(TTI
Figure 12: Visualization of the natural and perturbed images on CIFAR-100.
A.5 LARGE ARCHITECTURE
To prove the effectiveness of the FR and FR/WA blocks large models, we trained the 52 and Wide ResNet-34-15 on the CIFAR- 10 dataset. The results are shown in Table For reference, R and Wide ResNet-34- have parameter count of 11. 17.1 and 46. 46.146.66 160M, respec- tively. For large models, FR and FR/WA can still improve the model's robustness against multiple attacks relative to the standard AT, proving that the proposed methods are suitable for large models.
A.6 MORE COMPARISONS WITH FR
Experimental setup: For fair comparison, all experiments adopt the same data augmentation method: 4-pixel padding with 32 x 32 random crops (not for SVHN and Tiny ImageNet) and ran- dom horizontal flip (not for SVHN). All natural images Regularization (FR) coefficient is set to 0.1 for SVHN and CIFAR datasets, and 0.05 for Tiny Ima- geNet. The training set was randomly divided into the training and the validation set according to the ratio of 9:1. We select the model with the highest robustness against PGD-20 attacks on the validation set for further evaluation against other popular attacks.
normalized
[0, 1]. The Frequency
Effectiveness across the datasets and methods: We provide the thorough performance compari- of AT+FR and other methods ResNet18 in Table Since the FR and FR/WA are plug-and-
14

---

Under review as a conference paper at ICLR 2023
FFT(D.))
5FT10m)
Figure 13: Visualization the natural and perturbed images on Tiny ImageNet.
Table 4: Top-1 accuracy($e (%) of various models on the CIFAR-10, #number indicates the parameters. Bold numbers indicate the best.
model
Method
Clean
PGD-20
PGD-50
C&W
AT AT FR AT FR/WA
84.60
54.62
54.44
52.86
50.87
R5sNet152
81.11
57.76
57.70
54.74
53.32
# 18, 156,618
84.62
57.55
57.50
55.63
54.10
AT
86.66
35.79
55.49
54.58
52.76
Wide ResNet-34-15 # 103,819,674
AT FR AT + FR/WA
84.35
58.33
58.03
55.75
54.12
86.18
57.97
57.78
55.25
53.50
play blocks, we also apply them popular techniques (detailed experimental settings are depicted in Appendix (.7)) to prove their effectiveness. Experimental results demonstrate that FR can be plugged into these popular methods further improve robustness. Besides, FR/WA can maintain similar standard accuracy as AT while improving robust accuracy. The improvement is non-trivial since some papers have claimed a trade-off between the standard and robust accuracy.
Table 5: Top-1 accuracy(%) of the ResNet18 model on the SVHN. Bold numbers indicate the best.
Method
Clean
PGD-20
PGD-50
C&W
AA
AT
90.88
53.28
52.26
50.62
47.57
AT + FR
90.43
56.87
56.29
51.89
49.46
AT FR/WA
90.49
56.95
56.35
51.76
49.36
TRADES
89.04
55.71
55.48
51.48
50.03
TRADES + FR
87.23
56.96
56.73
52.64
51.26
TRADES FR/WA
88.76
57.01
56.76
52.53
51.18
MART
88,67
56.78
56,40
50.03
47.75
MART + FR
86.42
57.87
57.52
50.65
48.74
MART + FR/WA
88.53
57.58
57.26
50.42
48.58
AWP
89.12
53.85
53.23
49.84
47.05
AWP FR
86.63
55.64
55.33
50.83
49.53
AWP + FR/WA
88.73
55.32
55.11
50.68
49.37
15

---

Under review as a conference paper at ICLR 2023
Table 6: Top-1 accuracy($) of the ResNer18 model the CIFAR-10. Bold numbers indicate the best.
Method
Clean
PGD-20
PGD-50
C&W
AA
AT
81.98
51.69
51.46
50.44
48.19
AT + FR
80.04
55.39
55.13
51.61
50.02
AT FR/WA
81.74
55.12
54.88
52.21
50.16
TRADES
81.83
53.41
53.23
50.92
49.84
TRADES FR
80.11
54.45
54.24
51.51
50.52
TRADES + FR/WA
81.76
54.14
54.06
51.31
50.38
MART MART FR
81.01
54.58
54.47
50.01
48.10
79.03
55.17
54.90
50.98
49.22
MART + FR/WA
80.80
55.01
54.78
50.12
48.78
AWP AWP + FR AWP + FR/WA
81.06
55.36
55.27
51.98
50.37
79.03
57.07
57.01
52.16
50.80
80.87
56.81
56.82
52.14
50.61
Table 7: Top-1 accuracy(%) of the ResNet18 model on the CIFAR-100. Bold numbers indicate the best.
Method
Clean
PGD-20
PGD-50
C&W
AA
AT AT FR AT + FR/WA
54.18
27.81
27.49
25.82
23.56
49.23
31.27
31.20
27.60
26.09
53.66
31.49
31.36
28.24
26.06
TRADES
56.24
28.48
28.40
24.71
23.77
TRADES + FR
55.57
30.08
29.95
25.93
25.05
TRADES + FR/WA
56.59
30.22
30.20
26.81
25.37
MART
51.23
29.66
29.55
25.88
24.27
MART + FR
49.33
31.03
30.87
26.78
25.07
MART FR/WA
50.72
31.75
31.68
27.32
25.46
AWP
54.71
30.88
30.69
27.87
25.74
AWP + FR
48.92
31.90
31.73
28.02
26.10
AWP + FR/WA
55.78
31.75
31.60
28.84
26.64
A.7 DETAILED SETTINGS FOR POPULAR DEFENSES
TRADES Zhang al. 2019)):
decomposes the robust error the sum of the natural error and the boundary етror and encourages the algorithm to push the decision boundary away from the data improve the robust accuracy. The overall loss function shown as follows:
CAT CE(((x),
(L(f(x)) ())
CE denotes the Cross Cross-Entropy loss, KL denotes the Kullback-Leibe divergence generated by PGD-10, 8 denotes the adversarial perturbations, fxx denotes the probability predicted by the model, denotes the true label, X is the coefficient to balance the CE and KT. loss. Following the default setting in TRADES, batch size 128. The model is trained for 100 (30 epochs on one 3090 GPU, The initial learning rate is 0.1 (0.01), which decays one-tenth 75th (15th) and 90th (25th) epochs, respectively. The in Eqn. 5 is set to 6.
adopt SGD with momentum 0.9, weight decay 2 x 10-1, and
MART Wang et al. (011); Based on standard AT, it explicitly differentiates the misclassified and correctly classified examples during the training and adds misclassification- -ware regularization to the standard adversarial risk to achieve better robustness. The overall loss function is shown as
follows:
LAT BCE(f(2 6).9) + {L(f()))ff(z +)) (1- f(x))
(5)
TThe numbers in brackets the hyperparameters for SVHN.
16

---

Under review as a conference paper at ICLR 2023
Table 8: Top-1 accuracy(%) of the ResNet18 model on the Tiny ImageNet. Bold numbers indicate the best.
Method
Clean
PGD-20
PGD-50
C&W
AA
AT AT + FR
46.64
23.33
23.18
20.44
18.34
42.92
25.32
25.25
21.35
19.71
AT FR/WA
46.55
25.64
25.47
21.90
19.64
TRADES
48.33
22.77
22.71
18.89
17.95
TRADES FR
46.61
23.79
23.72
19.97
18.99
TRADES + FR/WA
48.94
24.81
24.73
20.21
19.34
MART MART FR
45.39
24.17
24.09
20.07
18.49
43.35
25.35
25.31
20.63
19.31
MART + FR/WA
44.79
25.83
25.80
21.53
19.44
AWP AWP + FR AWP + FR/WA
46.49
24.76
24.59
21.04
19.11
44.93
24.98
24.90
21.54
19.52
46.32
24.86
24.77
21.32
19.38
BCE denotes the binary Cross-Entropy loss, Following the default setting in MART, we adopt SGD with momentum 0.9, weight decay 2 10-4, and batch size 128. The model is trained for 100 (30) epochs on one 3090 GPU. The initial learning rate is 0.1 (0.01), which decays to one-tenth at 75th (15th) and 90th (25th) epochs, respectively. The À in Eqn. 5 is set 6.
AWP Wu et al. 2020 It identifies the connection between the weight loss landscape and the robust generalization gap, proposes adversarial weight perturbation to directly make the weight loss landscape flat, and develops double perturbation (adversarially perturbing both inputs and weights) mechanism in the AT framework. Following the default setting in AWP, we adopt SGD with mo- mentum 0.9, weight decay 5 x 10-4, and batch size 128. The model trained for 200 epochs on two V100 GPUs. The initial learning rate is 0.1 (0.01), which decays to one-tenth at 100th and 150th epochs, respectively.
17


Reviews:
[{"review_id": "luS4lQhYBIC", "reviewer": "Reviewer_q8SJ", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors investigate AT from a spectral perspective and show that AT induces the deep model to focus more on the low-frequency region.\nThey find that the spectrum of a white-box attack is distributed in regions the model focuses on. They propose a frequency regularization such that the spectral output inferred by an attacked input stays close to its natural input. ", "summary_of_the_review": "Please see the comments above.", "strength_and_weaknesses": "Strength\n1-- The paper is well-written.\n2-- The paper studies an important problem.\n3-- The proposed method is explained clearly.\n\nWeaknesses:\n1--It is well known in the literature that adversarial perturbations are targeting high-frequency. \n2-- The proposed training does not provide major new findings.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "lCuuhxlCBl", "reviewer": "Reviewer_5QQs", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper hypothesizes that \"the white-box attack can adapt its aggressive frequency distribution to the target model’s sensitivity\nto frequency corruptions\". Empirical investigations are illustrated in Fig. 2/3/4 to support the hypothesis. \n\nBased on these observations, authors then introduces a frequency regularization (FT) to enforce \"the model extract similar spectral features from the adversarial inputs as the natural inputs\". Experimental results in Tab. 2./3 indicate the effectiveness of the proposed method. ", "summary_of_the_review": "+ Overall the paper is well-organized and easy to follow.  \n\n+ Empirical investigation about the hypothesis is interesting and clearly illustrated in Fig. 2/3/4. \n\n- The proposed FT seems not as effective as it should be. \n\n    a. Improvements shown in Tab. 2/3 are only marginal, not substantial as the paper claimed.   \n\n    b. Experiments are rather limited (Tab. 2 only compare the proposed method with PGD-AT; Tab 3 only test WideResNet on CIFAR10), why not report thorough comparison results with more models / datasets / against all previous methods?\n\n- The proposed FT in (2) is probably not a wise choice: \n\n   a. naively minimizing L1 distance between frequency domain responses of natural and adversarial inputs  did not capture the notion of model vulnerability. Instead, distribution-based divergence is probably more appropirate. \n\n   b. even if the proposed FT enforces the model extract similar spectral features, PGD-AT and other attacks may still exploit the remaining model vulnerability.  Authors need to investigate failure cases and show what type of perturbations attacks may still constructed; \n\nI'd like to see more convincing results to demonstrate how to turn the interesting finding into an effective defending approach in follow up work. \n", "strength_and_weaknesses": "\n+ Overall the paper is well-organized and easy to follow.  \n\n+ Empirical investigation about the hypothesis is interesting and clearly illustrated in Fig. 2/3/4. \n\n- The proposed FT seems not as effective as it should be. \n\n    a. Improvements shown in Tab. 2/3 are only marginal, not substantial as the paper claimed.   \n\n    b. Experiments are rather limited (Tab. 2 only compare the proposed method with PGD-AT; Tab 3 only test WideResNet on CIFAR10), why not report thorough comparison results with more models / datasets / against all previous methods?\n\n- The proposed FT in (2) is probably not a wise choice: \n\n   a. naively minimizing L1 distance between frequency domain responses of natural and adversarial inputs  did not capture the notion of model vulnerability. Instead, distribution-based divergence is probably more appropirate. \n\n   b. even if the proposed FT enforces the model extract similar spectral features, PGD-AT and other attacks may still exploit the remaining model vulnerability.  Authors need to investigate failure cases and show what type of perturbations attacks may still constructed; \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "QtpVDCS3WHP", "reviewer": "Reviewer_DY1G", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "Based on the fact that adversarial perturbations are mainly on high-frequency part, this paper propose a regularization term to align the frequency response of natural and adversarial samples. ", "summary_of_the_review": "The motivation of introducing frequency regularization is not surprising. But the performance is indeed good. I hope I could receive additional explanation or result for the questions I raised above. ", "strength_and_weaknesses": "strength:\n+ as far as I know, the proposed method that aligns frequency domain response is novel. \n+ in numerical experiments, the frequency regularization shows advantages over other methods.\n\nweakness:\n- it is well known and can be understood that adversarial perturbations are mainly on high-frequency part. Thus, it is not necessary to provide toy examples for this point, i.e., Section 3.2 could be largely reduce.\n- some researchers think that it is better to use more flexible model for AT, since essentially we have two distributions to fit. In this point of view, it is better to enhance the flexibility, not to restrict it by regularization. Maybe for small model, regularization helps but for large model it becomes useless. I would like to know the opinion of the authors and if there are additional experiments on large model, it will be great. \n- AT is actually a trade-off between natural and adversarial samples. I notice that the proposed method generally has lower clean accuracy, from which it follows a question: how about the robustness when the clean accuracy is similar. Then the comparison could be more interesting. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "QQExws9Swt", "reviewer": "Reviewer_j5uT", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper observes that AT [1] focuses on the low-frequency area to achieving adversarial robustness. It empirically shows that white-box attack corrupts the high frequency domain. Authors propose Frequency Regularization (FR) which applies a regularization in the frequency domain with AT.", "summary_of_the_review": "Authors empirically shows model trained by AT focuses on the low-frequency region for adversarial robustness and propose the Frequency Regularization. Attempts to explain adversarial learning in the frequency domain seem very interesting. But, it seems that the comparison with other competitors is not fair and empirical results are marginal. ", "strength_and_weaknesses": "\n\nStrength\n\n- This paper describes the vulnerability of the neural network model against the white-box attack in terms of frequency distribution.\n- The new regularization method called FR is proposed for improving the adversarial robustness.\n\nWeakness / Question\n\n- This paper has no theoretical result. \n- In Table 1, I am confused how the values are computed. Can you explain the procedure with rigorous mathematical formuals if necessary? Also, why the Table 1 implies that AT focuses on low-frequency region? The robust model performs best for the highest bandwidth\n- In Table 1, how is the last column evaluated by the learned model?\n- The empirical results are not significant.\n- The experimental setup for Tabel 3 is not well explained.\n- WA can be applied to other adversarial algorithms. Thus, comparing the performance AT+FR/WA with other competitors is not fair. For fair comparison, WA should be applied to others.\n- It seems that the result of AWP [2] in Table 3 is not reliable. The original paper reports the robust accuracy against AA is about 56. The 2% degration of performance in AutoAttack is largely significant. Can you explain about it?\n- There is not enough explanation for model selection in the evalution setting.\n- In eqn (2), what is the exact form of \\mathcal{L}_{ce}? Does it depends on  f_1, f_2 or other f?\n- In eqn (2), how can you find  in the regularization term? Is PGD in AT [1]? What is target model for finding \\delta, f_1, f_2 or other model?\n- In eqn (2), what \\mathcal{F}(f_1(x)) means? It seems the outputs of FFT in logits. I'm confused what it means to apply FFT to logits. My understanding is that FFT is applied to data.\n- The frequency regularization is not limited AT [1]. It can be extended to other algorithm such as TRADES. Can you present the results for other algorithms?\n- I'm confused about what the L-model is. Is Train X of L-model LPF(X)?\n\n\n[1] Madry, Aleksander and Makelov, Aleksandar and Schmidt, Ludwig and Tsipras, Dimitris and Vladu, Adrian, Towards Deep Learning Models Resistant to Adversarial Attacks, In ICLR, 2018.\n\n[2]  Dongxian Wu, Shu-Tao Xia, and Yisen Wang, Adversarial Weight Perturbation Helps Robust Generalization, In NeurIPS, 2020.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject