# Empirical Perturbation Analysis of Two Adversarial Attacks: Black Box versus White Box
## 4 Adversarial Noise Visualization and Frequency Analysis
### Band-Stop Filtering Shuffled and Unshuffled Images: Which Frequencies Make an Image Adversarial?  
Thus far, the results of this study have revealed the quantity of all frequency components present in the adversarial perturbations, but their relevance to the attack effectiveness is still unknown. To address this issue, we band-stop filter the adversarial images \(\mathcal{D}_{k}^{\textit{attk}}(\mathcal{A}_{q}^{p})\) to eliminate various frequency ranges and check the effect produced on the CNN predictions. To evaluate the proportion of low vs. high frequencies of the noise introduced by the two attacks, the process is repeated with the shuffled adversarials \(sh(\mathcal{D}_{k}^{\textit{attk}}(\mathcal{A}_{q}^{p}),s)\) for \(s=32,56\) and \(112\).  
We first obtain the DFT of all shuffled or unshuffled ancestor and adversarial images, followed by filtering with band-stop filters of 10 different frequency ranges \(F_{\textit{bst},\textit{rc}}\), where the range center \(rc\) goes from 15 to 115 units per pixel, with steps of 10, and the bandwidth \(bw\) is fixed to 30 units per pixel. For example, the last band-stop filter \(F_{\textit{bst},115}\) removes frequencies in the range of \((115-15,115+15)\) units per pixel. The band-stopped images are passed through the Inverse DFT (IDFT) and sent to the CNN, which results in 10 pairs of \((c_{a},c_{t})\)-label values for each image, be it an ancestor or an adversarial. Figure 5 presents some results that are typical of the general behavior.  
For both the EA and BIM, the \(c_{t}\) probability tends to increase as \(rc\) increases. This means that lower frequencies have a larger impact on the adversarial classification than higher frequencies. As shown in the left column of each pair of graphs, it is the low frequencies that matter for the correct classification of the ancestor, as well. Although with both attacks, the \(c_{t}\) probability tends to increase at higher values of \(rc\), with BIM, it is dominant at considerably smaller values of \(rc\), whereas the EA adversarials are usually still classified as \(c_{a}\). Hence, the EA adversarials require almost the full spectrum of perturbations to fool the CNNs, whereas the lower part of the spectrum is sufficient for BIM adversarials. This result matches those of magn (diff) in Figure 3, where the EA and BIM were found to introduce white and predominantly low-frequency noise, respectively.  
As for the shuffled images, it is clear that their low-frequency features are affected by the shuffling process, and as a result, the \(c_{t}\) probability cannot increase to the extent it does in the unshuffled images. With BIM and \(s=112\), at high \(rc\)s, the band-stop graphs show a slower increase in the \(c_{t}\) probability than when the images are not shuffled. This implies that a large part of the BIM adversarial image's low-frequency noise is meaningful only for the unshuffled image. When this low-frequency noise changes location through the shuffling process, one needs to gather noise across a broader bandwidth to significantly increase the \(c_{t}\) probability of the shuffled adversarial.  
Even if the BIM adversarials require a larger bandwidth to be adversarial when shuffled, they still reach this goal. In contrast, the shuffled EA adversarials have band-stop graphs that closely resemble the shuffled ancestors' graph. Only BIM's remaining low and middle frequencies are meaningful enough to \(c_{t}\) and still manage to increase the \(c_{t}\) probability.