# Exploiting Frequency Characteristics for Boosting the Invisibility of Adversarial Attacks
## 3 Methodology
### Fourier Domain Analysis
The contrast sensitivity function (CSF) is an index that is specifically used to evaluate the response of the HVS to visual stimuli of different frequencies. Based on a large number of experiments, [PERSON] and [PERSON] [32] proposed the CSF model based on a large number of experiments using mathematical tools such as the Fourier transform to characterize the relationship between HVS sensitivity and spatial frequency, which was later improved by [PERSON] [33] as:  
\[CSF(f)= \begin{cases}2.6*(0.0192+0.114*f)\exp[-0.114*f],&f\geq f_{\text{peak}}\\ 0.981,&\text{otherwise},\end{cases}  \tag{2}\]  
where \(f=\sqrt{f_{x}^{2}+f_{y}^{2}}\) is the spatial frequency and \(f_{x}\) and \(f_{y}\) are the spatial frequencies in the horizontal and vertical directions, respectively. According to this model, for medium- and high-frequency information of an image, the sensitivity of the human eye is approximately inversely proportional to the frequency; i.e., the invisibility of a perturbation should be positively correlated with the height of its frequency, and the sensitivity of the visual perception decreases markedly in the high-frequency region. By constraining perturbations to components with higher frequencies, we can increase the invisibility of adversarial examples while maintaining their transferability. As we group the adversarial attack process from the Fourier frequency domain, the modification of the perturbation to each pixel value of the image is converted into a modification of the information at each frequency, and therefore the gradient information should also reflect how the change in the information at each frequency in the input to the model affects the model's output and loss function. First, we transform the input image \(\mathbf{x}\) to the frequency domain using the Fourier transform and denote it as \(\mathbf{x}_{\text{FFT}}\):  
\[\mathbf{x}_{\text{FFT}}=\text{FFT}(\mathbf{x}) \tag{3}\]  
Figure 3: Frequency domain sensitive region masks for different DNN models on the CIFAR10 dataset. By adding up the masks of all models, we set the values of points with a value of 1 in two or more masks to 1 and set the value of points with a value of 1 in only one mask or a value of 0 in all masks to 0, resulting in an integrated mask \(\omega\). We turn it back on the spatial domain and put it into the DNN to compute the loss function. Back-propagation calculates the gradient information of the loss function for the output of the model and utilizes the chain rule and the differentiability of the neural network to complete the gradient calculation and propagation from the output layer to the input layer. Since both the Fourier transform and the Fourier inverse transform are differentiable, based on the chain rule, we can add them to the process of back-propagation by converting the gradient of the loss function with respect to the input to the gradient with respect to its frequency domain information and obtain the partial derivatives of the loss function with respect to \(\mathbf{x}_{\text{FFT}}\). During the back-propagation process, the gradient information can be formulated as follows:  
\[g=\frac{\partial\mathcal{L}(\text{IFFT}(\mathbf{x}_{\text{FFT}}),\mathbf{y}; \mathcal{M}_{0})}{\partial\mathbf{x}_{\text{FFT}}} \tag{4}\]  
where \(\text{FFT}(\cdot)\) represents the Fourier transform and \(\text{IFFT}(\cdot)\) represents the inverse Fourier transform. Then, the gradient information is used to update \(\mathbf{x}_{\text{FFT}}\) and finally obtain an adversarial example after the inverse Fourier transform.