# Exploiting Frequency Characteristics for Boosting the Invisibility of Adversarial Attacks
## 3 Methodology
### Motivation  
In the current field of AI research, researchers are committed to improving the performance of AI systems and many approaches have been proposed including upgrading the model structure, training algorithms, and improving the quality of deployed data, among others, from the field of data-centric and model-centric AI [23]. Adversarial attack research is significant in both fields. Research on adversarial attacks can make adversarial examples more challenging, which is crucial for data-centric AI research to help us better understand the impact of training data on model robustness. In addition, advances in the field of adversarial attacks can lead us to design more robust model structures and guide strategies and techniques for model defense, thereby improving model security and reliability. In addition to the importance in AI research, high-quality adversarial examples play an important role in many other real-world scenarios of applications, especially in terms of privacy protection, e.g., securing the privacy of social network users. In big data environments such as social media, where people's personal information and private data can be subject to various forms of attacks and violations, the use of adversarial samples can help protect users' private data from unauthorized exploitation. Users upload and share adversarial examples of their photos instead of clean photos, which makes it more difficult for the model to identify and utilize personal information and does not affect the photo sharing experience, thus effectively increasing the level of privacy protection for users on social media platforms. Such scenarios place higher demands on the transferability and invisibility of adversarial examples. Existing works based on the I-FGSM and model augmentation are effective in improving the transferability of adversarial examples while leaving obvious traces of modification. Additionally, recent research [8] demonstrates that \(L_{p}\) constraints in the pixel domain are insufficient to guarantee the visual quality of adversarial examples. Due to the limitations of the I-FGSM, attackers can only use the constraint of the \(L_{\infty}\) norm to implicitly ensure that the visual distance between adversarial examples and clean ones is not too large, which is insufficient for invisibility. The \(L_{0}\) norm measures the number of different pixels between two images, the \(L_{2}\) norm measures the Euclidean distance between two images, and the \(L_{\infty}\) norm measures the maximum difference between corresponding pixels in two images. These norms only constrain certain statistical characteristics of perturbations in the pixel domain and may not ensure the invisibility of adversarial examples. Figure 1 displays an attack instance that uses only the \(L_{p}\) norm to constrain the perturbation strength, revealing the significant limitations of \(L_{p}\) constraints. The use of \(L_{p}\) norms can be misleading; that is, adversarial examples with small \(L_{p}\) norms are visually similar to clean images, but this is not the case. Nearly all adversarial attacks directly modify image pixels in the spatial domain based on the gradient information of the model, making it difficult for perturbations to adapt to changes in image content and often leaving visible traces. The perception of visual signal changes varies for different visual content. The human visual system (HVS) [7] is a non-uniform and nonlinear image processing system that acts as a low-pass linear system in the frequency domain. Due to its limited resolution, the HVS is more sensitive to changes in low-frequency image signals compared to high-frequency ones. While DNNs perceive image information counterintuitively, differently to the HVS, image information that is unrecognizable to the human eye may be important to  
Figure 1: Perturbed images with small \(L_{0}\), \(L_{2}\), and \(L_{\infty}\) norm constraints can still exhibit distinct perceptual artifacts; the two examples are from Tiny-ImageNet [24].