# Exploiting Frequency Characteristics for Boosting the Invisibility of Adversarial Attacks
## 3 Methodology
### Cluster Analysis  
The previous analysis has demonstrated that DNNs possess shared sensitive characteristics for specific frequency domain components in the Fourier domain regarding adversarial examples. Noise in these frequency domain components is more likely to deceive the neural network. Moreover, as we discussed earlier, the frequency of perturbations is closely linked to their invisibility. In the Fourier domain, the visual perceptual sensitivity of the HVS to perturbations is likewise closely related to its frequency and decreases significantly for high-frequency perturbations. Hence, we analyze the optimization objectives of perturbations in the Fourier domain, integrating both frequency sensitivity and invisibility. Observing the frequency-domain-sensitive regions of the DNN, as shown in Figure 3, it can be found that a substantial part of the common frequency-domain-sensitive regions of the neural network exist in low-to-medium frequency regions. Therefore, when constraining the perturbation to the frequency-sensitive region, we need to consider the effect of the frequency of the perturbation on the visibility. For the process of adversarial attacks, each element in the Fourier matrix embodies two characteristics of the perturbation of a frequency component. On the one hand, the heat value \(h_{t}\) in the Fourier heatmap reflects the sensitivity of the DNN to perturbations in this frequency domain component. The higher the heat value \(h_{t}\), the greater the probability of the perturbation causing the target model to classify incorrectly. On the other hand, based on the CSF model, it can be concluded that for the middle- and high-frequency bands in which the common sensitive region of the DNN are located, the CSF and the spatial frequency can be approximated as being inversely related. Correspondingly, the CSF reflects the human eye's ability to perceive details at different frequencies, so for the same intensity of perturbation, the higher its frequency, the weaker the human eye's ability to perceive the details and therefore the better its invisibility; i.e., the invisibility of the perturbation is positively correlated with its frequency. Consequently, we use the distance \(\tau\) from the pixel point to the zero-frequency component (after frequency centering) to represent the invisibility of the perturbation at that frequency. These two characteristics of perturbation correspond to the requirements of transferability and invisibility of adversarial examples, which we define as:  
\[h_{t}=\text{heat}(u,v) \tag{6}\]  
\[\tau=\sqrt{\left(u-\left[\frac{H-1}{2}\right]\right)^{2}+\left(v-\left[\frac{ W-1}{2}\right]\right)^{2}} \tag{7}\]  
Through the function of the frequency domain component \((u,v)\) of perturbation, the heat value \(h_{t}\), and the frequency \(\tau\), we can transform the improvement in the invisibility of transferable adversarial examples into the filtering of each element in the Fourier matrix in a two-dimensional space composed of the heat value \(h_{t}\) and frequency \(\tau\). Placing perturbations in the area with the highest heat value \(h_{t}\) can improve the transferability of adversarial examples, while placing all perturbations in the area with the highest \(\tau\) can minimize the visual difference between adversarial examples and original images. A clustering algorithm [35] is the process of clustering similar samples together based on the distribution law of the sample data themselves. We use a clustering algorithm to filter common sensitive regions in the Fourier domain and obtain the optimal embedding regions conducive to the invisibility of adversarial examples. We take all elements in the sensitive regions as a set, denoted as \(C\), and use the K-means algorithm [35] to cluster them.