# Exploiting Frequency Characteristics for Boosting the Invisibility of Adversarial Attacks
## 3 Methodology
### Frequency Domain Loss  
Typically, many adversarial attacks directly use the adversarial loss function as the optimization objective while simply constraining the perturbation through the Lp norm, which is obviously insufficient for an attack method that has requirements for image quality. Some studies add image evaluation functions such as SSIM [6], JND [16] constraints, etc., to the optimization objective as penalty terms to solve it, but this simple restriction on the strength of the perturbation may lead to an unsuccessful attack on the DNN. We propose that in addition to the strength of a perturbation, its frequency domain distribution can also affect the performance of the adversarial example. Therefore, we propose a new optimization objective that adds the frequency domain loss to adjust the perturbation. Specifically, we divide the loss function of the adversarial attack into the adversarial loss and frequency domain loss, and we formulate the frequency domain optimization as the maximization process of the frequency domain loss. We find the region with the highest value in the Fourier domain for the adversarial attack; then, we can improve the efficiency of the adversarial attack by optimizing the perturbation frequency domain distribution. Through a clustering analysis, we divided the overall Fourier matrix into a low-frequency region \(\omega_{low}\), a high-frequency region \(\omega_{high}\), and a non-sensitive region \(\omega_{other}=E-\omega_{low}-\omega_{high}\), where \(E\) is the all-ones matrix; we name them the frequency mask set \(\Omega\{\omega_{low},\omega_{high},\omega_{other}\}\). Then, all the information of the perturbation on the frequency domain \(d_{all}\) can be formulated as:  
\[d_{all}=\mathbf{x}_{\text{FFT}}^{\prime}-\mathbf{x}_{\text{FFT}}=d_{low}+d_{ high}+d_{other} \tag{9}\]  
Figure 4: Results after the clustering mask on the CIFAR10 dataset, with the Fourier heatmap, sensitive regions, low-frequency regions, and high-frequency regions from top to bottom by row. where \(d_{low}\), \(d_{high}\) and \(d_{other}\) represent the perturbation strength of the disturbance in the low-frequency region, high-frequency region, and non-sensitive region, respectively:  
\[d_{high} =\left\|\omega_{high}\odot\left(\mathbf{x}_{\text{FFT}}^{\prime}- \mathbf{x}_{\text{FFT}}\right)\right\|_{2} \tag{10}\] \[d_{low} =\left\|\omega_{low}\odot\left(\mathbf{x}_{\text{FFT}}^{\prime}- \mathbf{x}_{\text{FFT}}\right)\right\|_{2}\] (11) \[d_{other} =\left\|\omega_{other}\odot\left(\mathbf{x}_{\text{FFT}}^{\prime}- \mathbf{x}_{\text{FFT}}\right)\right\|_{2} \tag{12}\]  
For the overall perturbation, the value of \(d_{other}\) is the lowest for the adversarial attack, so we constrain it; furthermore, within the sensitive region, we further optimize the perturbation based on the HVS, which has greater visual redundancy for \(\omega_{high}\) and lower redundancy for \(\omega_{low}\), so we concentrate the perturbation on \(d_{high}\). We can summarize the frequency optimization objectives of the adversarial attack as increasing \(d_{high}\) and constraining \(d_{low}\) and \(d_{other}\), formulated as:  
\[\arg\max_{\mathbf{x}_{\text{FFT}}^{\prime}}\mathcal{L}_{fre}\big{(}\mathbf{x} _{\text{FFT}}^{\prime},\mathbf{x}_{\text{FFT}};\Omega\big{)}\rightarrow\left\{ \begin{array}{l}\arg\min_{\mathbf{x}_{\text{FFT}}^{\prime}}d_{other}\\ \arg\min_{\mathbf{x}_{\text{FFT}}^{\prime}}d_{low}\\ \arg\max_{\mathbf{x}_{\text{FFT}}^{\prime}}d_{high}\end{array} \right. \tag{13}\]  
To adjust the frequency domain distribution of the perturbation, the easiest way is to use the strength of the perturbation in each frequency domain region directly as the frequency domain loss. However, this method may lead to the problem of overfitting; if the strength of perturbation in a certain frequency domain is too large, it will obscure the antagonistic loss during back-propagation and the strength of the perturbation will vary greatly during the iterative process so that simple superposition will lead to unstable gradients.