Low Frequency Adversarial Perturbation

Understand

Adversarial images aim to change a target model's decision by minimally perturbing a target image.

• In the black-box setting, the absence of gradient information often renders this search problem costly in terms of query complexity.
• In this paper we propose to restrict the search for adversarial images to a low frequency domain.
• This approach is readily compatible with many existing black-box attack frameworks and consistently reduces their query cost by 2 to 4 times.