On the Effectiveness of Low Frequency Perturbations

Understand

Carefully crafted, often imperceptible, adversarial perturbations have been shown to cause state-of-the-art models to yield extremely inaccurate outputs, rendering them unsuitable for safety-critical application domains.

• In addition, recent work has shown that constraining the attack space to a low frequency regime is particularly effective.
• Yet, it remains unclear whether this is due to generally constraining the attack search space or specifically removing high frequency components from consideration.
• By systematically controlling the frequency components of the perturbation, evaluating against the top-placing defense submissions in the NeurIPS 2017 competition, we empirically show that performance improvements in both the white-box and black-box transfer settings are yielded only when low frequency components are preserved.