{"id":"1cf04ce5-ad74-4532-9b03-ab17badb5ee4","arxiv_id":"1908.06566","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"Removing high-frequency image components with a differentiable box filter improves robustness to black-box adversarial attacks and combines with TRADES.","lead":"This paper proposes a simple defense that removes high-frequency image components with a differentiable Fourier-domain filter before classification, and combines it with adversarial training. The method improved a black-box attack score and took 5th place in the IJCAI-2019 Alibaba Adversarial AI Challenge.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The load-bearing assumption, Eq. 3's hard frequency cutoff, is supported only by average spectrum curves (Fig. 1) and a black-box competition score (Eq. 9); adaptive low-frequency PGD attacks could remove the claimed robustness.","rationale":"The paper's Table 1 and Fig. 2 are internally consistent, and the code release is a point in its favor; I am not questioning the competition result. The central scientific claim, however, is that high-frequency suppression is the mechanism of the robustness. That mechanism rests on Fig. 1, which averages spectra over many images, and on Eq. 9, a black-box competition score. Neither rules out an adaptive attacker who optimizes only the low-frequency passband of Eq. 3. Since the module is hard-thresholded, gradients outside the box are exactly zero, so TRADES through the module would train against only low-frequency perturbations; the method falls into the gradient-masking category the paper itself cites. The concrete test above would distinguish genuine removal of harmful high-frequency content from a restricted attack surface. Hence the reader's conditional verdict is unchanged.","tokens_in":4228,"tokens_out":6413,"duration_ms":76457,"concrete_test":"Using the released code, train a ResNet-18 on CIFAR-10 with the proposed DFT box filter (r=8) and TRADES as in §2.2, then run PGD-20 and AutoAttack with the filter included in the attack graph, measuring robust accuracy at ε=8/255 under L∞. Compare against an identically trained model without the filter. If robust accuracy with the filter does not exceed the no-filter TRADES baseline by a meaningful margin, the proposed defense is not robust to adaptive attacks and the central frequency-separation claim fails. Also report clean accuracy with and without the filter to quantify the information-retention cost.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's core premise, stated in §3.1 on the basis of Fig. 1, is that adversarial perturbations carry harmful energy outside the passband radius r while clean-image class information lies inside it. Fig. 1 does not establish this in the worst-case or even image-specific sense: it shows an average cumulative spectrum over many images, and the adversarial line is nearly uniform, not high-frequency concentrated. For CIFAR-10 with r=8, a uniform perturbation retains roughly a quarter of its energy inside the passband of Eq. 3; for AAAC, r=8 keeps only a tiny area, but an attacker aware of the filter can spend the entire perturbation budget in that passband. The filter is a hard multiplication by zero outside the box, so its gradient there is exactly zero; TRADES training through the module (Eq. 7/8) therefore sees only low-frequency perturbation directions. The reported score (Eq. 9) is a black-box competition metric that rewards larger perturbation norms for correctly classified images and does not measure robust accuracy at a fixed epsilon against adaptive attacks. Consequently, the improved score could reflect a restricted attack surface rather than genuine removal of harmful high-frequency content. No experiment in the paper tests a white-box or adaptive attacker that optimizes low-frequency perturbations through the filter, so the central mechanism remains unverified.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a preprocessing module that removes high-frequency components of input images via a discrete Fourier transform (DFT) and a hard box filter, making the module differentiable for joint optimization with adversarial training. The authors combine this module with TRADES adversarial training and report the 5th-place score in the IJCAI-2019 Alibaba Adversarial AI Challenge (AAAC). The central claim, stated in Section 3.1, is that suppressing high-frequency components significantly reduces the effect of adversarial perturbations while retaining most clean-image information. Evidence includes cumulative spectral energy (CSE) curves in Figure 1, an ablation study in Table 1, and a radius sweep in Figure 2.","tokens_in":4479,"tokens_out":3769,"duration_ms":39522,"significance":"If the claim were fully substantiated, the paper would offer a simple, computationally cheap, and differentiable preprocessing defense that could be combined with adversarial training. The module is easy to describe and the ablation shows a monotonic improvement in the AAAC competition score, which is a useful empirical signal. The authors also provide open-source code and identify several follow-up directions. However, the evaluation is confined to a single black-box competition metric, lacks standard robust-accuracy measurements, error bars, and comparisons to prior defenses, and does not include adaptive white-box attacks. The frequency-domain premise is supported only by average spectrum curves, not by worst-case or image-specific analysis. Therefore the significance of the result is currently conditional on additional evaluation.","major_comments":[{"comment":"The quantitative evidence for robustness rests entirely on the AAAC competition score defined in Eq. (9), which is not a standard robust-accuracy metric at a fixed perturbation budget. The table reports no error bars or statistical significance, and there is no comparison to prior defense methods such as JPEG compression, feature squeezing, or other preprocessing defenses. The claim in the abstract and Section 3.2 that the method 'substantially improves robustness' would require a standard evaluation, e.g., robust accuracy under PGD or CW attacks with a fixed epsilon on CIFAR-10 or another benchmark, with the proposed module compared against TRADES alone and against other preprocessing defenses.","section":"Section 3.2, Table 1 and Eq. (9)"},{"comment":"The central premise—that harmful adversarial perturbation energy lies predominantly above the box radius r while class-relevant clean-image information lies below r—is supported only by average cumulative spectral energy curves. For CIFAR-10 with r=8, a uniform frequency-domain perturbation retains roughly one quarter of its energy inside the passband of Eq. (3), and an adaptive attacker aware of the hard filter can concentrate the entire perturbation budget in the low-frequency passband. Since the box filter sets the gradient to exactly zero in the stopband, neither the adversarial training in Eq. (7) nor a standard white-box attacker can explore high-frequency perturbation directions. The paper reports no experiment with an adaptive attacker that optimizes low-frequency perturbations through the filter, so the mechanism by which the defense improves robustness is not verified and the improved score could reflect a restricted attack surface rather than genuine removal of harmful high-frequency content.","section":"Section 3.1, Figure 1, and Eq. (3)"},{"comment":"The claim that the module is 'differentiable' and can be 'jointly optimized with adversarial training' is only partially correct. While the DFT in Eq. (5) is differentiable, the hard box mask in Eq. (3) has zero derivative almost everywhere in the suppressed band. Consequently, when TRADES or PGD updates the input perturbation, gradient-based search cannot adjust the high-frequency components of the perturbation at all. This means the adversarial training objective is effectively optimized over a restricted low-frequency subspace, which is not the same as training against the full set of perturbations within the stated epsilon ball. The paper should clarify this limitation and evaluate whether the defense remains robust when the adversary is allowed to use low-frequency-only perturbations generated with a filter-aware attack.","section":"Section 2.2, Eqs. (7)-(8)"}],"minor_comments":[{"comment":"The statement that 'researchers empirically find that the perturbations generated by adversarial attacks are also high-frequency signals' is made without a citation; a reference or a brief derivation would strengthen the motivation.","section":"Introduction, first paragraph"},{"comment":"The Parseval identity as stated, ||x - x_o||_2^2 = ||x_hat - M⊙x_hat||_2^2, omits the normalization factor that depends on the DFT convention in Eq. (1). With the unnormalized DFT, a factor of 1/(MN) (or similar) is required, and the authors should either use a unitary DFT definition or include the correct constant.","section":"Eq. (6)"},{"comment":"The definition of the score in Eq. (9) is ambiguous: the symbol δ is not defined in the text immediately preceding the equation, and the formula mixes a per-image condition with an average over attack models. Please clarify what δ represents and how the final score is aggregated over images and attacks.","section":"Section 3, Eq. (9)"},{"comment":"The notation 'we set M−u,· = MM−u,·' appears to contain a typographical error and is not followed by a clear definition of the aliased indices for negative frequencies; please revise this sentence.","section":"Section 2.1, Eq. (3)"},{"comment":"The curves in Figure 1 show only the mean cumulative energy, with no indication of variance across images. Adding error bands or percentile curves would make the claim that clean and adversarial spectra are 'similar' or 'different' more informative.","section":"Figure 1"}],"recommendation":"major_revision","confidential_remarks":"This manuscript reads as a competition-report style paper. The central idea is simple and the ablation is consistent, but the evaluation is far from the standard expected in a journal publication. The lack of adaptive attacks and standard robust-accuracy benchmarks is the main obstacle. If the authors can add a proper evaluation on CIFAR-10 or ImageNet with PGD/CW attacks at fixed epsilon and include a filter-aware adaptive attacker, the paper could become a useful contribution. I also note that the competition metric and the absence of comparison tables make it difficult to judge the novelty relative to existing preprocessing defenses."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper's idea is simple: put a hard low-pass filter in front of the network, make it differentiable, and train through it with TRADES. The DFT module is a clean implementation, and the Parseval-based analysis of the tradeoff between suppression and L2 distortion is a nice touch. The ablation is internally consistent: filtering alone beats TRADES alone on the AAAC score, and combining them helps. Code is available, and the authors are honest about their scope, listing open questions rather than overclaiming a general defense.\n\nThe soft spots are real, though. The central premise, that adversarial perturbations carry their harmful energy outside the passband, rests on Fig. 1: an average cumulative spectrum. Those curves show adversarial perturbations as nearly uniform across frequency, not high-frequency concentrated. With a box cutoff, an attacker who knows the filter can put all the perturbation energy inside the passband, and the filter's gradient outside the box is exactly zero, so adversarial training through the module only sees low-frequency directions. The reported evaluation is the competition score from Eq. 9, which measures perturbation norm only for correctly classified images, not robust accuracy at a fixed epsilon. There is no comparison to JPEG compression, feature squeezing, or other input-transformation defenses, and the radius r is tuned on validation data, with the final ensemble using multiple r values. None of this makes the method worthless, but it means the paper does not demonstrate robustness against an adaptive attacker.\n\nWho is this for? Researchers working on input-transformation defenses or on the frequency structure of adversarial perturbations. It is a legitimate extension of known ideas, but the evaluation standards in the adversarial robustness field have moved past competition scores. A serious referee should ask for standard robust-accuracy benchmarks with fixed epsilon and an adaptive attack that optimizes perturbations in the passband. I would send it to review, but with the expectation of major revisions. The idea is testable, the writing is clear, and the authors are not hiding their limitations.","headline":"A well-written low-pass filtering defense with an internally consistent ablation, but the evaluation rests on a competition score and never tests against adaptive attacks, so the central claim is not yet established.","tokens_in":4980,"tokens_out":1544,"would_cite":false,"duration_ms":19806,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Suppressing high-frequency image components sharply reduces the power of adversarial perturbations.","keywords":["adversarial defense","high-frequency suppression","discrete Fourier transform","adversarial training","TRADES","frequency domain","image classification","robustness"],"falsifier":"Construct adversarial perturbations whose energy lies mostly inside the low-frequency passband, for example by constraining the perturbation to frequencies below $r$ during projected gradient descent, and test whether the suppression module still prevents misclassification. If such perturbations reliably fool the filtered model, the frequency assumption fails. Alternatively, find a natural image category whose classification depends on high-frequency texture and show that suppressing frequencies above $r$ degrades clean accuracy far more than the average curves predict.","tokens_in":4031,"feed_emoji":"🛡️","tokens_out":6075,"duration_ms":58997,"temperature":0.7,"pith_summary":"The paper claims that most of what makes adversarial perturbations dangerous sits in the high-frequency part of an image, while the class-relevant content of ordinary images sits in low frequencies. It proposes a differentiable module that applies a DFT, multiplies the frequency map by a box window of radius r, and transforms back, then feeds the low-pass-filtered image to a classifier. In the AAAC adversarial image-classification benchmark, high-frequency suppression alone scores 14.97, above 9.99 for TRADES adversarial training alone, and the two combined score 19.05. This matters because it offers a cheap, controllable preprocessing defense that is complementary to adversarial training rather than a replacement.","feed_headline":"Cutting high-frequency detail blocks many adversarial attacks","feed_subtitle":"A simple DFT low-pass mask lifts defense scores above adversarial training alone; combining both works even better.","key_machinery":"The load-bearing object is the box-window mask $M$ in the DFT domain: $M_{u,v}=1$ for $|u|,|v| \\leq r$ and $0$ otherwise. Applying it as $x \\leftarrow \\mathcal{F}^{-1}(M \\odot \\mathcal{F}(x))$ removes all frequency components above radius $r$. The mechanism works because the paper's cumulative-spectral-energy measurements show clean images are low-frequency-dominated while adversarial perturbations are nearly uniform, so the mask removes a large share of perturbation energy at small cost to clean content. Differentiability follows from the linear matrix form $\\mathcal{F}(x) = F_M x F_N$, and Parseval's theorem gives closed-form control of the L2 distance between the original and filtered image in terms of $r$.","core_discovery":"The central discovery is a frequency-domain asymmetry: clean images concentrate their spectral energy in low frequencies, whereas adversarial perturbations spread energy almost uniformly across frequencies. Exploiting this, a fixed box-window low-pass filter in the DFT domain removes most of a perturbation's energy while retaining most clean-image information. Because the module is differentiable, it can be placed before a network and trained jointly with adversarial training, and because it is a box mask, Parseval's theorem makes the L2 modification of the input directly controllable by the radius r. The paper's empirical anchor is the AAAC ablation, where the module outperforms plain TRADES and the combination gives the best score.","pith_inferences":["An adaptive attacker who knows the mask could concentrate a perturbation's energy inside the passband (below $r$), which the defense cannot remove; the paper's black-box challenge results do not test this.","The average cumulative-spectral-energy evidence does not guarantee that every image's class-relevant detail lies below $r$; images whose class information depends on fine texture could suffer disproportionate accuracy loss.","A testable extension would learn a frequency mask or make $r$ input-dependent instead of using a fixed box, potentially improving the trade-off between accuracy and robustness."],"forward_implications":["A lightweight input filter can lift robustness above what adversarial training alone achieves on the AAAC metric, so frequency suppression is a viable standalone defense.","The module and TRADES are complementary: combining them raises the AAAC score to 19.05, and an ensemble of different radii reaches 19.75.","Smaller radius $r$ trades clean-image accuracy for robustness, so the defense can be tuned to the threat model.","Because the module is differentiable, it can be optimized jointly with the classifier rather than applied as a fixed preprocessing step.","The L2 modification of the input is theoretically controlled by the radius through Parseval's theorem, making the defense's footprint predictable."],"supporting_citations":[{"why":"Establishes the vulnerability of DNNs to small adversarial perturbations, the problem the paper addresses.","marker":"[Szegedy et al., 2014]"},{"why":"Shows these perturbations can be generated efficiently and are often imperceptible, motivating a frequency-domain defense.","marker":"[Goodfellow et al., 2015]"},{"why":"Supplies the texture-bias premise connecting class-relevant image information to high-frequency content.","marker":"[Geirhos et al., 2019]"},{"why":"Provides PGD adversarial training, the standard robust-training baseline the paper compares against.","marker":"[Madry et al., 2018]"},{"why":"Introduces TRADES, the adversarial-training objective the paper pairs with high-frequency suppression.","marker":"[Zhang et al., 2019]"},{"why":"Represents the preprocessing-defense line, specifically JPEG compression, that this filter extends.","marker":"[Das et al., 2017]"}],"fun_headline_variants":["Low-pass filter blocks most adversarial attacks","DFT low-pass mask thwarts adversarial perturbations","Suppressing high frequencies boosts adversarial defense","Frequency filtering beats adversarial training alone","Fixed low-pass mask plus adversarial training wins"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The argument assumes that the part of an adversarial perturbation that causes misclassification is concentrated in frequencies above the box radius $r$, while all information needed to classify clean images lies below $r$; the paper supports this only with average cumulative spectral energy curves, not per-image or worst-case analysis.","fun_headline_variants_meta":{"raw":{"variants":["Low-pass filter blocks most adversarial attacks","DFT low-pass mask thwarts adversarial perturbations","Suppressing high frequencies boosts adversarial defense","Frequency filtering beats adversarial training alone","Fixed low-pass mask plus adversarial training wins"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000119,"raw_usage":{"total_tokens":984,"prompt_tokens":739,"completion_tokens":245,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":355,"completion_tokens_details":{"reasoning_tokens":182}},"tokens_in":355,"tokens_out":245,"duration_ms":2980,"temperature":1.0,"reasoning_tokens":182,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T12:40:25.202485+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Construct adversarial perturbations whose energy lies mostly inside the low-frequency passband, for example by constraining the perturbation to frequencies below $r$ during projected gradient descent, and test whether the suppression module still prevents misclassification. If such perturbations reliably fool the filtered model, the frequency assumption fails. Alternatively, find a natural image category whose classification depends on high-frequency texture and show that suppressing frequencies above $r$ degrades clean accuracy far more than the average curves predict.","supporting_citations":[{"cited_title":"Intriguing properties of neural networks","cited_arxiv_id":null,"evidence_quote":"Establishes the vulnerability of DNNs to small adversarial perturbations, the problem the paper addresses."},{"cited_title":"Explaining and harnessing adversarial examples","cited_arxiv_id":null,"evidence_quote":"Shows these perturbations can be generated efficiently and are often imperceptible, motivating a frequency-domain defense."},{"cited_title":"Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness","cited_arxiv_id":null,"evidence_quote":"Supplies the texture-bias premise connecting class-relevant image information to high-frequency content."},{"cited_title":"Towards deep learning models resistant to adversarial attacks","cited_arxiv_id":null,"evidence_quote":"Provides PGD adversarial training, the standard robust-training baseline the paper compares against."},{"cited_title":"Theoretically principled trade-off between robustness and accuracy","cited_arxiv_id":null,"evidence_quote":"Introduces TRADES, the adversarial-training objective the paper pairs with high-frequency suppression."},{"cited_title":"Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression","cited_arxiv_id":null,"evidence_quote":"Represents the preprocessing-defense line, specifically JPEG compression, that this filter extends."}],"review_version":1}