REVIEW 3 major objections 5 minor 10 references
Adversarial Defense by Suppressing High-frequency Components
T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash
Pith's one-line read Suppressing high-frequency image components sharply reduces the power of adversarial perturbations.
desk verdict A well-written low-pass filtering defense with an internally consistent ablation, but the evaluation rests on a competition score and never tests against adaptive attacks, so the central claim is not yet established. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the box-window mask $M$ in the DFT domain: $M_{u,v}=1$ for $|u|,|v| \leq r$ and $0$ otherwise. Applying it as $x \leftarrow \mathcal{F}^{-1}(M \odot \mathcal{F}(x))$ removes all frequency components above radius $r$. The mechanism works because the paper's cumulative-spectral-energy measurements show clean images are low-frequency-dominated while adversarial perturbations are nearly uniform, so the mask removes a large share of perturbation energy at small cost to clean content. Differentiability follows from the linear matrix form $\mathcal{F}(x) = F_M x F_N$, and Parseval's theorem gives closed-form control of the L2 distance between the original and filtered image in terms of $r$.
What would settle it
Construct adversarial perturbations whose energy lies mostly inside the low-frequency passband, for example by constraining the perturbation to frequencies below $r$ during projected gradient descent, and test whether the suppression module still prevents misclassification. If such perturbations reliably fool the filtered model, the frequency assumption fails. Alternatively, find a natural image category whose classification depends on high-frequency texture and show that suppressing frequencies above $r$ degrades clean accuracy far more than the average curves predict.
Extended reading notes
Core claim
The central discovery is a frequency-domain asymmetry: clean images concentrate their spectral energy in low frequencies, whereas adversarial perturbations spread energy almost uniformly across frequencies. Exploiting this, a fixed box-window low-pass filter in the DFT domain removes most of a perturbation's energy while retaining most clean-image information. Because the module is differentiable, it can be placed before a network and trained jointly with adversarial training, and because it is a box mask, Parseval's theorem makes the L2 modification of the input directly controllable by the radius r. The paper's empirical anchor is the AAAC ablation, where the module outperforms plain TRADES and the combination gives the best score.
Load-bearing premise
The argument assumes that the part of an adversarial perturbation that causes misclassification is concentrated in frequencies above the box radius $r$, while all information needed to classify clean images lies below $r$; the paper supports this only with average cumulative spectral energy curves, not per-image or worst-case analysis.
Editorial extensions
If this is right
- A lightweight input filter can lift robustness above what adversarial training alone achieves on the AAAC metric, so frequency suppression is a viable standalone defense.
- The module and TRADES are complementary: combining them raises the AAAC score to 19.05, and an ensemble of different radii reaches 19.75.
- Smaller radius $r$ trades clean-image accuracy for robustness, so the defense can be tuned to the threat model.
- Because the module is differentiable, it can be optimized jointly with the classifier rather than applied as a fixed preprocessing step.
- The L2 modification of the input is theoretically controlled by the radius through Parseval's theorem, making the defense's footprint predictable.
Reading between the lines
- An adaptive attacker who knows the mask could concentrate a perturbation's energy inside the passband (below $r$), which the defense cannot remove; the paper's black-box challenge results do not test this.
- The average cumulative-spectral-energy evidence does not guarantee that every image's class-relevant detail lies below $r$; images whose class information depends on fine texture could suffer disproportionate accuracy loss.
- A testable extension would learn a frequency mask or make $r$ input-dependent instead of using a fixed box, potentially improving the trade-off between accuracy and robustness.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a preprocessing module that removes high-frequency components of input images via a discrete Fourier transform (DFT) and a hard box filter, making the module differentiable for joint optimization with adversarial training. The authors combine this module with TRADES adversarial training and report the 5th-place score in the IJCAI-2019 Alibaba Adversarial AI Challenge (AAAC). The central claim, stated in Section 3.1, is that suppressing high-frequency components significantly reduces the effect of adversarial perturbations while retaining most clean-image information. Evidence includes cumulative spectral energy (CSE) curves in Figure 1, an ablation study in Table 1, and a radius sweep in Figure 2.
Significance. If the claim were fully substantiated, the paper would offer a simple, computationally cheap, and differentiable preprocessing defense that could be combined with adversarial training. The module is easy to describe and the ablation shows a monotonic improvement in the AAAC competition score, which is a useful empirical signal. The authors also provide open-source code and identify several follow-up directions. However, the evaluation is confined to a single black-box competition metric, lacks standard robust-accuracy measurements, error bars, and comparisons to prior defenses, and does not include adaptive white-box attacks. The frequency-domain premise is supported only by average spectrum curves, not by worst-case or image-specific analysis. Therefore the significance of the result is currently conditional on additional evaluation.
major comments (3)
- [Section 3.2, Table 1 and Eq. (9)] The quantitative evidence for robustness rests entirely on the AAAC competition score defined in Eq. (9), which is not a standard robust-accuracy metric at a fixed perturbation budget. The table reports no error bars or statistical significance, and there is no comparison to prior defense methods such as JPEG compression, feature squeezing, or other preprocessing defenses. The claim in the abstract and Section 3.2 that the method 'substantially improves robustness' would require a standard evaluation, e.g., robust accuracy under PGD or CW attacks with a fixed epsilon on CIFAR-10 or another benchmark, with the proposed module compared against TRADES alone and against other preprocessing defenses.
- [Section 3.1, Figure 1, and Eq. (3)] The central premise—that harmful adversarial perturbation energy lies predominantly above the box radius r while class-relevant clean-image information lies below r—is supported only by average cumulative spectral energy curves. For CIFAR-10 with r=8, a uniform frequency-domain perturbation retains roughly one quarter of its energy inside the passband of Eq. (3), and an adaptive attacker aware of the hard filter can concentrate the entire perturbation budget in the low-frequency passband. Since the box filter sets the gradient to exactly zero in the stopband, neither the adversarial training in Eq. (7) nor a standard white-box attacker can explore high-frequency perturbation directions. The paper reports no experiment with an adaptive attacker that optimizes low-frequency perturbations through the filter, so the mechanism by which the defense improves robustness is not verified and the improved score could reflect a restricted attack surface rather than genuine removal of harmful high-frequency content.
- [Section 2.2, Eqs. (7)-(8)] The claim that the module is 'differentiable' and can be 'jointly optimized with adversarial training' is only partially correct. While the DFT in Eq. (5) is differentiable, the hard box mask in Eq. (3) has zero derivative almost everywhere in the suppressed band. Consequently, when TRADES or PGD updates the input perturbation, gradient-based search cannot adjust the high-frequency components of the perturbation at all. This means the adversarial training objective is effectively optimized over a restricted low-frequency subspace, which is not the same as training against the full set of perturbations within the stated epsilon ball. The paper should clarify this limitation and evaluate whether the defense remains robust when the adversary is allowed to use low-frequency-only perturbations generated with a filter-aware attack.
minor comments (5)
- [Introduction, first paragraph] The statement that 'researchers empirically find that the perturbations generated by adversarial attacks are also high-frequency signals' is made without a citation; a reference or a brief derivation would strengthen the motivation.
- [Eq. (6)] The Parseval identity as stated, ||x - x_o||_2^2 = ||x_hat - M⊙x_hat||_2^2, omits the normalization factor that depends on the DFT convention in Eq. (1). With the unnormalized DFT, a factor of 1/(MN) (or similar) is required, and the authors should either use a unitary DFT definition or include the correct constant.
- [Section 3, Eq. (9)] The definition of the score in Eq. (9) is ambiguous: the symbol δ is not defined in the text immediately preceding the equation, and the formula mixes a per-image condition with an average over attack models. Please clarify what δ represents and how the final score is aggregated over images and attacks.
- [Section 2.1, Eq. (3)] The notation 'we set M−u,· = MM−u,·' appears to contain a typographical error and is not followed by a clear definition of the aliased indices for negative frequencies; please revise this sentence.
- [Figure 1] The curves in Figure 1 show only the mean cumulative energy, with no indication of variance across images. Adding error bands or percentile curves would make the claim that clean and adversarial spectra are 'similar' or 'different' more informative.
Circularity Check
No significant circularity: the core claim is tested on an external black-box challenge, and the cutoff radius is a tuned hyperparameter rather than an input that forces the reported result.
full rationale
The paper's derivation chain is not circular. The high-frequency suppression module is defined by the DFT box filter in Eqs. (1)-(4), and its properties follow from the definition, but the central claim that suppressing high-frequency components improves adversarial robustness is an empirical claim evaluated on the external AAAC benchmark using the score in Eq. (9). The cutoff radius r in Eq. (3) is selected from the validation trade-off shown in Fig. 2, and the final entry ensembles models with different r; this is ordinary hyperparameter tuning and does not make the AAAC score equivalent to an input. TRADES is adopted from an external citation (Zhang et al., 2019) and is not the authors' own prior work. The only potentially weak step is the empirical premise that clean-image class information lies mostly in the low-pass band while attack energy does not, but this premise is supported by the cumulative spectrum statistics in Fig. 1 and is not true by construction. Because the claimed result is not equivalent to its inputs and no load-bearing self-citation exists, no significant circularity is found.
Assumptions & free parameters
free parameters (1)
- box window radius r =
8, 16, 24, 150 evaluated; ensemble uses multiple radii
assumptions (4)
- standard math DFT is a linear, invertible transform expressible as matrix multiplication (Eq. 5), hence differentiable, and Parseval's theorem gives the L2 relation in Eq. 6.
- domain assumption Adversarial perturbations have nearly uniform cumulative spectral energy, so masking high frequencies removes most of the attack signal.
- domain assumption Natural image information is concentrated in low frequencies, so removing high frequencies preserves class-relevant content.
- domain assumption The AAAC challenge score, which rewards larger perturbation norms when the prediction is correct, is a reliable indicator of robustness against general adversarial attacks.
Cite this review
Pith. "Pith review of Adversarial Defense by Suppressing High-frequency Components." pith.science (2026). https://pith.science/paper/EVF6CHY7
@misc{pith2026190806566,
author = {Pith},
title = {Pith review of: Adversarial Defense by Suppressing High-frequency Components},
year = {2026},
howpublished = {\url{https://pith.science/paper/EVF6CHY7}},
note = {Machine review of arXiv:1908.06566}
}
read the original abstract
Recent works show that deep neural networks trained on image classification dataset bias towards textures. Those models are easily fooled by applying small high-frequency perturbations to clean images. In this paper, we learn robust image classification models by removing high-frequency components. Specifically, we develop a differentiable high-frequency suppression module based on discrete Fourier transform (DFT). Combining with adversarial training, we won the 5th place in the IJCAI-2019 Alibaba Adversarial AI Challenge. Our code is available online.
Figures
Reference graph
Works this paper leans on
-
[1]
Ijcai-2019 alibaba adversarial ai challenge
AAAC. Ijcai-2019 alibaba adversarial ai challenge. https://security.alibaba.com/alibs2019
work page 2019
-
[2]
Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples
Anish Athalye, Nicholas Carlini, and David A Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. international conference on machine learning , pages 274--283, 2018
work page 2018
-
[3]
Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression
Nilaksh Das, Madhuri Shanbhogue, Shangtse Chen, Fred Hohman, Li Chen, Michael E Kounavis, and Duen Horng Chau. Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression. arXiv: Computer Vision and Pattern Recognition , 2017
work page 2017
-
[4]
Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness. international conference on learning representations , 2019
work page 2019
-
[5]
Explaining and harnessing adversarial examples
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. international conference on learning representations , 2015
work page 2015
-
[6]
Towards deep learning models resistant to adversarial attacks
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. international conference on learning representations , 2018
work page 2018
-
[7]
Intriguing properties of neural networks
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J Goodfellow, and Rob Fergus. Intriguing properties of neural networks. international conference on learning representations , 2014
work page 2014
-
[8]
Feature squeezing: Detecting adversarial examples in deep neural networks
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. network and distributed system security symposium , 2018
work page 2018
Show all 10 references
-
[9]
Theoretically principled trade-off between robustness and accuracy
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael I Jordan. Theoretically principled trade-off between robustness and accuracy. arXiv: Learning , 2019
2019
-
[10]
write newline
" write newline "" before.all 'output.state := FUNCTION fin.entry add.period write newline FUNCTION new.block output.state before.all = 'skip after.block 'output.state := if FUNCTION new.sentence output.state after.block = 'skip output.state before.all = 'skip after.sentence '...
Reviewed August 14, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.