Pith. sign in

REVIEW 5 major objections 6 minor 21 references

Automated Detection System for Adversarial Examples with High-Frequency Noises Sieve

T0 review · 5 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A low-pass filter sieve can distinguish adversarial images from benign ones with 99.7–100% accuracy in many settings.

desk verdict Thin variant of feature squeezing with a missing proof and thresholds fit to the test set; the 99.7–100% claim is not supported. read the letter →

arxiv 1908.01469 v1 pith:AOZ5ECKF submitted 2019-08-05 cs.CV cs.LGeess.IV

Dang Duy Thang , Toshihiro Matsui This is my paper · ORCID
classification cs.CVcs.LGeess.IV
keywords adversarialexamplesdeepneuralnetworkshigh-frequencynoiselow-passfilterGaussianmedianFGSMPGD
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that adversarial perturbations, at least for the FGSM and PGD attacks it studies, are concentrated in the high-frequency content of an image. It proposes an end-to-end detector that feeds the input to a classifier twice: once directly to record the highest-confidence anchor class, and once through a Gaussian or median low-pass 'sieve' that strips high-frequency noise. If the filter changes the anchor class's probability by more than a fixed threshold, the input is labelled adversarial; otherwise it is benign. On MNIST and ImageNet test sets built by the authors, the system reports detection rates of 99.7–100% in many settings and can sometimes recover the original class from an adversarial image. A sympathetic reading is that a retraining-free, threshold-based pre-filter can neutralize common gradient-based attacks.

What carries the argument

The carrying object is the 'sieve' layer: either a Gaussian low-pass filter $G_\sigma(i,j) = \frac{1}{2\pi\sigma^2} e^{-(i^2+j^2)/(2\sigma^2)}$ (Detection System based on Gaussian, DSG) or a median filter (Detection System based on Median, DSM), applied with $3\times 3$ and $5\times 5$ kernels. The system runs input through two parallel flows: the anchor flow classifies the raw input and records the highest-confidence class, and the sieve flow filters the input and then classifies it conditional on that anchor. A fixed threshold $\Theta$ on the probability difference turns the filter into a binary detector; no retraining or per-dataset threshold search is required.

What would settle it

Craft adversarial examples whose perturbation energy is concentrated in low-frequency bands, or optimize FGSM/PGD perturbations against the sieve itself so the anchor–filtered probability difference stays below the fixed threshold while the classifier still misclassifies; if such examples succeed on MNIST or ImageNet, the high-frequency premise is false.

Watch

Extended reading notes

Core claim

The central claim is that a low-pass filter placed before a classifier exposes adversarial examples: when the input is adversarial, filtering removes the perturbation and makes the model's confidence in its original top class collapse, while for a benign image the same filtering barely moves the top-class probability. The proposed system formalizes this as a sieve in parallel with an anchor: the direct input path supplies the anchor class, the sieved path is classified given that anchor, and the difference between the two probabilities is compared with a fixed threshold $\Theta$. The paper states that the high-frequency assumption is supported by a theoretical proof, and the experimental sections support it empirically with FGSM and PGD attacks on MNIST and ImageNet.

Load-bearing premise

Everything hangs on the claim that adversarial perturbations are high-frequency noise, a premise the paper states as proven in Section 3 without actually presenting that proof.

Editorial extensions

If this is right

  • A deployment can add adversarial detection without retraining or modifying the target classifier: only a Gaussian or median filter and a fixed threshold are inserted in front of it.
  • Because the decision requires only the classifier's confidence outputs, the same detector design transfers across architectures and datasets, as shown with MNIST and ImageNet.
  • The filtered output can be used not just to reject adversarial inputs but, in many cases, to recover the true class from an adversarial image, effectively a preprocessing defense as well as a detector.
  • Compared with feature-squeezing detectors that need per-setting thresholds, the fixed-threshold design removes a manual tuning step that could overburden operators.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that an adversary aware of the sieve could shift perturbation energy into low-frequency bands or optimize the perturbation to keep the filtered anchor probability stable; testing such adaptive attacks would directly probe the high-frequency premise.
  • The same anchor-versus-filtered comparison generalizes to other denoisers, such as bilateral filters or wavelet shrinkage, because the mechanism only requires that attack noise be attenuated more than benign content.
  • The reported 99.7–100% figures are specific to the constructed test sets and attack settings; worst-case guarantees would require a different evaluation, so the numbers should be read as strong evidence for the mechanism rather than as an upper bound on detection difficulty.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes an automated detection system for adversarial examples based on the hypothesis that adversarial perturbations are predominantly high-frequency. The system runs the input through a low-pass filter (Gaussian or median) and compares the classifier's confidence in the original highest-confidence class before and after filtering; if the difference exceeds a threshold, the input is flagged as adversarial. The authors evaluate on MNIST and ImageNet with FGSM and PGD attacks and report detection accuracies of 99.7–100% in many settings, claiming superiority over feature squeezing (Xu et al.). Section 3 is said to contain a theoretical proof of the frequency-domain hypothesis, and the paper claims the system is fully automatic with a fixed threshold.

Significance. If the claimed detection rates were valid, the work would be a useful contribution to adversarial-example detection, and the algorithm-style presentation (Algorithms 1 and 2) makes the method easy to test and compare. The paper also identifies threshold selection as a weakness of prior work. However, the evidence presented is not sufficient to establish the claims: the promised theoretical proof is absent, the thresholds appear to be chosen using the test data, no adaptive attacks are considered, and the evaluation is narrow (two datasets, two attacks, no error bars). The central hypothesis about high-frequency adversarial noise is asserted rather than demonstrated, and the reported detection rates are not reliable as evidence.

major comments (5)
  1. [Section 3, especially Sec. 3.2] The paper states in Section 1 and Section 3 that a theoretical proof of the high-frequency assumption is provided, but no such proof appears anywhere in the text. The only supporting evidence is the qualitative example in Fig. 3. Since the entire detection mechanism rests on the premise that low-pass filtering removes adversarial noise while preserving benign features, this missing proof is a load-bearing gap that must be addressed.
  2. [Tables 1 and 2] The thresholds Θ=0.1 (MNIST) and Θ=0.92 (ImageNet) are reported as 'fixed,' but the manuscript does not describe how they were chosen or whether they were selected on a validation set disjoint from the test set. Reporting 99.7–100% detection on the same data used to determine the thresholds is circular and likely overstates performance. The paper should provide a threshold-selection procedure, error bars, and results on held-out sets.
  3. [Section 4.3 and Algorithm 2] The evaluation considers only white-box FGSM and PGD attacks; no adversary that knows the sieve mechanism is tested. Because the detection rule is deterministic (comparing filtered and unfiltered classifier confidence), an adaptive adversary can craft perturbations with low-frequency energy or perturbations that keep the filtered confidence nearly unchanged. Without such experiments, the claim that the system can 'mostly distinguish adversarial samples and benign images in an end-to-end manner' is unsupported.
  4. [Section 4.1 and Table 2] The comparison with Xu et al. [21] is not controlled: the datasets differ in size (3,000 vs 1,800 for ImageNet), class balance, and threshold choices, and no confidence intervals are reported. The statement that 'our detection rates exceeded those of Xu et al.' is therefore not justified by the data presented.
  5. [Section 4.2] The sentence 'The proposed detection system knows the true labels of the input' directly contradicts the claimed automatic, end-to-end operation. If the true label is used anywhere in the detection decision, the method is not an automated detector; if not, the sentence must be corrected. This ambiguity undermines the paper's central claim.
minor comments (6)
  1. [Section 2.1 heading] The heading 'Related W orks' contains a typo and should read 'Related Works'.
  2. [Section 2.1] 'Carnili et al.' should be 'Carlini et al.'; the reference list correctly cites Carlini and Wagner [2].
  3. [Equation (3) and Algorithm 1] Equation (3) is malformed: the projection operator 'project (x,ϵ)(x∗)' is not clearly defined. In Algorithm 1, the first line 'x← x∗' should be 'x∗← x' to initialize the adversarial sample from the clean input.
  4. [Abstract, Section 4.3, and Section 5] The abstract and conclusion overstate the results: the abstract reports an out-detection rate of 99.7–100%, but Table 2 shows accuracy of 0.983 (DSG) and 0.958 (DSM) on ImageNet, with only DSM recall reaching 1.0. Section 5 claims 'maximum accuracy rates of 99.9% and 100%,' which does not match the accuracy values in Tables 1 and 2.
  5. [Figure 3 caption] The caption contains spelling errors ('Orginal', 'suffer to DSG') and should be corrected for clarity.
  6. [Algorithm 2] Algorithm 2 loops over kernel sizes κ = [(3×3); (5×5)], but the final decision uses p(sievey) without specifying how results from different kernel sizes are aggregated; the effect of κ on the output should be clarified.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the sieve detector is an empirical low-pass-filter-plus-threshold heuristic; its high-frequency premise is asserted rather than derived, but no claim reduces by construction to its inputs or to a self-citation.

full rationale

The paper's detection chain is: assume adversarial perturbations concentrate in high frequencies; low-pass filter the input; compare the confidence of the highest-confidence class before and after filtering against a threshold. Each step is an empirical hypothesis or an engineering choice, not a derivation in which the output is identical to an input. The promised 'theoretical proof' in Section 3 is not present, and the evaluation only covers FGSM/PGD attacks on a single-target-class benchmark, which limits how much the 99.7-100% rates support the general claim. However, these are validity and robustness concerns, not circularity: the paper does not define the high-frequency assumption in terms of the detection result, does not fit a parameter and then rename it a prediction, and does not rely on a load-bearing self-citation or uniqueness theorem. The per-dataset thresholds (0.1 and 0.92) are reported as fixed parameters; the paper does not describe their selection or a validation split, so the detection rates may be optimistic, but without evidence that the thresholds were tuned on the same test set and then presented as predictions, this cannot be classified as circular under the requirement to exhibit a specific reduction. No circular step meets the evidentiary bar.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central claim rests on the untested high-frequency assumption, per-dataset thresholds fitted to the test sets, and a threshold-based separability assumption. No code, data, or formal verification artifacts are provided.

free parameters (2)
  • Detection threshold Theta = 0.1 on MNIST, 0.92 on ImageNet
    Threshold used to compare the anchor and sieved probabilities. Values appear to be selected per dataset after observing the test data and are not derived or validated on held-out data (Tables 1 and 2).
  • Filter kernel size kappa = 3x3 and 5x5
    Kernel sizes for the Gaussian and median filters are chosen by hand. Algorithm 2 iterates over both sizes, but the result tables do not report performance per kernel size.
assumptions (3)
  • domain assumption Adversarial perturbations are created in high frequencies and low-pass filtering removes them while preserving benign content.
    Invoked in Sections 1 and 3.2. The claimed proof in Section 3 is not present, and low-frequency adversarial perturbations are not considered.
  • domain assumption The classifier's confidence on the anchor class changes predictably when adversarial noise is filtered out, so a fixed threshold separates adversarial and benign inputs.
    Algorithm 2 compares the anchor probability before and after sieving. The separability of the probability difference is assumed, not demonstrated on held-out data.
  • domain assumption The target classifier is fixed and the threat model excludes attackers who know the detector and adapt to it.
    The evaluation uses white-box FGSM and PGD attacks against the classifier but does not consider attacks that target the sieve or that deliberately place perturbations in low frequencies.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Automated Detection System for Adversarial Examples with High-Frequency Noises Sieve." pith.science (2026). https://pith.science/paper/AOZ5ECKF

@misc{pith2026190801469,
  author       = {Pith},
  title        = {Pith review of: Automated Detection System for Adversarial Examples with High-Frequency Noises Sieve},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AOZ5ECKF}},
  note         = {Machine review of arXiv:1908.01469}
}
read the original abstract

Deep neural networks are being applied in many tasks with encouraging results, and have often reached human-level performance. However, deep neural networks are vulnerable to well-designed input samples called adversarial examples. In particular, neural networks tend to misclassify adversarial examples that are imperceptible to humans. This paper introduces a new detection system that automatically detects adversarial examples on deep neural networks. Our proposed system can mostly distinguish adversarial samples and benign images in an end-to-end manner without human intervention. We exploit the important role of the frequency domain in adversarial samples and propose a method that detects malicious samples in observations. When evaluated on two standard benchmark datasets (MNIST and ImageNet), our method achieved an out-detection rate of 99.7 - 100% in many settings.

Figures

Figures reproduced from arXiv: 1908.01469 by the authors.

Figure 1
Figure 1. Processes of our automated detection system: an input is duplicated and [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Attack Phase Samples. 4.3 Results Our results were compared with those of Xu et al. [21]. Our system is more convenient that Xu’s system, owing to its high detection accuracy and easy setup. Specifically, our system adopts a fixed threshold whereas Xu et al.’s system must adapt the threshold value to individual cases. The performance of our system was evaluated by the F1-score. When based on the Gaussian and median … view at source ↗
Figure 3
Figure 3. Original image (true class: Oscilloscope) and Adversarial image suffer to [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

21 extracted references · 12 canonical work pages

  1. [21]

    In: 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21 (2018)

    Xu, W., Evans, D., Qi, Y.: Feature squeezing: Detecting adversarial examples in deep neural networks. In: 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21 (2018)

    work page 2018

  2. [1]

    In: Joint European conference on machine learning and knowledge discovery in databases

    Biggio, B., Corona, I., Maiorca, D., Nelson, B., ˇSrndi´ c, N., Laskov, P., Giacinto, G., Roli, F.: Evasion attacks against machine learning at test time. In: Joint European conference on machine learning and knowledge discovery in databases. pp. 387–402. Springer (2013)

    work page 2013

  3. [2]

    In: 2017 IEEE Symposium on Security and Privacy (SP)

    Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy (SP). pp. 39–57. IEEE (2017)

    2017

  4. [3]

    In: International Conference on Learning Representations ICLR (2015), http://arxiv.org/abs/1412.6572

    Goodfellow, I., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial ex- amples. In: International Conference on Learning Representations ICLR (2015), http://arxiv.org/abs/1412.6572

    arXiv 2015

  5. [4]

    In: European Symposium on Research in Com- puter Security

    Grosse, K., Papernot, N., Manoharan, P., Backes, M., McDaniel, P.: Adversarial examples for malware detection. In: European Symposium on Research in Com- puter Security. pp. 62–79. Springer (2017)

    work page 2017

  6. [5]

    CoRR abs/1412.5068 (2014)

    Gu, S., Rigazio, L.: Towards deep neural network architectures robust to adversar- ial examples. CoRR abs/1412.5068 (2014)

    arXiv 2014

  7. [6]

    In: Proceedings of the 4th ACM workshop on Security and artificial intelligence

    Huang, L., Joseph, A.D., Nelson, B., Rubinstein, B.I., Tygar, J.: Adversarial ma- chine learning. In: Proceedings of the 4th ACM workshop on Security and artificial intelligence. pp. 43–58. ACM (2011)

    work page 2011

  8. [7]

    In: International Conference on Learning Representations ICLR (2018)

    Kurakin, A., Boneh, D., Tramr, F., Goodfellow, I., Papernot, N., McDaniel, P.: Ensemble adversarial training: Attacks and defenses. In: International Conference on Learning Representations ICLR (2018)

    work page 2018

Show all 21 references
  1. [8]

    arXiv preprint arXiv:1611.01236 (2016)

    Kurakin, A., Goodfellow, I., Bengio, S.: Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236 (2016)

    2016 arXiv

  2. [9]

    nature 521(7553), 436 (2015) Automated Detection System for Adversarial Examples 15

    LeCun, Y., Bengio, Y., Hinton, G.: Deep learning. nature 521(7553), 436 (2015) Automated Detection System for Adversarial Examples 15

    2015

  3. [10]

    AT&T Labs [Online]

    LeCun, Y., Cortes, C., Burges, C.: Mnist handwritten digit database. AT&T Labs [Online]. Available: http://yann. lecun. com/exdb/mnist 2 (2010)

    2010

  4. [11]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition

    Liao, F., Liang, M., Dong, Y., Pang, T., Hu, X., Zhu, J.: Defense against adver- sarial attacks using high-level representation guided denoiser. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 1778–1787 (2018)

    2018

  5. [12]

    In: 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings (2018)

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learn- ing models resistant to adversarial attacks. In: 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings (2018)

    2018

  6. [13]

    In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Commu- nications Security

    Meng, D., Chen, H.: Magnet: a two-pronged defense against adversarial examples. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Commu- nications Security. pp. 135–147. ACM (2017)

    2017

  7. [14]

    arXiv preprint arXiv:1703.09202 (2017)

    Nayebi, A., Ganguli, S.: Biologically inspired protection of deep networks from adversarial attacks. arXiv preprint arXiv:1703.09202 (2017)

    2017 arXiv

  8. [15]

    In: 2016 IEEE Symposium on Security and Privacy (SP)

    Papernot, N., McDaniel, P., Wu, X., Jha, S., Swami, A.: Distillation as a defense to adversarial perturbations against deep neural networks. In: 2016 IEEE Symposium on Security and Privacy (SP). pp. 582–597. IEEE (2016)

    2016

  9. [16]

    International Journal of Computer Vision 115(3), 211–252 (2015)

    Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al.: Imagenet large scale visual recog- nition challenge. International Journal of Computer Vision 115(3), 211–252 (2015)

    2015

  10. [17]

    International Journal of Pattern Recognition and Artificial Intelligence 23(04), 687–719 (2009)

    Sun, Y., Wong, A.K., Kamel, M.S.: Classification of imbalanced data: A review. International Journal of Pattern Recognition and Artificial Intelligence 23(04), 687–719 (2009)

    2009

  11. [18]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., Wojna, Z.: Rethinking the incep- tion architecture for computer vision. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 2818–2826 (2016)

    2016

  12. [19]

    arXiv preprint arXiv:1312.6199 (2013)

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fer- gus, R.: Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)

    2013 arXiv

  13. [20]

    In: Proceedings of the Twenty-Seventh Inter- national Joint Conference on Artificial Intelligence, IJCAI-18

    Xiao, C., Li, B., yan Zhu, J., He, W., Liu, M., Song, D.: Generating adversarial examples with adversarial networks. In: Proceedings of the Twenty-Seventh Inter- national Joint Conference on Artificial Intelligence, IJCAI-18. pp. 3905–3911 (7 2018)

    2018

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.