Source-linked AI summary
Low Frequency Adversarial Perturbation
Chuan Guo, Jared S. Frank, Kilian Q. Weinberger
TL;DR
Black-box adversarial attacks face high query costs because gradient information is unavailable and searches span high-dimensional perturbation spaces. The paper restricts attacks to a low-frequency domain, making the approach compatible with existing black-box frameworks. It reports 2x–4x query reductions, circumvention of image-transformation defenses, and a Google Cloud Vision attack using 1000 queries.
Problem
Black-box adversarial-image attacks lack gradient information and therefore often require costly searches over high-dimensional perturbation spaces.
Method
The paper restricts adversarial directions to a low-frequency subspace and incorporates this restriction into existing black-box attacks.
Results
Low-frequency attacks reduce query costs by 2x–4x, circumvent JPEG compression and bit-depth reduction defenses, and fool Google Cloud Vision with 1000 model queries.
Takeaways & Limitations
Low-frequency perturbations provide substantial benefits for black-box attacks and can be incorporated into many existing algorithms.
Takeaways & Limitations
The approach relies on the assumption that CNNs respond especially to low-frequency patterns associated with class-defining image information.
Abstract
from arXiv · showhide
Adversarial images aim to change a target model's decision by minimally perturbing a target image. In the black-box setting, the absence of gradient information often renders this search problem costly in terms of query complexity. In this paper we propose to restrict the search for adversarial images to a low frequency domain. This approach is readily compatible with many existing black-box attack frameworks and consistently reduces their query cost by 2 to 4 times. Further, we can circumvent image transformation defenses even when both the model and the defense strategy are unknown. Finally, we demonstrate the efficacy of this technique by fooling the Google Cloud Vision platform with an unprecedented low number of model queries.
1 INTRODUCTION
Black-box adversarial attacks are costly because they search a high-dimensional perturbation space, so this paper restricts adversarial directions to low frequencies. The approach reduces query costs, preserves effective attacks at strong dimensionality reduction, bypasses image-transformation defenses, and fools Google Cloud Vision with 1000 queries.
- Black-box attacks can require 10^4–10^5 queries because they search high-dimensional perturbation spaces without gradient guidance.
- The proposed method explicitly restricts adversarial directions to a low-frequency subspace, where adversarial directions may occur more densely.This restriction is intended to reduce random sampling of non-adversarial directions and query complexity.
- A dimensionality reduction to 1/64 of the original space still yields near-optimal adversarial perturbations.
- Approximately 1000 median model queries produce imperceptibly changed ImageNet adversarial images with low-frequency boundary attack, a 4x reduction versus vanilla boundary attack.
- Low-frequency NES produces a consistent 2x speed-up across images, with around 12,000 median queries for targeted black-box attacks.
- Low-frequency perturbations circumvent JPEG compression and bit-depth reduction defenses that had not previously shown vulnerability to black-box attacks.
- The method fools Google Cloud Vision with an unprecedented 1000 model queries.
2 BACKGROUND
The background formulates adversarial-example generation as finding an imperceptibly different image that changes a model's prediction, while distinguishing attack goals and threat models. It contrasts white-box access with black-box settings that rely on limited queries and may use transfer, gradient-estimation, or decision-based attacks.
- Adversarial-example generation seeks a perturbed image that changes the model's prediction while remaining imperceptibly different from the natural image.
- The perceptual constraint is commonly approximated with MSE, the Euclidean norm, or the max-norm.
- Untargeted attacks seek any incorrect class, whereas targeted attacks seek a specified target class.
- White-box attacks assume full model and training knowledge, while black-box attacks operate with more limited information and access.
- Transfer-based attacks train a substitute model to imitate the target, while gradient-estimation attacks infer gradients from input-output pairs.
- Gradient-estimation attacks generally require queries proportional to image size, whereas decision-based attacks use more restricted model feedback.
3 LOW FREQUENCY IMAGE SUBSPACE
The paper represents adversarial perturbations in a restricted low-frequency DCT subspace, where random attack directions can be sampled more efficiently while retaining strong attack effectiveness. Experiments identify r = 1/8 as a favorable frequency ratio and show that low-frequency restrictions can preserve near-optimal perturbations and improve black-box search.
- Low-frequency subspace: Low-frequency adversarial directions occupy a reduced subspace that can contain a high density of adversarial examples, enabling more efficient sampling.The motivation is that high-dimensional image-space sampling produces many non-adversarial directions and high query complexity.
- DCT representation: The DCT decomposes images into cosine-wave coefficients, with lower indices representing lower frequencies, and IDCT reconstructs the image from those coefficients.DCT and IDCT are invertible, isometric transforms, and can be applied independently across color channels.
- Sampling low-frequency noise: LF-DCT noise is sampled by retaining only the top-left rd × rd frequency coefficients and applying IDCT to map the perturbation back into pixel space.The resulting noise has non-zero cosine coefficients only below the frequency cutoff rd.
- Random-noise evaluation: r = 1/8 is the empirical sweet spot, corresponding to a 1/64 dimensionality reduction and the highest area under the success-rate curve.Across perturbation magnitudes, success rate increases with ρ, while r = 1 has the worst success rate among the tested ratios.
- White-box optimality: 100% success at r = 1/8 shows that optimizing in a frequency space of dimensionality 2352 can match full-image Carlini-Wagner effectiveness despite a 1/64-sized search space.Very small frequency ratios eventually reduce success because the subspace becomes too limited to admit adversarial perturbations.
- Boundary attack: Low-frequency boundary attack sampling improves convergence because sampled directions are more often adversarial, reducing repeated resampling and model queries.The modification replaces Gaussian pixel-space noise with noise drawn from the low-frequency distribution via IDCT.
4 APPLICATION TO BLACK-BOX ATTACKS
The paper adapts black-box boundary and NES attacks by restricting perturbation search to a low-frequency subspace, reducing wasted exploration in high-dimensional pixel space. Low-frequency sampling integrates readily into both attack frameworks while preserving their optimization pipelines.
- Motivation: The low-frequency restriction reduces random sampling of non-adversarial directions, addressing query complexity that otherwise scales with image dimensionality.The method is proposed as a broadly compatible tool for improving black-box attack query efficiency.
- Boundary attack: The boundary attack iteratively perturbs an adversarial image, projects it around the target image, contracts toward that target, and accepts only adversarial iterates.The procedure maintains adversariality while gradually reducing perturbation distance.
- Attack modifications: Low-frequency noise replaces full-space or Gaussian sampling in boundary and NES attacks, producing low-frequency adversarial perturbations.For boundary attack, noise is sampled through the low-frequency transform; for NES, the Gaussian search distribution is replaced by its low-frequency version.
- Frequency selection: Hyperband selects the frequency ratio r per image by terminating less successful parallel attack runs until one frequency remains.Candidate ratios are evaluated repeatedly, with the total process bounded by a query budget.
- NES attack: NES minimizes a loss over points near the current image by estimating a stochastic gradient from sampled noise vectors and projecting updates into the perceptibility region.The update pushes the image away from directions associated with high adversarial loss; the max-norm constraint is enforced by clipping.
5 EMPIRICAL EVALUATION
Experiments on ImageNet and image transformation defenses evaluate low-frequency boundary and NES attacks against pretrained ResNet-50 models, with additional tests on Google Cloud Vision. Across these settings, low-frequency variants reduce query requirements, adapt frequency selection, and succeed where RGB-BA fails against defenses.
- Transformation defenses: Against JPEG compression and 3-bit reduction, RGB-BA fails to make progress, whereas LF-BA reduces average MSE to 0.001 after 30,000 model queries.The defense evaluation uses quality level 75 JPEG compression and reduces bit depth to 3 bits.
- Query efficiency: 1128 median queries for LF-BA versus 4020 for RGB-BA, an almost 4x reduction; LF-NES requires 12,444 versus 22,389 median queries for RGB-NES, an approximately 2x reduction.The query distributions are shifted left for both low-frequency attacks, especially LF-BA.
- Frequency selection: Adaptive frequency selection outperforms fixed ratios by combining rapid initial MSE reduction with continued later progress.Higher ratios descend rapidly but stall after 2500 iterations, while lower ratios progress more slowly; Hyperband selects the effective ratio adaptively.
- Query efficiency: LF-BA reaches the same average MSE as RGB-BA in less than 3000 queries instead of 30,000 on the undefended model.This constitutes an order of magnitude reduction in queries for that comparison.
- Transformation defenses: On defended models, LF-BA produces imperceptible perturbations with high probability, while RGB-BA consistently fails to do so.On the undefended model, neither attack produces a visible difference between clean and perturbed images.
- Comparative results: LF-BA uses 5x fewer queries than RGB-BA and 24x fewer than Opt-attack at the same average L2-norm/MSE.For targeted attacks, LF-NES uses half as many queries as RGB-NES at the same perturbation norm and achieves a higher success rate.
6 DISCUSSION AND FUTURE WORK
The study concludes that image adversarial attacks can operate exclusively in low-frequency signal components, providing substantial black-box benefits and compatibility with existing algorithms. It identifies extensions to other data modalities and searches for alternative adversarial subspaces as future directions.
- Discussion: Low-frequency perturbations can be incorporated into many existing black-box attack algorithms and substantially improve their query efficiency.The paper connects this result to follow-up work using coordinate descent that also exploits adversarial perturbations in the low-frequency subspace.
- Future work: Similar low-frequency approaches may apply to speech recognition systems or time series data, while other subspaces may reveal denser adversarial regions.The paper presents these as promising future directions rather than demonstrated results.