Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Detecting AutoAttack Perturbations in the Frequency Domain

Peter Lorenz, Paula Harder, Dominik Strassel, Margret Keuper, Janis Keuper

TL;DR

Adversarial attacks like AutoAttack threaten image classifiers, highlighting the limitations of robustness-only defenses. The authors propose inference-time detection using frequency-domain features—specifically, the magnitudes of 2D Fourier coefficients—to distinguish clean from perturbed inputs. They implement two detectors: a black-box variant operating on input images and a white-box variant using selected CNN feature maps, both relying on Fourier power spectra and discarding phase information. The detectors achieve near-perfect performance on CIFAR-10 and strong results on ImageNet at $\varepsilon=8/255$, indicating a practical, lightweight defense that can complement or reduce reliance on adversarial training. This work provides a frequency-domain perspective on adversarial perturbations with potential for real-world deployment and further generalization studies.

Abstract

Recently, adversarial attacks on image classification networks by the AutoAttack (Croce and Hein, 2020b) framework have drawn a lot of attention. While AutoAttack has shown a very high attack success rate, most defense approaches are focusing on network hardening and robustness enhancements, like adversarial training. This way, the currently best-reported method can withstand about 66% of adversarial examples on CIFAR10. In this paper, we investigate the spatial and frequency domain properties of AutoAttack and propose an alternative defense. Instead of hardening a network, we detect adversarial attacks during inference, rejecting manipulated inputs. Based on a rather simple and fast analysis in the frequency domain, we introduce two different detection algorithms. First, a black box detector that only operates on the input images and achieves a detection accuracy of 100% on the AutoAttack CIFAR10 benchmark and 99.3% on ImageNet, for epsilon = 8/255 in both cases. Second, a whitebox detector using an analysis of CNN feature maps, leading to a detection rate of also 100% and 98.7% on the same benchmarks.

Detecting AutoAttack Perturbations in the Frequency Domain

TL;DR

Adversarial attacks like AutoAttack threaten image classifiers, highlighting the limitations of robustness-only defenses. The authors propose inference-time detection using frequency-domain features—specifically, the magnitudes of 2D Fourier coefficients—to distinguish clean from perturbed inputs. They implement two detectors: a black-box variant operating on input images and a white-box variant using selected CNN feature maps, both relying on Fourier power spectra and discarding phase information. The detectors achieve near-perfect performance on CIFAR-10 and strong results on ImageNet at , indicating a practical, lightweight defense that can complement or reduce reliance on adversarial training. This work provides a frequency-domain perspective on adversarial perturbations with potential for real-world deployment and further generalization studies.

Abstract

Recently, adversarial attacks on image classification networks by the AutoAttack (Croce and Hein, 2020b) framework have drawn a lot of attention. While AutoAttack has shown a very high attack success rate, most defense approaches are focusing on network hardening and robustness enhancements, like adversarial training. This way, the currently best-reported method can withstand about 66% of adversarial examples on CIFAR10. In this paper, we investigate the spatial and frequency domain properties of AutoAttack and propose an alternative defense. Instead of hardening a network, we detect adversarial attacks during inference, rejecting manipulated inputs. Based on a rather simple and fast analysis in the frequency domain, we introduce two different detection algorithms. First, a black box detector that only operates on the input images and achieves a detection accuracy of 100% on the AutoAttack CIFAR10 benchmark and 99.3% on ImageNet, for epsilon = 8/255 in both cases. Second, a whitebox detector using an analysis of CNN feature maps, leading to a detection rate of also 100% and 98.7% on the same benchmarks.
Paper Structure (8 sections, 4 equations, 1 figure, 5 tables)

This paper contains 8 sections, 4 equations, 1 figure, 5 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Methods: dft based Detection
  4. Black-Box Detection: Fourier Features of Input Images
  5. White-Box Detection: Fourier Features of Feature-Maps
  6. Measuring Adversarial Detection
  7. Experiments
  8. Discussion and Conclusion

Figures (1)

  • Figure 1: Visualization of AutoAttack perturbations on a ResNet18 for CIFAR10. The top row: APGD-CE $\ell_\infty$ attack, bottom row: Squares $\ell_\infty$ attack. Left column shows the spacial difference between a random test image from CIFAR10 and its perturbation. The center column depicts the mean of spacial differences over 1000 perturbed images. Right column: accumulated magnitudes of the spectral differences over the same 1000 images. While there are no obvious clues that can be obtained from the spacial domain, the frequency representation of perturbations show significant and systematic changes which can be exploited to detect attacks.