F-mixup: Attack CNNs From Fourier Perspective

Abstract

Recent research has revealed that deep neural networks are highly vulnerable to adversarial examples. In this paper, different from most adversarial attacks which directly modify pixels in spatial domain, we propose a novel black-box attack in frequency domain, named as \textit{f-mixup}, based on the property of natural images and perception disparity between human-visual system (HVS) and convolutional neural networks (CNNs): First, natural images tend to have the bulk of their Fourier spectrums concentrated on the low frequency domain; Second, HVS is much less sensitive to high frequencies while CNNs can utilize both low and high frequency information to make predictions. Extensive experiments are conducted and show that deeper CNNs tend to concentrate more on the higher frequency domain, which may explain the contradiction between robustness and accuracy. In addition, we compared \textit{f-mixup} with existing attack methods and observed that our approach possesses great advantages. Finally, we show that \textit{f-mixup} can be also incorporated in training to make deep CNNs defensible against a kind of perturbations effectively.