From a Fourier-Domain Perspective on Adversarial Examples to a Wiener Filter Defense for Semantic Segmentation

Despite recent advancements, deep neural networks are not robust against\nadversarial perturbations. Many of the proposed adversarial defense approaches\nuse computationally expensive training mechanisms that do not scale to complex\nreal-world tasks such as semantic segmentation, and offer only marginal\nimprovements. In addition, fundamental questions on the nature of adversarial\nperturbations and their relation to the network architecture are largely\nunderstudied. In this work, we study the adversarial problem from a frequency\ndomain perspective. More specifically, we analyze discrete Fourier transform\n(DFT) spectra of several adversarial images and report two major findings:\nFirst, there exists a strong connection between a model architecture and the\nnature of adversarial perturbations that can be observed and addressed in the\nfrequency domain. Second, the observed frequency patterns are largely image-\nand attack-type independent, which is important for the practical impact of any\ndefense making use of such patterns. Motivated by these findings, we\nadditionally propose an adversarial defense method based on the well-known\nWiener filters that captures and suppresses adversarial frequencies in a\ndata-driven manner. Our proposed method not only generalizes across unseen\nattacks but also beats five existing state-of-the-art methods across two models\nin a variety of attack settings.\n