# Towards Imperceptible Universal Attacks on Texture Recognition

Yingpeng Deng1 and Lina J. Karam1,2
1Image  Video and Usability Lab  School of ECEE  Arizona State University
Tempe  AZ  USA
2Dept. of ECE  School of Engineering  Lebanese American University  Lebanon
<EMAIL_ADDRESS>
###### Abstract

Although deep neural networks (DNNs) have been shown to be susceptible to
image-agnostic adversarial attacks on natural image classification problems,
the effects of such attacks on DNN-based texture recognition have yet to be
explored. As part of our work, we find that limiting the perturbation’s
$l_{p}$ norm in the spatial domain may not be a suitable way to restrict the
perceptibility of universal adversarial perturbations for texture images.
Based on the fact that human perception is affected by local visual frequency
characteristics, we propose a frequency-tuned universal attack method to
compute universal perturbations in the frequency domain. Our experiments
indicate that our proposed method can produce less perceptible perturbations
yet with a similar or higher white-box fooling rates on various DNN texture
classifiers and texture datasets as compared to existing universal attack
techniques. We also demonstrate that our approach can improve the attack
robustness against defended models as well as the cross-dataset
transferability for texture recognition problems.

##  1 Introduction

no attack

brick 100%

stripped 15%

linen 54%

GAP-tar [50]
aluminum 66%
STSIM: 0.8969

stripped 14%
STSIM: 0.8707

linen 47%
STSIM: 0.9395

FTGAP (ours)
moss 100%
STSIM: 0.9059

grid 5%
STSIM: 0.9260

corduroy 51%
STSIM: 0.9675

Figure 1: Comparison between GAP-tar [50] and our FTGAP universal attack
methods. We show the visual examples of clean images (first column), GAP-tar
(second column) and our FTGAP (third column) on different texture datasets
(from top to bottom: GTOS [73, 72], DTD [6] and KTH [4]) in each row. Under
each image are the groundtruth class (green) or perturbed class (red) with the
corresponding confidence scores. The similarity index STSIM [79] of each
perturbed image in the second & third columns with the corresponding clean
image in the first column is also given below the classification result.

While DNNs achieved considerable success in various computer vision problems
[61, 63, 23, 39, 54, 18, 53], they were also shown to be vulnerable to
adversarial attacks [20, 5, 43, 69, 24, 32]. An adversarial attack generally
produces a small perturbation which is added to the input image(s) to fool the
DNN, even though such a perturbation is not enough to degrade the image
quality and fool the human vision. Many existing adversarial attacks are
white-box attacks, where one can have full knowledge about the targeted DNN
model such as the architecture, weight and gradient information for computing
the perturbation. Adversarial attacks can be categorized as image-dependent
[64, 20, 44, 31, 48, 5] or image-agnostic (universal) [43, 50, 56, 13]
attacks. Compared to the former, the latter can be more challenging to
generate given that a universal perturbation is often computed to
significantly lower the performance of the targeted DNN model on a whole
training image set as well as on unseen validation/test sets.

Although many current universal attack methods have been designed for
classification tasks involving natural images (e.g., ImageNet [55]), little
work has been done to explore the existence of effective universal attacks
against DNNs for texture image recognition tasks [75, 72, 26]. Thus in this
paper, we explore the generation of universal adversarial attacks on texture
image recognition.

Existing universal attack methods usually limit the perceptibility of the
computed perturbation by setting a small and fixed $l_{p}$ norm threshold
($\left\|\delta\right\|_{\infty}\leq 10$ for example). This type of
thresholding method treats different image/texture regions identically and
does not take human perception sensitivity to different frequencies into
consideration. In this work, we propose a frequency-tuned universal attack
method, which is shown to further improve the effectiveness of the universal
attack in terms of increasing the fooling rate while reducing the
perceptibility of the adversarial perturbation. Instead of optimizing the
perturbation directly in the spatial domain, the proposed method generates a
frequency-adaptive perturbation by tuning the computed perturbation according
to the frequency content. For this purpose, we adopt a perceptually motivated
just noticeable difference (JND) model based on frequency sensitivity in
different frequency bands. A similar method has shown its potential on the
natural image classification problem [12]. As shown in Figure 1, the proposed
universal attack algorithm can easily convert correct predictions into wrong
labels with less perceptible perturbations.

Our contributions are summarized as follows:

  * •

We examine the effectiveness of four current universal attack algorithms [43,
50, 56, 13] by attacking four DNN-based texture classifiers [23, 75, 72, 26]
that are trained on six different texture recognition datasets [3, 73, 72, 6,
66, 58, 4].

  * •

We propose a frequency-tuned universal attack method to generate a less
perceivable perturbation for texture images while providing a similar or
better performance in terms of white-box fooling rate as compared to the
state-of-the-art.

  * •

We demonstrate that our proposed method is more robust against a universal
adversarial training defense strategy [56] and possesses better out-of-
distribution generalization when tested across datasets.

  * •

With the standard data augmentation strategy [30, 75], our proposed method can
maintain a robust performance even when the training image dataset is
significantly reduced in size (i.e., to $\approx$ 0.1% of the training
dataset).

##  2 Related Work

###  2.1 Texture Recognition

Texture recognition has been widely explored for many decades. Right before
the prevalence of DNNs, discriminative features were commonly extracted from
texture patterns through diverse types of methods, such as Scale-Invariant
Feature Transform (SIFT) [40], Bag-of-Words (BoWs) [9], Vector of Locally
Aggregated Descriptors (VLAD) [27], Fisher Vector (FV) [49], etc. Cimpoi et
al. [7] used pretrained DNNs to extract deep features from texture images and
achieved cutting-edge performance.

Later, research works turned to adaptive modifications of end-to-end DNN
architectures. Andrearczyk and Whelan [2] took AlexNet [30] as backbone and
concatenated computed energy information with convolutional layers to the
first flatten layer. Lin and Maji [34] introduced the bilinear convolutional
neural network [35] to compute the outer product of the feature maps as the
texture descriptor. By adopting ResNet [23], Dai et al. [11] captured the
second order information of convolutional features by the deep bilinear model
and fused it with the first order information of convolutional features before
the final layer, while Zhang et al. [75] proposed a deep texture encoding
network (DeepTEN) by inserting a residual encoding layer with learnable
dictionary codewords before the decision layer. To improve on the method of
Zhang et al. [75], Xue et al. [72] combined the global average pooling
features with the encoding pooling features through a bilinear model [17] in
their deep encoding pooling (DEP) network, followed by a multi-level texture
encoding and representation (MuLTER) [26] to aggregate multi-stage features
extracted using the DEP module.

###  2.2 Image-Dependent Attacks

Figure 2: Block diagram of the proposed frequency-tuned generative adversarial
perturbation (FTGAP). $p$ is a fixed input pattern, that is randomly sampled
from a uniform distribution, of the generator $G$. For $G$, we adopt a ResNet
generator, consisting of 8 consecutive residual blocks [50]. $\delta_{G}$ and
$\delta_{r}$ denote the intermediate perturbations of the output of the
generator and reshaping stage, respectively. $\delta_{DCT}$ is obtained after
scaling using the computed DCT-domain threshold set $\hat{t}_{DCT}$, and is
transformed by the iDCT into a spatial-domain perturbation $\delta$, which is
added to the stochastic training batch $B$. The loss is computed to update the
generator (orange) only during training via backpropagation while the other
parts (blue) are kept frozen.

An image-dependent perturbation is usually computed for each input image
separately to maximize the attack power. Aiming to maximize the loss between
the prediction and the true label or designed logit distance function,
researchers came up with various image-dependent white-box attack methods such
as box-contrained L-BFGS [64], JSMA [48], DeepFool [44], C&W [5] and the
family of FGSM based attacks [20, 31, 14, 70, 15], while constraining the
$l_{p}$ norm of the adversarial perturbation.

However, $l_{p}$-norm constraints may not be suitable in limiting the
perturbation perceptibility [59]. In order to reduce the perturbation
perceptibility for image-dependent attacks, alternative approaches were
proposed to generate sparse adversarial perturbations [62, 71, 42, 8, 16],
while others were based on perceptually motivated measurements with the
constraints formulated in terms of human perceptual distance [41], pixel-wise
JND models [68, 76] and perceptual color distance [77]. Overall, these image-
dependent methods aimed to compute the imperceptibility metrics (either
sparsely perturbed pixel locations or perceptual measurement) directly using
image-specific information of the perturbed image. In many cases, even without
a perceptibility constraint, image-dependent attacks can be easily made
invisible by finding the minimal effective perturbation (e.g., [44]). In
contrast, our proposed method generates image-content-agnostic perturbations,
in which case reducing the perceptibility is more chanllenging given that the
evaluated images are inaccesible during training. Furthermore, in our proposed
approach, the perturbation perceptibility is constrained by adaptively tuning
the perturbation according to frequency bands’ characteristics.

Adversarial attacks in the frequency domain have already been explored, many
of which limited or emphasized the perturbations on low frequency content to
construct effective image-dependent attacks [78, 21, 60, 10, 57] or
computationally efficient black-box attacks [22, 37]. Yin et al. [74]
constructed image-dependent perturbations by randomly corrupting up to two
sampled Fourier bands.

###  2.3 Universal Attacks

A universal, image-agnostic perturbation can drastically reduce the prediction
accuracy of the targeted DNN model when applied to all the images in the
training/validation/testing set. Based on DeepFool [44], Moosavi-Dezfooli et
al. [43] generated universal adversarial perturbations (UAP) by accumulating
the updates iteratively for all the training images. Later, some works such as
generative adversarial perturbation (GAP) [50] and network for adverary
generation (NAG) [52] adopted generative adversarial networks (GANs) [19] to
produce universal perturbations. Recently, the authors of [47] and [56]
generated universal adversarial perturbations by adopting a mini-batch based
stochastic projected gradient descent (sPGD) during training and maximizing
the average loss over each mini-batch. Li et al. [33] presented a method for
producing transferable universal perturbations that are resilient to defenses
by homogenizing the perturbation components regionally. Most recently, Deng
and Karam [13] proposed a universal projected gradient descent (UPGD) method
by integrating a PGD attack [31] with momentum boosting in the UAP framework
[43].

There are also white-box universal attack methods [46, 51, 45, 36] which do
not make use of training data. These data-free methods are unsupervised and
not as strong as the aforementioned supervised ones. As for frequency-domain
universal attacks, Tsuzuku and Sato [65] came up with a black-box universal
attack by characterizing the computed UAP in the Fourier domain and exploring
the effective perturbations that are generated on different Fourier basis
functions. This frequency-domain method is black-box, whose performance is
generally weaker as compared to UAP.

##  3 Proposed Frequency-Tuned Universal Attack

For generating universal adversarial perturbations, we propose a novel
perceptually motivated frequency-tuned generative adversarial perturbation
(FTGAP) framework, where the perturbation is generated by computing individual
perturbation components in each of the frequency bands. As illustrated in
Figure 2, the integration of an inverse discrete cosine transform (iDCT) stage
during the training process forces the perturbation to be generated in the DCT
frequency-based domain ($\delta_{DCT}$ just before the iDCT stage in Figure 2)
and allows the generated perturbation to be adapted to the local
characteristics of each frequency band so as to achieve the best tradeoff
between the attack’s strength and imperceptibility.

For the generator, we adopt a ResNet generator consisting of eight consecutive
residual blocks as in [50]. First, a $3\times 224\times 224$ (channel first)
pattern is randomly sampled from a uniform distribution between $0$ and $1$
and then fixed during training. By inputing the fixed pattern into a ResNet
generator ended with a tanh function, the generated output with the same size
of $3\times 224\times 224$ has all the element values in the range of $-1$ to
$1$. The resulting generator’s output is reshaped into a tensor
$\delta_{r}(c,k,\hat{n}_{1},\hat{n}_{2})$ of size $3\times 64\times 28\times
28$, where 64 denotes the number of frequency bands (flattened $8\times 8$ DCT
block) and $28\times 28$ indicates the number of $8\times 8$ blocks in each
$224\times 224$ input channel. For the frequency band $k$, the reshaped output
tensor $\delta_{r}$ is scaled to ensure that the $l_{\infty}$ norm of each
frequency band is limited by the corresponding $\hat{t}_{DCT}$ (Section 3.2),
resulting in the DCT-domain perturbation $\delta_{DCT}$. The generated DCT-
domain universal perturbation $\delta_{DCT}$ is transformed by the iDCT into a
spatial-domain perturbation, that is added to the stochastic mini-batch $B$.
We then feed the perturbed image batch, which is clipped to the valid image
scale (e.g., $[0,255]$ for 8-bit images), into the targeted model, i.e., the
DNN-based texture classifier, and compute the loss. In [50], the authors
suggested two types of loss functions, $L_{tar}$ and $L_{llc}$, for universal
attacks. Let $L_{ce}$ represent the cross-entropy loss which is used to train
the targeted model. The first one, $L_{tar}$, maximizes the cross-entropy
loss, $L_{ce}$, based on the prediction $\hat{y}$ and the true label (target)
$y_{tar}$:

$\small L_{tar}=-L_{ce}(\hat{y},y_{tar}).$ (1)

The second one, $L_{llc}$, minimizes the cross-entropy between $\hat{y}$ and
the least likely class $y_{llc}$ during prediction:

$\small L_{llc}=L_{ce}(\hat{y},y_{llc}).$ (2)

In our universal attack experiments, we found that using $L_{tar}$ results in
a significantly improved performance as compared to $L_{llc}$ in terms of
fooling rates (Section 4.1), so we adopt $L_{tar}$ in our FTGAP method. Note
that only the generator is updated via gradient backpropagation during
training. Once the training process is completed, the generator can be
discarded and the computed perturbation is stored for evaluation.

Further details about the computation of the DCT/iDCT and the perceptually
motivated frequency-adaptive thresholds $\hat{t}_{DCT}$, are provided in
Sections 3.1 and 3.2, respectively.

###  3.1 Discrete Cosine Transform

The Discrete Cosine Transform (DCT) is a fundamental spatial-frequency
transform tool which is extensively used in signal, image and video
processing, especially for data compression, given its properties of energy
compaction and of being a real-valued transform. We adopt the orthogonal Type-
II DCT, whose formula is identical to its inverse DCT (iDCT). The DCT formula
can be expressed as:

$\small
X(k_{1},k_{2})=\sum_{n_{1}=0}^{N_{1}-1}\sum_{n_{2}=0}^{N_{2}-1}x(n_{1},n_{2})c_{1}(n_{1},k_{1})c_{2}(n_{2},k_{2}),$
(3) $\small
c_{i}(n_{i},k_{i})=\tilde{c_{i}}(k_{i})\cos\left(\frac{\pi(2n_{i}+1)k_{i}}{2N_{i}}\right),$
(4)
$\small\tilde{c_{i}}(k_{i})=\left\\{\begin{array}[]{rcl}\sqrt{\frac{1}{N_{i}}},&k_{i}=0\\\
\sqrt{\frac{2}{N_{i}}},&k_{i}\neq 0\end{array}\right.,$ (5)

where $\ 0\leq n_{i},k_{i}\leq N_{i}-1$ and $\ i=1,2$. In Equation 3,
$x(n_{1},n_{2})$ is the image pixel value at location $(n_{1},n_{2})$ and
$X(k_{1},k_{2})$ is the DCT of the $N_{1}\times N_{2}$ image block (e.g.,
$N_{1}=N_{2}=8$). Using the DCT, an $8\times 8$ spatial-domain block
$x(n_{1},n_{2})$ can be converted to an $8\times 8$ frequency-domain block
$X(k_{1},k_{2})$, with a total of 64 frequency bands. Given a $224\times 224$
color image, we can divide each image channel $c$ into $28\times 28=784$ non-
overlapping $8\times 8$ blocks, leading to its DCT
$X_{c}(\hat{n}_{1},\hat{n}_{2},k_{1},k_{2})$, where $k_{1},k_{2}$ denote 2-D
frequency indices and the 2-D block indices $(\hat{n}_{1},\hat{n}_{2})$
satisfy $0\leq\hat{n}_{1},\hat{n}_{2}\leq 27$.

###  3.2 Perceptual JND Thresholds

The Just Noticeable Difference (JND) is the minimum difference amount to
produce a noticeable variation for human vision. Inspired by human contrast
sensitivity, we adopt luminance-model-based JND thresholds in the DCT domain
to adaptively constrain the $l_{\infty}$ norm of perturbations in different
frequency bands, which can be computed as [1, 25]

$\small
t_{DCT}(k_{1},k_{2})=\frac{MT(k_{1},k_{2})}{2\tilde{c_{1}}(k_{1})\tilde{c_{2}}(k_{2})(L_{max}-L_{min})},$
(6)

where $L_{min}$ and $L_{max}$ are the minimum and maximum display luminance,
and $M=255$ for 8-bit image. To compute the background luminance-adjusted
contrast sensitivity $T(k_{1},k_{2})$, Ahumada and Peterson proposed an
approximating parametric model based on frequency, luminance and viewing
distance [1]. Usually the viewing distance is set to a constant (60 cm for
example), and we use the luminance corresponding to $2^{b-1}$ if the bit depth
is $b$ bits for the considered image (refer to Appendix A for computation
details). The resulting DCT-based $l_{\infty}$ norm JND thresholds
$t_{DCT}(k_{1},k_{2})$ are given below for 64 frequency bands ($0\leq
k_{1},k_{2}\leq 7$ with the top left corner corresponding to $k_{1}=0$ and
$k_{2}=0$):

17.31 | 12.24 | 4.20 | 3.91 | 4.76 | 6.39 | 8.91 | 12.60
---|---|---|---|---|---|---|---
12.24 | 6.23 | 3.46 | 3.16 | 3.72 | 4.88 | 6.70 | 9.35
4.20 | 3.46 | 3.89 | 4.11 | 4.75 | 5.98 | 7.90 | 10.72
3.91 | 3.16 | 4.11 | 5.13 | 6.25 | 7.76 | 9.96 | 13.10
4.76 | 3.72 | 4.75 | 6.25 | 8.01 | 10.14 | 12.88 | 16.58
6.39 | 4.88 | 5.98 | 7.76 | 10.14 | 13.05 | 16.64 | 21.22
8.91 | 6.70 | 7.90 | 9.96 | 12.88 | 16.64 | 21.30 | 27.10
12.60 | 9.35 | 10.72 | 13.10 | 16.58 | 21.22 | 27.10 | 34.39

.

Rather than limiting the perceptibility to be at the JND level, one can
adjust/control the tolerance beyond the JND level with a coefficient matrix
$\lambda(k_{1},k_{2})$. In this way, the final threshold for each DCT
frequency band $(k_{1},k_{2}),0\leq k_{1},k_{2}\leq 7$, can be expressed as

$\small\hat{t}_{DCT}(k_{1},k_{2})=\lambda(k_{1},k_{2})\cdot
t_{DCT}(k_{1},k_{2}).$ (7)

Generally, a human is more sensitive to intensity changes that occur in the
image regions that are dominated by low frequency content than those with high
frequency content. In practice, we found that relaxing high frequency
components beyond the JND thresholds can increase the effectiveness without
severely weakening the imperceptibility of the perturbation. So, in order to
provide a good performance tradeoff between effectiveness and
imperceptibility, we compute $\lambda(k_{1},k_{2})$ based on the radial
frequency $f(k_{1},k_{2})$ (see Equation 12 in Appendix A for the computation
of the radial frequency) that is associated with each DCT frequency band
$(k_{1},k_{2})$ as follows:

$\small\lambda(k_{1},k_{2})=\lambda_{l}(1-S(f(k_{1},k_{2})))+\lambda_{h}S(f(k_{1},k_{2})),$
(8)

where $\lambda_{l}$ ($\lambda_{h}$) is a constant parameter indicating the
gain for low (high) frequency. $S(f(k_{1},k_{2}))$ is a shifted sigmoid
function about $f(k_{1},k_{2})$:

$\small S(f(k_{1},k_{2}))=\frac{1}{1+e^{-(f(k_{1},k_{2})-f_{c})}},$ (9)

where $f_{c}$ is the cut-off frequency between low and high frequency bands.
Given that $S(f(k_{1},k_{2}))$ approaches zero when $f(k_{1},k_{2})\ll f_{c}$
and one when $f(k_{1},k_{2})\gg f_{c}$, $\lambda_{l}$ and $\lambda_{h}$ can be
used to control the perceptibility in low ($f(k_{1},k_{2})<f_{c}$) and high
($f(k_{1},k_{2})>f_{c}$) frequency bands.

##  4 Experimental Results

Table 1: Fooling rates by the universal attacks against different models on
various texture datasets. Bold number indicates best performance and
underlined number denotes the second best performance on the corresponding
model in each column within the same dataset.

| ResNet | DeepTEN | DEP | MuLTER | mean | ResNet | DeepTEN | DEP | MuLTER | mean
---|---|---|---|---|---|---|---|---|---|---
| MINC | GTOS
UAP | 86.6 | 73.1 | 59.8 | 66.4 | 71.5 | 51.0 | 27.7 | 31.6 | 39.0 | 37.3
GAP-llc | 74.9 | 84.4 | 87.1 | 80.3 | 81.7 | 45.9 | 49.6 | 57.6 | 54.6 | 51.9
GAP-tar | 94.1 | 94.8 | 94.5 | 94.2 | 94.4 | 69.5 | 81.5 | 72.5 | 79.0 | 75.6
sPGD | 93.8 | 94.3 | 93.1 | 93.4 | 93.7 | 61.5 | 74.9 | 70.0 | 76.3 | 70.7
UPGD | 93.4 | 93.7 | 93.1 | 93.7 | 93.5 | 78.0 | 77.5 | 72.4 | 77.8 | 76.4
FTGAP | 93.6 | 93.4 | 94.3 | 94.6 | 94.0 | 73.0 | 70.1 | 75.2 | 79.0 | 74.3
| DTD | 4DLF
UAP | 26.2 | 36.6 | 32.4 | 38.9 | 33.5 | 83.6 | 72.5 | 79.2 | 77.2 | 78.1
GAP-llc | 55.7 | 75.3 | 61.4 | 76.0 | 67.1 | 69.7 | 75.6 | 81.1 | 72.2 | 74.7
GAP-tar | 72.5 | 86.2 | 81.1 | 83.6 | 80.9 | 87.5 | 84.2 | 90.0 | 89.4 | 87.8
sPGD | 70.9 | 83.9 | 78.8 | 84.5 | 79.5 | 86.4 | 84.4 | 85.6 | 81.7 | 84.5
UPGD | 71.8 | 82.6 | 80.5 | 79.9 | 78.7 | 88.3 | 88.3 | 86.1 | 81.9 | 86.2
FTGAP | 78.4 | 86.6 | 88.8 | 88.6 | 85.6 | 89.2 | 88.9 | 90.0 | 90.0 | 89.5
| FMD | KTH
UAP | 65.0 | 49.0 | 39.0 | 50.0 | 50.8 | 75.8 | 41.9 | 62.0 | 42.0 | 55.4
GAP-llc | 51.0 | 67.0 | 78.0 | 55.0 | 62.8 | 48.2 | 57.6 | 8.4 | 45.1 | 39.8
GAP-tar | 90.0 | 94.0 | 88.0 | 88.0 | 90.0 | 68.9 | 79.2 | 75.9 | 80.2 | 76.1
sPGD | 89.0 | 93.0 | 87.0 | 89.0 | 89.5 | 69.2 | 79.9 | 72.8 | 80.6 | 75.6
UPGD | 79.0 | 75.0 | 86.0 | 69.0 | 77.3 | 85.7 | 78.5 | 74.3 | 75.2 | 78.4
FTGAP | 92.0 | 94.0 | 91.0 | 86.0 | 90.8 | 73.6 | 82.1 | 76.2 | 85.6 | 79.4

Datasets and models. We train each of the following four DNN models, ResNet
[23], DeepTEN [75], DEP [72] and MuLTER [26] on six texture datasets, Material
in Context (MINC) [3], Ground Terrain in Outdoor Scenes (GTOS) [73, 72],
Describable Texture Database (DTD) [6], the 4D light-field (4DLF) material
dataset, Flickr Material Dataset (FMD) [58] and KTH-TIPS-2b (KTH) [4], and we
obtain 24 trained classifiers. We then conduct universal attacks on the 24
trained classifiers. For each of the considered dataset, universal
perturbations are computed by using a subset of images that are randomly
sampled from the training set. The generated perturbations are then evaluated
on the testing data. The dataset descriptions and DNN model training
strategies are presented in Appendix B. All our results are reported on the
testing set of the corresponding dataset.

Attack strategies. Generally, no data augmentation is used while computing the
universal perturbations. But in our implementation, given the small number of
data samples for 4DLF, FMD and KTH, we use data augmentation to prevent
overfitting. We perform universal attacks using the proposed FTGAP on the
trained models. For comparison, we also conduct attacks using UAP [43], GAP
[50], sPGD [47, 56] and UPGD [13]. For GAP [50], we refer to the perturbations
computed using the loss in Equations 1 and 2 as GAP-tar and GAP-llc,
respectively. For GAP and sPGD, we use a mini-batch size of 32 when computing
the perturbation. The default parameters as provided by the respective authors
are used for all the compared attack methods, except for UPGD whose
hyperparameters (i.e., initial learning rate and decay factor, momentum, etc.)
were varied to maximize the performance for the computed perturbations in
terms of fooling rate. For our FTGAP method, we use the Adam optimizer [29]
with $\alpha=0.0002$ and $\beta_{1}=0.5$. We stop the training process of the
perturbation and report the results when the fooling rates are unable to
increase by more than 0.5% within 5 epochs for all the attack methods, except
for UAP. For UAP, we choose its best result in terms of fooling rate within 20
epochs given that its learning curves were observed to fluctuate drastically.
All the compared perturbations which are computed in the spatial domain are
constrained within an $l_{\infty}$ norm of 10 on 8-bit images ($\approx$ 0.04
for the normalized image scale $[0,1]$). For the proposed FTGAP method, the
values of the parameters $\lambda_{l}$, $\lambda_{h}$ and $f_{c}$ in Equations
8 and 9 are provided for each dataset in Appendix B.

Metrics. We adopt the top-1 accuracy and fooling rate as the performance
metrics. The fooling rate describes the percentage of misclassified samples in
the perturbed image set. Given an image set $I$ and a universal perturbation
$\delta$ in the spatial domain, the fooling rate can be expressed as
$FR=\frac{1}{n}\sum_{i=1}^{n}\llbracket\hat{y}(x_{i}+\delta)\neq\hat{y}(x_{i})\rrbracket$,
where $\llbracket\cdot\rrbracket$ denotes the indicator function, $x_{i}$ is
the $i$-th input sample in the $n$-sample testing set and $\hat{y}(x_{i})$ is
the predicted label for the input $x_{i}$ by the classifier.

###  4.1 Adversarial Strength

MINC [3]
&
DeepTEN [75]

GTOS [73, 72]
&
ResNet [23]

DTD [6]
&
MuLTER [26]

4DLF [66]
&
DEP [72]

FMD [58]
&
ResNet [23]

KTH [4]
&
MuLTER [26]

no attack

GAP-tar [50]

STSIM: 0.8058

STSIM: 0.9294

STSIM: 0.6396

STSIM: 0.8163

STSIM: 0.8498

STSIM: 0.8326

sPGD [47, 56]

STSIM: 0.8134

STSIM: 0.9206

STSIM: 0.6475

STSIM: 0.8157

STSIM: 0.8269

STSIM: 0.8098

UPGD [13]

STSIM: 0.8090

STSIM: 0.9490

STSIM: 0.6765

STSIM: 0.8153

STSIM: 0.8411

STSIM: 0.8235

FTGAP (ours)

STSIM: 0.8257

STSIM: 0.9371

STSIM: 0.6836

STSIM: 0.8530

STSIM: 0.8581

STSIM: 0.8805

Figure 3: Visual comparison of different universal attack methods. Each row
shows the perturbed images that result from applying on the clean image
(leftmost image), universal perturbations that are generated by the considered
universal attack methods for different DNN models and datasets (shown in
leftmost column). The structural texture similarity (STSIM) index is given
below each perturbed image. Bold number indicates best performance for the
model & dataset in each row.

We present the white-box fooling rates of evaluated universal attacks on the
four DNN texture classifiers for all the six texture datasets in Table 1.
Generally, GAP-tar, sPGD, UPGD and our FTGAP can perform effective universal
attacks in terms of more than 70% of fooling rates on all the datasets,
showing that the DNN models are still vulnerable to universal attacks even
when a small number of data samples is used for computing the perturbations in
the scenario of texture recognition. From Table 1, it can be seen that our
proposed FTGAP outperforms all other methods on DTD, 4DLF, FMD and KTH in
terms of producing a higher fooling rate. For the MINC and GTOS dataset, our
FTGAP method generally results in fooling rates that are comparable to GAP-tar
with marginal drops of 0.4% and 1.3%, respectively, in terms of mean fooling
rate over four DNN models.

###  4.2 Perturbation Perceptibility

Given the relatively weak performances of UAP and GAP-llc according to Table
1, we provide visual results only for GAP-tar, sPGD, UPGD and our FTGAP, as
shown in Figure 3. We show perturbed images that result from these four attack
methods as well as the clean images as references, for different combinations
of datasets and DNN models. Also, in order to objectively measure the
perceptibility of the adversarial perturbations in the attacked images, we use
the structural texture similarity (STSIM) index [79], which was shown to be a
more suitable similarity index for texture content as compared to the well-
known structural similarity (SSIM) index [67].

From Figure 3, it can be seen that our proposed FTGAP can produce
significantly less perceptible perturbations as compared to the existing
universal attack methods. In terms of the objective similary metric STSIM, our
FTGAP results in the highest STSIM values for all the considered datasets and
models except for the GTOS dataset with the ResNet model (2nd row in Figure
3). For this latter case, the proposed FTGAP achieves the second highest STSIM
value with UPGD [13] attaining the highest STSIM value. However, in this case,
Figure 3 clearly shows that our proposed FTGAP method results in a
significantly less perceptible perturbation as compared to all other methods,
and that the STSIM is not able to accurately account for the visible color
distortions that appear in the perturbed images which are generated by the
existing attack methods.

It can also be shown that the performance of existing universal attack methods
can be significantly improved when integrated within our proposed frequency-
tuned attack framework (see Appendix H).

###  4.3 Out-of-Distribution Generalization

Table 2: Mean generalization results over the DNN models across datasets for
GAP-tar and our FTGAP. The top row describes the tested datasets and the
leftmost column lists the datasets used to compute the universal adversarial
perturbations. Bold number indicates best result.

| MINC | GTOS | DTD | 4DLF | FMD | KTH | mean
---|---|---|---|---|---|---|---
MINC | GAP-tar | 94.4 | 26.8 | 50.6 | 83.0 | 63.8 | 40.3 | 59.8
FTGAP | 94.0 | 18.9 | 73.6 | 81.3 | 75.3 | 33.1 | 62.7
GTOS | GAP-tar | 55.3 | 75.6 | 37.4 | 79.1 | 47.3 | 47.2 | 57.0
FTGAP | 42.0 | 74.3 | 74.1 | 86.6 | 76.5 | 66.3 | 70.0
DTD | GAP-tar | 39.0 | 10.8 | 80.8 | 78.6 | 58.0 | 19.1 | 47.7
FTGAP | 26.1 | 9.3 | 85.6 | 81.7 | 72.5 | 19.4 | 49.1
4DLF | GAP-tar | 38.8 | 24.7 | 40.3 | 87.8 | 46.0 | 25.9 | 43.9
FTGAP | 30.9 | 12.0 | 71.0 | 89.5 | 72.8 | 28.5 | 50.8
FMD | GAP-tar | 51.5 | 16.9 | 49.3 | 80.8 | 90.0 | 20.4 | 51.5
FTGAP | 29.2 | 11.8 | 75.6 | 84.9 | 90.8 | 27.3 | 53.3
KTH | GAP-tar | 48.8 | 35.0 | 40.1 | 79.1 | 50.3 | 76.1 | 54.9
FTGAP | 27.3 | 19.4 | 61.5 | 74.9 | 61.3 | 79.4 | 54.0
mean | GAP-tar | 54.6 | 31.6 | 49.8 | 81.4 | 59.2 | 38.2 | 52.5
FTGAP | 41.6 | 24.3 | 73.6 | 83.2 | 74.8 | 42.3 | 56.6

To test the out-of-distribution generalization of the perturbations, we
evaluate the cross-dataset performance over different datasets for each DNN
model and report the average fooling rates over all the considered four DNN
models on each dataset for GAP-tar and our FTGAP in Table 2. For the
perturbations computed on each dataset (listed in the leftmost column), Table
2 shows that the proposed FTGAP method exhibits a better out-of-distribution
generalization in terms of achieving higher mean fooling rates over all the
tested datasets (listed in the top row) for all the generated universal
perturbations except for the one that is generated using the KTH dataset for
which FTGAP achieves a mean fooling rate that is comparable to GAP-tar.

###  4.4 Robustness against Defended Models

Table 3: Mean top-1 accuracy results over the defended DNN models. Bold number
indicates best performance and underlined number denotes second best
performance for each dataset.

| no attack | UAP | GAP-llc | GAP-tar | sPGD | UPGD | FTGAP
---|---|---|---|---|---|---|---
MINC | 78.6 | 76.5 | 63.0 | 59.5 | 70.7 | 68.4 | 39.0
GTOS | 73.3 | 74.1 | 70.1 | 66.1 | 70.0 | 65.5 | 64.8
DTD | 64.8 | 63.9 | 48.8 | 46.1 | 46.0 | 48.8 | 38.0
4DLF | 64.6 | 56.7 | 43.8 | 36.0 | 47.9 | 50.7 | 26.9
FMD | 71.3 | 63.8 | 55.8 | 50.3 | 52.0 | 59.0 | 45.0
KTH | 78.8 | 75.1 | 72.2 | 47.5 | 50.4 | 62.4 | 50.5
mean | 71.9 | 68.4 | 59.0 | 50.9 | 56.2 | 59.1 | 44.0

We also provide comparisons of perturbation robustness against defended models
in Table 3. For this purpose, we retrain the four considered DNN models by
adopting the universal adversarial training strategy, a simple yet effective
adversarial training method to defend against universal attacks [56]. All the
perturbations are computed on the undefended models and then applied to the
input images of the defended models. From the results in Table 3, our FTGAP
method yields the most robust perturbations as compared to the existing
universal attack methods by achieving the lowest mean top-1 accuracy over the
defended models for almost all the datasets.

###  4.5 Effects of Training Data Size

Figure 4: Fooling rate in function of training set size (expressed as a
percentage of the full training set size) using the MINC dataset and various
DNN models ((a) ResNet [23], (b) DeepTEN [75], (c) DEP [72] and (d) MuLTER
[26]) where the training set is the set used to compute the universal
perturbations.

We explore the effects of the training data size on the universal perturbation
effectiveness for our FTGAP method using the MINC dataset, which includes
48,875 training images. According to Figure 4, without data augmentation, the
fooling rates can be maintained at the same level when the percentage of
training images that are used to compute the universal perturbations drops
from 100% to 1%. The achieved fooling rate drastically decreases when the
percentage of training set size goes lower than 1%. When data augmentation is
employed111We employed the same data augmentation approaches as the ones that
were used to train the original DNN texture classifiers [30, 75]., the
proposed FTGAP can maintain a relatively high fooling rate with only a
marginal decrease (about 10% drop at most) even when the universal
perturbation is computed with about 0.1% of all training images, indicating a
strong robustness against very sparse data. Similar results were also obtained
for other datasets (see Appendix E).

##  5 Conclusion

To our knowledge this paper presents the first work dealing with universal
adversarial attacks on texture recognition tasks. To this end, this paper
presents a novel frequency-tuned generative adversarial perturbation (FTGAP)
method. The proposed FTGAP method generates universal adversarial
perturbations by computing frequency-domain perturbation components that are
adapted to the local characteristics of DCT frequency bands. Furthermore, we
demonstrate that, compared to existing universal attack methods, our method
can significantly reduce the perceptibility of the generated universal
perturbations while achieving on average comparable or higher fooling rates
across datasets and models for texture image classification. In addition,
according to the conducted experiments, the proposed FTGAP method can improve
the universal attack performance as compared to existing universal attacks in
terms of various aspects including out-of-distribution generalization across
datasets and robustness against defended models, and can also maintain a
relatively high fooling rate even with a very sparse set of training samples.

## References

  * [1] Albert J Ahumada Jr and Heidi A Peterson.  Luminance-model-based DCT quantization for color image compression.  In Human Vision, Visual Processing, and Digital Display III, volume 1666, pages 365–374, 1992.
  * [2] Vincent Andrearczyk and Paul F. Whelan.  Using filter banks in convolutional neural networks for texture classification.  Pattern Recognition Letters, 84:63 – 69, 2016.
  * [3] Sean Bell, Paul Upchurch, Noah Snavely, and Kavita Bala.  Material recognition in the wild with the materials in context database.  In IEEE conference on Computer Vision and Pattern Recognition, pages 3479–3487, 2015.
  * [4] Barbara Caputo, Eric Hayman, and P Mallikarjuna.  Class-specific material categorisation.  In IEEE International Conference on Computer Vision, volume 2, pages 1597–1604, 2005.
  * [5] Nicholas Carlini and David Wagner.  Towards evaluating the robustness of neural networks.  In IEEE Symposium on Security and Privacy, pages 39–57, 2017.
  * [6] Mircea Cimpoi, Subhransu Maji, Iasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi.  Describing textures in the wild.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 3606–3613, 2014.
  * [7] Mircea Cimpoi, Subhransu Maji, and Andrea Vedaldi.  Deep filter banks for texture recognition and segmentation.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 3828–3836, 2015.
  * [8] Francesco Croce and Matthias Hein.  Sparse and imperceivable adversarial attacks.  In IEEE International Conference on Computer Vision, pages 4724–4732, 2019.
  * [9] Gabriella Csurka, Christopher Dance, Lixin Fan, Jutta Willamowski, and Cédric Bray.  Visual categorization with bags of keypoints.  In Workshop on statistical learning in computer vision, ECCV, volume 1, pages 1–2. Prague, 2004.
  * [10] Ali Dabouei, Sobhan Soleymani, Fariborz Taherkhani, Jeremy Dawson, and Nasser Nasrabadi.  SmoothFool: an efficient framework for computing smooth adversarial perturbations.  In IEEE Winter Conference on Applications of Computer Vision, pages 2665–2674, 2020.
  * [11] Xiyang Dai, Joe Yue-Hei Ng, and Larry S Davis.  FASON: first and second order information fusion network for texture recognition.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 7352–7360, 2017.
  * [12] Yingpeng Deng and Lina J Karam.  Frequency-tuned universal adversarial attacks.  arXiv preprint arXiv:2003.05549, 2020.
  * [13] Yingpeng Deng and Lina J. Karam.  Universal adversarial attack via enhanced projected gradient descent.  In IEEE International Conference on Image Processing, pages 1241–1245, 2020.
  * [14] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li.  Boosting adversarial attacks with momentum.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 9185–9193, 2018.
  * [15] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu.  Evading defenses to transferable adversarial examples by translation-invariant attacks.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 4312–4321, 2019.
  * [16] Yanbo Fan, Baoyuan Wu, Tuanhui Li, Yong Zhang, Mingyang Li, Zhifeng Li, and Yujiu Yang.  Sparse adversarial attack via perturbation factorization.  In European Conference on Computer Vision, 2020.
  * [17] William T Freeman and Joshua B Tenenbaum.  Learning bilinear models for two-factor problems in vision.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 554–560. IEEE, 1997.
  * [18] Ross Girshick, Jeff Donahue, Trevor Darrell, and Jitendra Malik.  Rich feature hierarchies for accurate object detection and semantic segmentation.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 580–587, 2014.
  * [19] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio.  Generative adversarial nets.  In Advances in Neural Information Processing Systems, pages 2672–2680, 2014.
  * [20] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  International Conference on Learning Representations, 2015.
  * [21] Chuan Guo, Jared S Frank, and Kilian Q Weinberger.  Low frequency adversarial perturbation.  arXiv preprint arXiv:1809.08758, 2018.
  * [22] Chuan Guo, Jacob Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Weinberger.  Simple black-box adversarial attacks.  In International Conference on Machine Learning, pages 2484–2493, 2019.
  * [23] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 770–778, 2016.
  * [24] Jan Hendrik Metzen, Mummadi Chaithanya Kumar, Thomas Brox, and Volker Fischer.  Universal adversarial perturbations against semantic image segmentation.  In IEEE International Conference on Computer Vision, pages 2755–2764, 2017.
  * [25] Ingo Hontsch and Lina J Karam.  Adaptive image coding with perceptual distortion control.  IEEE Transactions on Image Processing, 11(3):213–222, 2002.
  * [26] Yuting Hu, Zhiling Long, and Ghassan AlRegib.  Multi-level texture encoding and representation (MuLTER) based on deep neural networks.  In IEEE International Conference on Image Processing, pages 4410–4414, 2019.
  * [27] Hervé Jégou, Matthijs Douze, Cordelia Schmid, and Patrick Pérez.  Aggregating local descriptors into a compact image representation.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 3304–3311, 2010.
  * [28] Lina J Karam, Nabil G Sadaka, Rony Ferzli, and Zoran A Ivanovski.  An efficient selective perceptual-based super-resolution estimator.  IEEE Transactions on Image Processing, 20(12):3470–3482, 2011.
  * [29] Diederik P Kingma and Jimmy Ba.  Adam: A method for stochastic optimization.  arXiv preprint arXiv:1412.6980, 2014.
  * [30] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton.  Imagenet classification with deep convolutional neural networks.  In Advances in Neural Information Processing Systems, pages 1097–1105, 2012.
  * [31] Alexey Kurakin, Ian Goodfellow, and Samy Bengio.  Adversarial examples in the physical world.  arXiv preprint arXiv:1607.02533, 2016.
  * [32] Debang Li, Junge Zhang, and Kaiqi Huang.  Universal adversarial perturbations against object detection.  Pattern Recognition, page 107584, 2020.
  * [33] Yingwei Li, Song Bai, Cihang Xie, Zhenyu Liao, Xiaohui Shen, and Alan Yuille.  Regional homogeneity: Towards learning transferable universal adversarial perturbations against defenses.  European Conference on Computer Vision, 2020.
  * [34] Tsung-Yu Lin and Subhransu Maji.  Visualizing and understanding deep texture representations.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 2791–2799, 2016.
  * [35] Tsung-Yu Lin, Aruni RoyChowdhury, and Subhransu Maji.  Bilinear CNN models for fine-grained visual recognition.  In IEEE International Conference on Computer Vision, pages 1449–1457, 2015.
  * [36] Hong Liu, Rongrong Ji, Jie Li, Baochang Zhang, Yue Gao, Yongjian Wu, and Feiyue Huang.  Universal adversarial perturbation via prior driven uncertainty approximation.  In IEEE International Conference on Computer Vision, pages 2941–2949, 2019.
  * [37] Yujia Liu, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard.  A geometry-inspired decision-based attack.  In IEEE International Conference on Computer Vision, pages 4890–4898, 2019.
  * [38] Zhen Liu, Lina J Karam, and Andrew B Watson.  JPEG2000 encoding with perceptual distortion control.  IEEE Transactions on Image Processing, 15(7):1763–1778, 2006.
  * [39] Jonathan Long, Evan Shelhamer, and Trevor Darrell.  Fully convolutional networks for semantic segmentation.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 3431–3440, 2015.
  * [40] David G Lowe.  Distinctive image features from scale-invariant keypoints.  International Journal of Computer Vision, 60(2):91–110, 2004.
  * [41] Bo Luo, Yannan Liu, Lingxiao Wei, and Qiang Xu.  Towards imperceptible and robust adversarial example attacks against neural networks.  In AAAI Conference on Artificial Intelligence, 2018.
  * [42] Apostolos Modas, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard.  SparseFool: a few pixels make a big difference.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 9087–9096, 2019.
  * [43] Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard.  Universal adversarial perturbations.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 1765–1773, 2017.
  * [44] Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard.  DeepFool: A simple and accurate method to fool deep neural networks.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 2574–2582, 2016.
  * [45] Konda Reddy Mopuri, Aditya Ganeshan, and R Venkatesh Babu.  Generalizable data-free objective for crafting universal adversarial perturbations.  IEEE Transactions on Pattern Analysis and Machine Intelligence, 41(10):2452–2465, 2018.
  * [46] Konda Reddy Mopuri, Utsav Garg, and R Venkatesh Babu.  Fast Feature Fool: a data independent approach to universal adversarial perturbations.  In British Machine Vision Conference, 2017.
  * [47] Chaithanya Kumar Mummadi, Thomas Brox, and Jan Hendrik Metzen.  Defending against universal perturbations with shared adversarial training.  In IEEE International Conference on Computer Vision, pages 4928–4937, 2019.
  * [48] Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami.  The limitations of deep learning in adversarial settings.  In IEEE European Symposium on Security and Privacy, pages 372–387, 2016.
  * [49] Florent Perronnin, Jorge Sánchez, and Thomas Mensink.  Improving the fisher kernel for large-scale image classification.  In European Conference on Computer Vision, pages 143–156. Springer, 2010.
  * [50] Omid Poursaeed, Isay Katsman, Bicheng Gao, and Serge Belongie.  Generative adversarial perturbations.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 4422–4431, 2018.
  * [51] Konda Reddy Mopuri, Phani Krishna Uppala, and R Venkatesh Babu.  Ask, acquire, and attack: Data-free UAP generation using class impressions.  In European Conference on Computer Vision, pages 19–34, 2018.
  * [52] Konda Reddy Mopuri, Utkarsh Ojha, Utsav Garg, and R Venkatesh Babu.  NAG: network for adversary generation.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 742–751, 2018.
  * [53] Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi.  You only look once: Unified, real-time object detection.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 779–788, 2016.
  * [54] Olaf Ronneberger, Philipp Fischer, and Thomas Brox.  U-Net: Convolutional networks for biomedical image segmentation.  In International Conference on Medical Image Computing and Computer-Assisted Intervention, pages 234–241, 2015.
  * [55] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei.  ImageNet large scale visual recognition challenge.  International Journal of Computer Vision, 115(3):211–252, 2015\.
  * [56] Ali Shafahi, Mahyar Najibi, Zheng Xu, John Dickerson, Larry S Davis, and Tom Goldstein.  Universal adversarial training.  AAAI Conference on Artificial Intelligence, 2020.
  * [57] Ali Shahin Shamsabadi, Ricardo Sanchez-Matilla, and Andrea Cavallaro.  Colorfool: Semantic adversarial colorization.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1151–1160, 2020.
  * [58] Lavanya Sharan, Ce Liu, Ruth Rosenholtz, and Edward H Adelson.  Recognizing materials using perceptually inspired features.  International Journal of Computer Vision, 103(3):348–371, 2013\.
  * [59] Mahmood Sharif, Lujo Bauer, and Michael K Reiter.  On the suitability of lp-norms for creating and preventing adversarial examples.  In IEEE Conference on Computer Vision and Pattern Recognition Workshops, pages 1605–1613, 2018.
  * [60] Yash Sharma, Gavin Weiguang Ding, and Marcus A Brubaker.  On the effectiveness of low frequency perturbations.  In International Joint Conference on Artificial Intelligence, pages 3389–3396, 2019.
  * [61] Karen Simonyan and Andrew Zisserman.  Very deep convolutional networks for large-scale image recognition.  In International Conference on Learning Representations, 2015.
  * [62] Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai.  One pixel attack for fooling deep neural networks.  IEEE Transactions on Evolutionary Computation, 23(5):828–841, 2019\.
  * [63] Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich.  Going deeper with convolutions.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 1–9, 2015.
  * [64] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus.  Intriguing properties of neural networks.  International Conference on Learning Representations, 2014.
  * [65] Yusuke Tsuzuku and Issei Sato.  On the structural sensitivity of deep convolutional networks to the directions of fourier basis functions.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 51–60, 2019.
  * [66] Ting-Chun Wang, Jun-Yan Zhu, Ebi Hiroaki, Manmohan Chandraker, Alexei A Efros, and Ravi Ramamoorthi.  A 4D light-field dataset and CNN architectures for material recognition.  In European Conference on Computer Vision, pages 121–138, 2016\.
  * [67] Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli.  Image quality assessment: from error visibility to structural similarity.  IEEE Transactions on Image Processing, 13(4):600–612, 2004.
  * [68] Zhibo Wang, Mengkai Song, Siyan Zheng, Zhifei Zhang, Yang Song, and Qian Wang.  Invisible adversarial attack against deep neural networks: An adaptive penalization approach.  IEEE Transactions on Dependable and Secure Computing, 2019.
  * [69] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille.  Adversarial examples for semantic segmentation and object detection.  In IEEE International Conference on Computer Vision, pages 1369–1378, 2017.
  * [70] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille.  Improving transferability of adversarial examples with input diversity.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 2730–2739, 2019.
  * [71] Kaidi Xu, Sijia Liu, Pu Zhao, Pin-Yu Chen, Huan Zhang, Quanfu Fan, Deniz Erdogmus, Yanzhi Wang, and Xue Lin.  Structured adversarial attack: Towards general implementation and better interpretability.  In International Conference on Learning Representations, 2019.
  * [72] Jia Xue, Hang Zhang, and Kristin Dana.  Deep texture manifold for ground terrain recognition.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 558–567, 2018.
  * [73] Jia Xue, Hang Zhang, Kristin Dana, and Ko Nishino.  Differential angular imaging for material recognition.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 764–773, 2017.
  * [74] Dong Yin, Raphael Gontijo Lopes, Jon Shlens, Ekin Dogus Cubuk, and Justin Gilmer.  A Fourier perspective on model robustness in computer vision.  In Advances in Neural Information Processing Systems, pages 13276–13286, 2019.
  * [75] Hang Zhang, Jia Xue, and Kristin Dana.  Deep TEN: Texture encoding network.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 708–717, 2017.
  * [76] Zifei Zhang, Kai Qiao, Lingyun Jiang, Linyuan Wang, and Bin Yan.  AdvJND: Generating adversarial examples with just noticeable difference.  arXiv preprint arXiv:2002.00179, 2020.
  * [77] Zhengyu Zhao, Zhuoran Liu, and Martha Larson.  Towards large yet imperceptible adversarial image perturbations with perceptual color distance.  In IEEE Conference on Computer Vision and Pattern Recognition, pages 1039–1048, 2020.
  * [78] Wen Zhou, Xin Hou, Yongjun Chen, Mengyun Tang, Xiangqi Huang, Xiang Gan, and Yong Yang.  Transferable adversarial perturbations.  In European Conference on Computer Vision, pages 452–467, 2018\.
  * [79] Jana Zujovic, Thrasyvoulos N Pappas, and David L Neuhoff.  Structural texture similarity metrics for image analysis and retrieval.  IEEE Transactions on Image Processing, 22(7):2545–2558, 2013.

##  Appendix A Computation Details of JND Thresholds

The JND thresholds for different frequency bands $(k_{1},k_{2})$ can be
computed as [25]

$\small
t_{DCT}(k_{1},k_{2})=\frac{MT(k_{1},k_{2})}{2\tilde{c_{1}}(k_{1})\tilde{c_{2}}(k_{2})(L_{max}-L_{min})},$
(10)

where $L_{min}$ and $L_{max}$ are the minimum and maximum display luminance,
$M=255$ for 8-bit image, and $\tilde{c_{i}(k_{i})}$ are computed using
Equation 5 in the main paper. To compute the background luminance-adjusted
contrast sensitivity $T(k_{1},k_{2})$, Ahumada and Peterson proposed an
approximating parametric model111$T(k_{1},k_{2})$ can be computed for any
$k_{1}$, $k_{2}$ which satisfy $k_{1}k_{2}\neq 0$ by this model, while
$T(0,0)$ is estimated as min($T(0,1)$, $T(1,0)$). [1]:

$\displaystyle\log_{10}(T(k_{1},k_{2}))=$
$\displaystyle\log_{10}\frac{T_{min}}{r+(1-r)\cos^{2}\theta(k_{1},k_{2})}$
(11) $\displaystyle+K(\log_{10}f(k_{1},k_{2})-\log_{10}f_{min})^{2}.$

The radial frequency $f(k_{1},k_{2})$ and its corresponding orientation
$\theta(k_{1},k_{2})$ are given as follows:

$\small
f(k_{1},k_{2})=\frac{1}{2N_{DCT}}\sqrt{\frac{k_{1}^{2}}{w_{x}^{2}}+\frac{k_{2}^{2}}{w_{y}^{2}}},$
(12)
$\small\theta(k_{1},k_{2})=\arcsin\frac{2f(k_{1},0)f(0,k_{2})}{f^{2}(k_{1},k_{2})}.$
(13)

The luminance-dependent parameters are generated by the following equations:

$\small
T_{min}=\left\\{\begin{array}[]{cc}\left(\frac{L}{L_{T}}\right)^{\alpha_{T}}\frac{L_{T}}{S_{0}}&,\
L\leq L_{T}\\\ \frac{L}{S_{0}}&,\ L>L_{T}\end{array}\right.,\ $ (14) $\small
f_{min}=\left\\{\begin{array}[]{cc}f_{0}\left(\frac{L}{L_{f}}\right)^{\alpha_{f}}&,\
L\leq L_{f}\\\ f_{0}&,\ L>L_{f}\end{array}\right.,\ $ (15)
$K=\left\\{\begin{array}[]{cc}K_{0}\left(\frac{L}{L_{K}}\right)^{\alpha_{K}}&,\
L\leq L_{K}\\\ K_{0}&,\ L>L_{K}\end{array}\right..$ (16)

The values of constants in Equations 14-16 are $r=0.7$, $N_{DCT}=8$,
$L_{T}=13.45$ cd/m2, $S_{0}=94.7$, $\alpha_{T}=0.649$, $f_{0}=6.78$
cycles/degree, $alpha_{f}=0.182$, $L_{f}=300$ cd/m2, $K_{0}=3.125$,
$\alpha_{K}=0.0706$, and $L_{K}=300$ cd/m2. Given a viewing distance of 60 cm
and a 31.5 pixels-per-cm (80 pixels-per-inch) display, the horizontal
width/vertical height of a pixel ($w_{x}/w_{y}$) is 0.0303 degree of visual
angle [38]. In practice, for a measured luminance of $L_{min}=0$ cd/m2 and
$L_{max}=175$ cd/m2, we use the luminance $L$ corresponding to the median
intensity value of the image to avoid image-specific computation as follows
[28]:

$L=L_{min}+128\frac{L_{max}-L_{min}}{M}$ (17)

##  Appendix B Implementation Details

In this section, we will describe all the adopted texture datasets and
corresponding splits for training/attacking/testing. The details for training
the DNN texture classifiers are also provided together with the hyperparameter
settings for our proposed FTGAP method.

###  B.1 Datasets

Table 4: The number of images used for training the networks (training set),
computing the perturbation (attacking set) and testing (testing set).

Dataset | training set | attacking set | testing set
---|---|---|---
MINC [3] | 48,875 | 5,750 | 5,750
GTOS [73, 72] | 93,945 | 9,381 | 6,066
DTD [6] | 3,760 | 1,880 | 1,880
4DLF [66] | 840 | 360 | 360
FMD [58] | 900 | 300 | 100
KTH [4] | 2,376 | 231 | 2,376

We consider six texture datasets in order to examine the recognition
performance of the DNN models under various unviersal attacks. The Materials
in Context (MINC) Database [3] is a large real-world material dataset. In our
work, we adopt its publicly available subset MINC-2500 with its provided
train-test split. There are 23 classes with 2500 images for each class. Xue et
al. created the Ground Terrain in Outdoor Scenes (GTOS) [73] dataset with 31
classes of over 90,000 ground terrain images and the GTOS-mobile [72] with the
same classes but with a much smaller number of images (around 6,000 images).
As in [72], we adopt the GTOS dataset as the training set and test the trained
models on the GTOS-mobile dataset. In our paper, we use MINC and GTOS to refer
to the MINC-2500 and the combined dataset of GTOS and GTOS-mobile,
respectively.

We also adopt other smaller texture datasets. The Describable Textures
Database (DTD) [6] includes 47 categories with 120 images per category. The 4D
light-field (4DLF) material dataset [66] consists of 1200 images in total for
12 different categories. An angular resolution of $7\times 7$ is used for each
image in the dataset and we only use the one where $(u,v)=(-3,3)$ in our
experiments. The Filckr Material Dataset (FMD) [58] has 10 material classes
and 100 images per class. The KTH-TIPS-2b (KTH) [4] comprises 11 texture
classes, with four samples per class and 108 images per sample.

For each dataset, the training set is used to train the models for texture
recognition, the attacking set includes images that are randomly sampled from
the training set for computing the perturbations, and the testing set is to
evalute the performance. The number of images for each of these sets is listed
in Table 4. We use the train-test split that is either provided in the dataset
or suggested in [75]. To extract the attacking set, we randomly sample 10% of
the images in the training image set for the GTOS/KTH dataset, one-third of
the training images for the FMD dataset and a number of training images that
is equal to the number of testing images for MINC, DTD and 4DLF separately.

###  B.2 Training Strategies

Table 5: The hyperparameter settings on different datasets for FTGAP.

| MINC | GTOS | DTD∗ | 4DLF∗ | FMD | KTH∗
---|---|---|---|---|---|---
$\lambda_{l}$ | 0 | 1 | 0 | 0 | 0 | 0
$\lambda_{h}$ | 3 | 3 | 1.5 | 2.5 | 2.5 | 2
$f_{c}$ | 4

Table 6: Top-1 accuracy results for attacking the defended models on MINC and
GTOS using GAP-tar and our FTGAP.

| no attack | ResNet | DeepTEN | DEP | MuLTER | mean
---|---|---|---|---|---|---
MINC | GAP-tar | 78.6 | 27.6 | 17.1 | 11.8 | 14.4 | 17.7
FTGAP | 5.0 | 5.9 | 5.9 | 5.5 | 5.4
GTOS | GAP-tar | 73.3 | 48.8 | 56.2 | 54.1 | 48.0 | 51.8
FTGAP | 48.6 | 28.8 | 42.4 | 38.1 | 39.5

The DNN models are finetuned based on the ResNet backbones which are
pretrained on ImageNet [55]. With regard to the network backbone, we use
pretrained ResNet50222According to the provided source code for [75], the
adopted ResNet50 backbones are slightly different from [23], where the first
convolutional layer with a kernel size of 7 is replaced by three cascaded 3
$\times$ 3 convolutional layers. for MINC, DTD, 4DLF and FMD and pretrained
ResNet18 for GTOS and KTH, as suggested in [75, 72]. Following the same
training strategies in [72, 26], we train our models with only single-size
images. Similar to the data augmentation strategies in [75], the input images
are resized to 256 $\times$ 256 and then randomly cropped to 224 $\times$ 224,
followed by a random horizontal flipping. Standard color augmentation and PCA-
based noise are used as in [30, 75]. For DeepTEN [75], DEP [72] and MuLTER
[26], the number of codewords is set to 8 for the ResNet18 backbone and to 32
for the ResNet50 backbone as suggested by the corresponding authors. For
finetuning, we use stochastic gradient descent (SGD) with a mini-batch size of
32. With a weight decay of $10^{-4}$ and a momentum of 0.9, the learning rate
is initialized to 0.01 and decays every 10 epochs by a factor of 0.1. The
training process is terminated after 30 epochs and the best performing model
is adopted.

ResNet [23]

DeepTEN [75]

DEP [72]

MuLTER [26]

Figure 5: The perturbed images generated by attacking the defended models on
MINC (top two rows) and GTOS (bottom two rows). We provide visual results of
adversarially perturbed images that are generated by GAP-tar [50] (first and
third rows) and by our FTGAP (second and fourth rows).

no attack

FTGAP
with JND

FTGAP
without JND

MINC [3]

STSIM: 0.8011
FR: 93.6

STSIM: 0.8051
FR: 93.6

GTOS [73, 72]

STSIM: 0.8291
FR: 73.0

STSIM: 0.7920
FR: 72.6

DTD [6]

STSIM: 0.8898
FR: 78.4

STSIM: 0.8601
FR: 79.0

4DLF [66]

STSIM: 0.8223
FR: 89.2

STSIM: 0.7889
FR: 88.9

FMD [58]

STSIM: 0.9186
FR: 92.0

STSIM: 0.9075
FR: 92.0

KTH [4]

STSIM: 0.8409
FR: 73.6

STSIM: 0.8293
FR: 72.6

Figure 6: Comparison between FTGAP with and without JND thresholds on various
datasets. The similarity index of each perturbed image in the second & third
rows with the corresponding clean image in the first row, as well as the
resulting fooling rate (FR) on each dataset, are given below each perturbed
image. Bold number indicates better similarity index. Table 7: Cross-model
fooling rates on the attacked models listed in the first row by using the
FTGAP perturbations computed on the models in the first column.

| ResNet | DeepTEN | DEP | MuLTER | mean | ResNet | DeepTEN | DEP | MuLTER | mean
---|---|---|---|---|---|---|---|---|---|---
| MINC | GTOS
ResNet | 93.6 | 74.5 | 75.8 | 73.6 | 79.4 | 73.0 | 59.1 | 55.4 | 70.0 | 64.4
DeepTEN | 87.4 | 93.4 | 86.3 | 83.0 | 87.5 | 69.0 | 70.1 | 55.5 | 67.6 | 65.6
DEP | 85.4 | 84.5 | 94.3 | 82.6 | 86.7 | 65.0 | 69.0 | 75.2 | 69.3 | 69.6
MuLTER | 87.7 | 85.5 | 89.1 | 94.6 | 89.2 | 76.4 | 70.8 | 67.2 | 79.0 | 73.4
mean | 88.5 | 84.5 | 86.4 | 83.5 | 85.7 | 70.9 | 67.3 | 63.3 | 71.5 | 68.2
| DTD | 4DLF
ResNet | 78.4 | 83.1 | 87.5 | 81.7 | 82.7 | 89.2 | 85.3 | 76.1 | 80.6 | 82.8
DeepTEN | 49.0 | 86.6 | 87.1 | 83.0 | 76.4 | 43.9 | 88.9 | 66.7 | 90.6 | 72.5
DEP | 53.0 | 82.5 | 88.8 | 80.4 | 76.2 | 44.7 | 89.4 | 90.0 | 90.3 | 78.6
MuLTER | 51.2 | 86.2 | 87.7 | 88.6 | 78.4 | 45.0 | 83.9 | 56.9 | 90.0 | 69.0
mean | 57.9 | 84.6 | 87.8 | 83.4 | 78.4 | 55.7 | 86.9 | 72.4 | 87.9 | 75.7
| FMD | KTH
ResNet | 92.0 | 77.0 | 81.0 | 68.0 | 79.5 | 73.6 | 71.9 | 63.5 | 72.6 | 70.4
DeepTEN | 34.0 | 94.0 | 80.0 | 83.0 | 72.8 | 9.4 | 82.1 | 82.5 | 79.0 | 63.3
DEP | 45.0 | 93.0 | 91.0 | 83.0 | 78.0 | 7.7 | 62.3 | 76.2 | 63.1 | 52.3
MuLTER | 36.0 | 90.0 | 85.0 | 86.0 | 74.3 | 9.2 | 77.2 | 78.2 | 85.6 | 62.6
mean | 51.8 | 88.5 | 84.3 | 80.0 | 76.1 | 25.0 | 73.4 | 75.1 | 75.1 | 62.1

Table 8: Comparisons of resulting fooling rates for baseline attack methods
and their variants using the proposed frequency-tuned attack framework: sPGD
(baseline) [47, 56] vs. FT-sPGD (frequency-tuned); UPGD (baseline) [13] vs.
FT-UPGD (frequency-tuned). Bold number indicates better performance on the
corresponding model in each column within the same dataset.

| ResNet | DeepTEN | DEP | MuLTER | mean | ResNet | DeepTEN | DEP | MuLTER | mean
---|---|---|---|---|---|---|---|---|---|---
| MINC | GTOS
sPGD | 93.8 | 94.3 | 93.1 | 93.4 | 93.7 | 61.5 | 74.9 | 70.0 | 76.3 | 70.7
FT-sPGD | 94.5 | 92.5 | 93.7 | 94.3 | 93.8 | 61.7 | 80.8 | 76.0 | 83.7 | 75.6
UPGD | 93.4 | 93.7 | 93.1 | 93.7 | 93.5 | 78.0 | 77.5 | 72.4 | 77.8 | 76.4
FT-UPGD | 93.6 | 93.3 | 94.4 | 94.2 | 93.9 | 81.1 | 82.3 | 76.1 | 83.9 | 80.9
| DTD | 4DLF
sPGD | 70.9 | 83.9 | 78.8 | 84.5 | 79.5 | 86.4 | 84.4 | 85.6 | 81.7 | 84.5
FT-sPGD | 79.3 | 87.9 | 86.6 | 85.8 | 84.9 | 89.4 | 86.7 | 90.6 | 92.8 | 89.9
UPGD | 71.8 | 82.6 | 80.5 | 79.9 | 78.7 | 88.3 | 88.3 | 86.1 | 81.9 | 86.2
FT-UPGD | 77.0 | 88.4 | 90.4 | 88.8 | 86.2 | 89.2 | 94.7 | 92.2 | 96.1 | 93.1
| FMD | KTH
sPGD | 89.0 | 93.0 | 87.0 | 89.0 | 89.5 | 69.2 | 79.9 | 72.8 | 80.6 | 75.6
FT-sPGD | 92.0 | 94.0 | 91.0 | 93.0 | 92.5 | 77.9 | 84.7 | 77.8 | 86.8 | 81.8
UPGD | 79.0 | 75.0 | 86.0 | 69.0 | 77.3 | 85.7 | 78.5 | 74.3 | 75.2 | 78.4
FT-UPGD | 85.0 | 88.0 | 88.0 | 86.0 | 86.8 | 90.0 | 80.1 | 77.3 | 81.5 | 82.2

###  B.3 Hyperparameters for FTGAP

For our FTGAP method, we mainly have three hyperparameters $\lambda_{l}$,
$\lambda_{h}$ and $f_{c}$. As listed in Table 5333For the datasets with an
asterisk, we use different $\lambda_{l}$ and $\lambda_{h}$ only for ResNet.
DTD: $\lambda_{l}=0$ and $\lambda_{h}=2$; 4DLF: $\lambda_{l}=0$ and
$\lambda_{h}=3$; KTH: $\lambda_{l}=1$ and $\lambda_{h}=3$., we set the
hyperparameters empirically to balance effectiveness and imperceptibility. An
ablation study for hyperparameters is conducted in Appendix F.

##  Appendix C Cross-Model Generalization

Cross-model generalization assesses the transferability of the attack to other
DNN models which are not used for computing the adversarial perturbation. We
report the cross-model fooling rates of the perturbations that are computed by
our FTGAP method on different models and datasets in Table 7. As shown in
Table 7, the perturbations by our FTGAP method can still result in substantial
fooling rates on unseen models for all the considered datasets.

##  Appendix D Attacking against Defended Models

We also use GAP-tar [50] and our FTGAP to attack the models defended by
universal adverarial training [56] on MINC and GTOS. As shown in Table 6, our
FTGAP outperforms the baseline method GAP-tar with more than 10% drops of
average top-1 accuracy on both datasets. Particularly, our FTGAP method can
invalidate the defense on MINC by reducing the top-1 accuracy under 6%, which
is nearly the same as the attack performance on the undefended models. Some
visual examples of perturbed images are given in Figure 5.

##  Appendix E Effects of Training Data Size

Figure 7: Fooling rate in function of the training set size (expressed as a
percentage of the full training set size) using the GTOS dataset and various
DNN models ((a) ResNet [23], (b) DeepTEN [75], (c) DEP [72] and (d) MuLTER
[26]) where the training set is the set used to compute the universal
perturbations.

Figure 7 shows the effects of the training data size on the universal
perturbation effectiveness for our FTGAP method using the GTOS dataset, which
includes 93,945 training images. It can be seen that, despite the fooling rate
fluctuations as the training set size is reduced, the proposed FTGAP with data
augmentation can produce much higher fooling rates as compared to that without
data augmentation even when only 0.1% of all training images are used to
compute the perturbation. The data augmentation is performed as in Section 4.5
of the main paper.

##  Appendix F Ablation Study

no attack

$\lambda_{h}=1$
STSIM: 0.8516
FR: 58.1

STSIM: 0.7903
FR: 83.9

STSIM: 0.7486
FR: 86.3

$\lambda_{h}=2$
STSIM: 0.8041
FR: 83.6

STSIM: 0.7547
FR: 87.2

STSIM: 0.7240
FR: 89.2

$\lambda_{h}=3$
STSIM: 0.7790
FR: 89.2

STSIM: 0.7382
FR: 89.2

STSIM: 0.7109
FR: 90.6

$\lambda_{h}=4$
STSIM: 0.7537
FR: 91.7

STSIM: 0.7250
FR: 90.6

STSIM: 0.7153
FR: 91.1

Figure 8: Effects of $\lambda_{l}$ and $\lambda_{h}$ for the ResNet model [23]
and the 4DLF dataset [66]. Under each perturbed image, the similarity index
with the clean image and the fooling rate (FR) obtained by the corresponding
perturbation are given. The hyperparameter settings that are used in our
method for producing the results in the main paper, are shown in green.

no attack

$f_{c}=0$

STSIM: 0.6715
FR: 89.7

$f_{c}=2$

STSIM: 0.7039
FR: 89.2

$f_{c}=4$

STSIM: 0.7423
FR: 89.2

$f_{c}=6$

STSIM: 0.7959
FR: 88.3

$f_{c}=8$

STSIM: 0.8082
FR: 86.9

$f_{c}=10$

STSIM: 0.8290
FR: 85.0

Figure 9: Effects of $f_{c}$ for the ResNet model [23] and the 4DLF dataset
[66]. Under each perturbed image, the similarity index with the clean image
and the fooling rate (FR) obtained by the corresponding perturbation are
given. The hyperparameter setting that is used in our method for producing the
experimental results in the main paper, is shown in green.

JND thresholds. To exhibit the effect of the adopted JND thresholding model on
imperceptibility, we examine our FTGAP method with and without JND thresholds
on the ResNet model [23]. For FTGAP without JND thresholds, we empirically
find a constant to replace the JND thresholds over all frequency bands while
producing a fooling rate result that is similar to FTGAP with JND thresholds,
and we compare the imperceptibility of the computed and applied adversarial
perturbations. According to Figure 6, the adopted JND-based thresholding model
can help improve the imperceptibility of the generated adversarial
perturbations.

$\lambda_{l}$ and $\lambda_{h}$. The effects of $\lambda_{l}$ and
$\lambda_{h}$ for low and high frequency bands, respectively, are illustrated
based on the ResNet model [23] and the 4DLF dataset [66] in Figure 8. From
Figure 8, it can be seen that increasing both $\lambda_{l}$ and $\lambda_{h}$
can result in higher fooling rates but in lower similarity values (i.e., more
visible perturbations). In particular, increasing $\lambda_{l}$ can
significantly increase the perceptibility of the adversarial perturbation as
compared to an increase in the value of $\lambda_{h}$, which is consistent
with the fact that perturbations in low frequency components can be more
perceived as compared to perturbations in high frequency components.
Furthermore, Figure 8 shows that increasing $\lambda_{h}$ can result in a
higher fooling rate and in a less perceptible perturbation as compared to
$\lambda_{l}$.

$f_{c}$. We illustrate the effects of the cut-off frequency $f_{c}$ based on
the ResNet model [23] and the 4DLF dataset [66] in Figure 9 for
$\lambda_{l}=0$ and $\lambda_{h}=3$. A higher $f_{c}$ value will result in
more frequency bands being treated as belonging to the low frequency region
($f<f_{c}$) while shrinking the high frequency region to bands with higher
indices (corresponding to $f>f_{c}$). The higher $f_{c}$ will limit the
computed perturbation to the higher frequency bands in the DCT domain.
According to Figure 9, the fooling rate becomes saturated when we reduce
$f_{c}$ to be less than 4 cycles/degree.

##  Appendix G Visual Comparisons of More Examples

MINC [3]
&
DeepTEN [75]

GTOS [73, 72]
&
ResNet [23]

DTD [6]
&
MuLTER [26]

4DLF [66]
&
DEP [72]

FMD [58]
&
ResNet [23]

KTH [4]
&
MuLTER [26]

no attack

GAP-tar [50]
STSIM: 0.7934

STSIM: 0.9410

STSIM: 0.8788

STSIM: 0.8083

STSIM: 0.9135

STSIM: 0.9112

sPGD [47, 56]

STSIM: 0.8032

STSIM: 0.9319

STSIM: 0.9030

STSIM: 0.8082

STSIM: 0.8982

STSIM: 0.8901

UPGD [13]

STSIM: 0.7954

STSIM: 0.9565

STSIM: 0.9374

STSIM: 0.8094

STSIM: 0.9081

STSIM: 0.9022

FTGAP (ours)

STSIM: 0.8082

STSIM: 0.9456

STSIM: 0.9403

STSIM: 0.8458

STSIM: 0.9175

STSIM: 0.9273

Figure 10: Visual comparison of different universal attack methods. Each row
shows the perturbed images that result from applying on the clean image
(leftmost image), universal perturbations that are generated by the considered
universal attack methods for different DNN models and datasets (shown in
leftmost column). The structural texture similarity (STSIM) index is given
below each perturbed image. Bold number indicates best performance for the
model & dataset in each row.

MINC [3]
&
DeepTEN [75]

GTOS [73, 72]
&
ResNet [23]

DTD [6]
&
MuLTER [26]

4DLF [66]
&
DEP [72]

FMD [58]
&
ResNet [23]

KTH [4]
&
MuLTER [26]

no attack

GAP-tar [50]

STSIM: 0.7956

STSIM: 0.9177

STSIM: 0.8225

STSIM: 0.8607

STSIM: 0.8715

STSIM: 0.8220

sPGD [47, 56]

STSIM: 0.8033

STSIM: 0.9060

STSIM: 0.8467

STSIM: 0.8627

STSIM: 0.8518

STSIM: 0.7980

UPGD [13]

STSIM: 0.7987

STSIM: 0.9384

STSIM: 0.8974

STSIM: 0.8606

STSIM: 0.8646

STSIM: 0.8139

FTGAP (ours)

STSIM: 0.8056

STSIM: 0.9235

STSIM: 0.9111

STSIM: 0.8954

STSIM: 0.8746

STSIM: 0.8615

Figure 11: Visual comparison of different universal attack methods. Each row
shows the perturbed images that result from applying on the clean image
(leftmost image), universal perturbations that are generated by the considered
universal attack methods for different DNN models and datasets (shown in
leftmost column). The structural texture similarity (STSIM) index is given
below each perturbed image. Bold number indicates best performance for the
model & dataset in each row.

Additional visual comparisons of perturbed images that are generated by our
FTGAP method and by existing universal attack methods are provided in Figures
10 and 11.

##  Appendix H Results for Alternative Baselines

MINC [3]

GTOS [73, 72]

DTD [6]

4DLF [66]

FMD [58]

KTH [4]

no attack

sPGD [47, 56]
STSIM: 0.8095
FR: 93.1

STSIM: 0.9089
FR: 70.0

STSIM: 0.8300
FR: 78.8

STSIM: 0.8585
FR: 85.6

STSIM: 0.8957
FR: 87.0

STSIM: 0.9268
FR: 72.8

FT-sPGD (ours)
STSIM: 0.8373
FR: 93.7

STSIM: 0.8821
FR: 76.0

STSIM: 0.8738
FR: 86.6

STSIM: 0.8985
FR: 90.6

STSIM: 0.9017
FR: 91.0

STSIM: 0.9581
FR: 77.8

UPGD [13]
STSIM: 0.8009
FR: 93.1

STSIM: 0.8893
FR: 72.4

STSIM: 0.8276
FR: 80.5

STSIM: 0.8582
FR: 86.1

STSIM: 0.9011
FR: 86.0

STSIM: 0.9298
FR: 74.3

FT-UPGD (ours)
STSIM: 0.8281
FR: 94.4

STSIM: 0.9039
FR: 76.1

STSIM: 0.8691
FR: 90.4

STSIM: 0.8944
FR: 92.2

STSIM: 0.9095
FR: 88.0

STSIM: 0.9580
FR: 77.3

Figure 12: Visual comparison of different universal attack methods. Each row
shows the perturbed images that result from applying on the clean image
(leftmost image), universal perturbations that are generated by the considered
universal attack methods (shown in top row) for the DEP model [72] and
different datasets (shown in leftmost column). The structural texture
similarity (STSIM) index and resulting fooling rate (FR) are given below each
perturbed image. Bold numbers indicate best performance for each image in a
row when comparing each baseline attack method with its variant using our
proposed frequency-tuned (FT) attack framework.

Our frequency-tuned method can be easily adapted to improve the performance of
other baseline methods, such as sPGD [47, 56] and UPGD [13]. We evaluate our
proposed frequency-tuned attack framework based on sPGD and UPGD, which we
refer to as FT-sPGD and FT-UPGD, respectively. The obtained performance
results (Table 8, Figure 12) show that our proposed frequency-tuned approach
can enhance the adversarial attack strengths of the baseline methods in terms
of white-box fooling rates on almost all the datasets and DNN models as shown
in Table 8, with a reduced perceptibility as illustrated in Figure 12.