[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-291292-105":3,"detail-sidebar-cat-0-en-105":81,"doc-detail-291292-en":131},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","dat-improving-adversarial-robustness-via-generative-amplitude-mix-up-in-frequency-domain","DAT - Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain","","Adversarial training (AT) protects deep neural networks from adversarial attacks by incorporating adversarial examples into learning. Existing work indicates adversarial attacks more severely degrade patterns in the frequency-domain phase than in the amplitude, harming correct categorization. This paper mixes the amplitude of training samples’ frequency spectra with those of distractor images to guide the model toward phase patterns less affected by perturbations, improving robustness. It remains difficult to pick distractors that preserve phase. The proposed optimized Adversarial Amplitude Generator achieves a better robustness–phase retention tradeoff.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/research-report/","Research & Report",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/dat-improving-adversarial-robustness-via-generative-amplitude-mix-up-in-frequency-domain/291292/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/dat-improving-adversarial-robustness-via-generative-amplitude-mix-up-in-frequency-domain/291292.png","ImageObject",300,407,{"name":42,"@type":43},"4398046744996","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-29","2026-09-17",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",14,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What problem does the paper address in adversarial training?","Question",{"text":63,"@type":64},"It targets the challenge that adversarial attacks disproportionately damage frequency-domain phase patterns, which are crucial for semantics and accurate prediction during AT.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"How does the proposed method improve robustness?",{"text":68,"@type":64},"It introduces a strategy that mixes frequency-amplitude information with carefully generated adversarial amplitude from distractors, guiding the model to focus on phase patterns less impacted by adversarial perturbations.",{"name":70,"@type":61,"acceptedAnswer":71},"What is the role of the Adversarial Amplitude Generator (AAG) and DAT?",{"text":72,"@type":64},"The AAG generates an optimized adversarial amplitude to balance maximizing model loss while limiting fitting of amplitude patterns, and the resulting Dual Adversarial Training (DAT) combines this with an efficient adversarial example production procedure.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},291292,1789644310,{"code":4,"msg":82,"data":83},"success",[84,88,92,96,101,106,111,115,120,123,127],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":85,"show_sort_weight":86,"slug":87},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":89,"show_sort_weight":90,"slug":91},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":93,"show_sort_weight":94,"slug":95},"Exam",70,"exam",{"id":97,"doc_module":4,"doc_module_name":25,"category_name":98,"show_sort_weight":99,"slug":100},5,"Comic",60,"comic",{"id":102,"doc_module":4,"doc_module_name":25,"category_name":103,"show_sort_weight":104,"slug":105},6,"Technology",50,"technology",{"id":107,"doc_module":4,"doc_module_name":25,"category_name":108,"show_sort_weight":109,"slug":110},7,"Healthcare",40,"healthcare",{"id":112,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":113,"slug":114},8,30,"research-report",{"id":116,"doc_module":4,"doc_module_name":25,"category_name":117,"show_sort_weight":118,"slug":119},9,"Religion & Spirituality",20,"religion-spirituality",{"id":118,"doc_module":4,"doc_module_name":25,"category_name":121,"show_sort_weight":118,"slug":122},"World Cup","world-cup",{"id":124,"doc_module":4,"doc_module_name":25,"category_name":125,"show_sort_weight":124,"slug":126},10,"Lifestyle","lifestyle",{"id":128,"doc_module":4,"doc_module_name":25,"category_name":129,"show_sort_weight":97,"slug":130},19,"General","general",{"code":4,"msg":82,"data":132},{"doc_id":79,"user_id":133,"nickname":42,"user_avatar":11,"doc_module":4,"category_id":112,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":113,"language":139,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":12,"update_tm":80,"read_time":143,"preview_page_count":4},4398046744996,"DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain  \nFengpeng Li1 Kemou Li1 Haiwei Wu2 Jinyu Tian3 Jiantao Zhou1 ∗  \n1 State Key Laboratory of Internet of Things for Smart City, University of Macau  \n2Department of Computer Science, City University of Hong Kong  \n3Faculty of Innovation Engineering, Macau University of Science and Technology  \nAbstract  \nTo protect deep neural networks (DNNs) from adversarial attacks, adversarial training (AT) is developed by incorporating adversarial examples (AEs) into model training. Recent studies show that adversarial attacks disproportionately impact the patterns within the phase of the sample’s frequency spectrum—typically containing crucial semantic information—more than those in the amplitude, resulting in the model’s erroneous categorization of AEs. We find that, by mixing the amplitude of training samples’ frequency spectrum with those of distractor images for AT, the model can be guided to focus on phase patterns unaffected by adversarial perturbations. As a result, the model’s robustness can be improved. Unfortunately, it is still challenging to select appropriate distractor images, which should mix the amplitude without affecting the phase patterns. To this end, in this paper, we propose an optimized Adversarial Amplitude Generator (AAG) to achieve a better tradeoff between improving the model’s robustness and retaining phase patterns.  \nBased on this generator, together with an efficient AE production procedure, we design a new Dual Adversarial Training (DAT) strategy. Experiments on various datasets show that our proposed DAT leads to significantly improved robustness against diverse adversarial attacks. The source code is available at [https://](https://)[ ](https://)[github.com/Feng-peng-Li/DAT](github.com/Feng-peng-Li/DAT).  \n1 Introduction  \nDNNs have been successfully applied to various tasks [21, 32, 25] . However, recent studies reveal that DNNs are vulnerable to adversarial examples (AEs), created by applying subtle yet deceptive adversarial perturbations to benign samples [40, 51] . Such vulnerabilities have sparked considerable interests, leading to the development of numerous adversarial attacks designed to deceive DNNs [40, 19, 39, 13, 20, 5, 6] . Furthermore, serious concerns about the trustworthiness of artificial intelligence have been raised, due to these fundamental vulnerabilities [47, 37] . To mitigate these threats, adversarial training (AT) has been developed to enhance model robustness by incorporating AEs into training through a min-max strategy [40, 61, 38] . Based on the typical method, PGD-AT [40], a variety of AT strategies have been devised [38, 29, 37](see Appendix B for related works) .  \nFor image signals transformed into the frequency domain using, e.g. the discrete Fourier transform (DFT), several AT works [59, 52, 53, 43] explore the adversarial attacks’ behavior on sample’s frequency spectrum. Frequency spectra consist of amplitude and phase; the amplitude typically captures stylistic information, whereas the phase encompasses richer semantics [7] . Recent studies [58, 63] find, as shown in Figure 1, that adversarial attacks often severely eliminate some semantics in the phase, making it difficult for models to extract features for correctly predicting AEs, while the  \n* Corresponding author: Jiantao Zhou ([jtzhou@um.edu.mo](jtzhou@um.edu.mo)).  \n38th Conference on Neural Information Processing Systems (NeurIPS 2024) .  \nimpacts on amplitude are relatively mild. Moreover, by forcing the model to focus on phase patterns,[7, 63] confirm the model can learn more features unaffected by image corruptions, e.g., Gaussian noise and defocus blur, improving the model’s performance on corrupted samples.  \nTo explore the impact of adversarial perturbations on phase and amplitude patterns respectively, we conduct some studies (see Sec. 2 for details) . We find that the standard model trained without AT has worse perfo","cbCaioES90TSpV30","https://ap.wps.com/l/cbCaioES90TSpV30","pdf",939093,"English","# Abstract\n# Introduction\n## Adversarial vulnerabilities and adversarial training\n## Frequency-domain phase vs amplitude effects\n## Proposed Dual Adversarial Training (DAT)","[{\"question\":\"What problem does the paper address in adversarial training?\",\"answer\":\"It targets the challenge that adversarial attacks disproportionately damage frequency-domain phase patterns, which are crucial for semantics and accurate prediction during AT.\"},{\"question\":\"How does the proposed method improve robustness?\",\"answer\":\"It introduces a strategy that mixes frequency-amplitude information with carefully generated adversarial amplitude from distractors, guiding the model to focus on phase patterns less impacted by adversarial perturbations.\"},{\"question\":\"What is the role of the Adversarial Amplitude Generator (AAG) and DAT?\",\"answer\":\"The AAG generates an optimized adversarial amplitude to balance maximizing model loss while limiting fitting of amplitude patterns, and the resulting Dual Adversarial Training (DAT) combines this with an efficient adversarial example production procedure.\"}]","DAT - Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain | PDF",76]