[tc]

As one example of how this can be useful, Jo and Bengio recently used Fourier filtering to measure the susceptibility of neural networks to adversarial examples. By changing the statistics of the images in a principled manner, they confirmed that even networks that generalize well are learning mostly surface-level statistics. E.g. an image of a car is more likely to also have asphalt and building colors than greenery. The networks overweight these kinds of features, and that turns out to be good enough to get high scores on many data sets. Using Fourier filtering, they were able to alter the images to generate arbitrarily different surface statistics while preserving how humans would perceive the images.

https://arxiv.org/abs/1711.11561 (https://news.ycombinator.com/item?id=16165126)

[sytelus]

I was pretty concerned by this paper but now I'm much more calmed down :). I think authors have jumped to conclusion here. In the two papers that they have cited themselves mensions that human visuals system actually filters out high freq components before transmitting signals further down the chain. The paper says the same thing: if you apply low pass filtering, network is more well behaved. So the expectations that network should consume high freq components and still be resistant to adversarial attacks is unfounded.