Robust deep learning object recognition models rely on low frequency information in natural images
Fig 6
Frequency analysis of models trained on ImageNet.
One baseline model (‘base’), two models (‘adv’) trained for adversarial robustness, and six models (‘crp’) trained for corruption robustness are compared. (a) Minimum adversarial perturbation size ϵ versus the half-power frequency f0.5 calculated from adversarial perturbation spectra. (b) Model accuracy on ImageNet-C dataset versus reverse frequency frev calculated from hybrid image experiment.