FAMPE: Frequency-Aware Model Parameter Explorer

• The paper introduces FAMPE, an attribution method that separates high and low-frequency components using an adaptive energy-based cutoff to enhance explanation robustness.
• It employs transferable frequency-aware adversarial attacks by scaling frequency bands with a noise parameter α to isolate robust model features under noise.
• Experimental results on ImageNet show a 13.02% improvement in Insertion Score over AttEXplore, with ablation studies highlighting the benefits of high-frequency exploration.

Frequency-Aware Model Parameter Explorer (FAMPE) is an attribution method for deep neural networks (DNNs) that combines model parameter exploration (MPE) with transferable frequency-aware adversarial attacks in order to improve explainability under real-world noise and intentional perturbations. The method explicitly separates high- and low-frequency components, controls their relative influence through a noise scaling factor $\alpha$, and determines the low/high cutoff per image through an energy-based rule rather than manual tuning. In the reported ImageNet experiments, FAMPE attains an average gain of 13.02% in Insertion Score relative to AttEXplore, while its ablation studies indicate that the reported gains derive mainly from high-frequency exploration (Yavari et al., 25 Sep 2025).

1. Motivation and problem setting

FAMPE is designed for a setting in which standard attribution techniques are unreliable because DNNs are highly non-linear and often rely on subtle, distributed features. Real-world inputs contain sensor noise, compression artifacts, and domain shifts, while adversarial perturbations can exploit frequency biases to flip predictions while preserving human-perceived content. Under these conditions, gradient-based saliency is described as unstable because of gradient saturation and sensitivity to baselines, whereas perturbation-based explanations are brittle under small but structured noise (Yavari et al., 25 Sep 2025).

The method is also motivated by the observation that models exhibit texture bias and frequency-dependent robustness. Some architectures depend more on high-frequency edges, whereas others depend more on low-frequency global structure. If an attribution method ignores frequency composition, explanations can become misleading or collapse under noise targeted at specific spectral bands. FAMPE addresses this by treating spectral structure as part of the attribution problem rather than as an external nuisance (Yavari et al., 25 Sep 2025).

This framing also defines the method’s position relative to prior work. Local-surrogate and gradient-only methods, including LIME, Saliency, Grad-CAM, DeepLIFT, IG, and GIG, are described as either oversimplifying the decision logic, depending on baselines and fixed paths, or producing coarse maps that miss fine structures. Adversarial boundary-based methods such as AGI, BIG, and MFABA improve faithfulness by exploring decision boundaries, but they require careful path construction and can be costly. AttEXplore introduced MPE with frequency-domain multiplicative noise, but it applied an all-pass frequency alteration and did not separate high- and low-frequency bands. FAMPE’s central methodological claim is that explicit decoupling of bands, together with adaptive cutoff selection, yields more precise attributions (Yavari et al., 25 Sep 2025).

2. Transferable frequency-aware adversarial attacks

The attack formulation begins with a frequency decomposition of an image $x \in \mathbb{R}^{H\times W\times C}$. For a single channel, FAMPE uses the $2$D discrete Fourier transform

$$X(u,v)=\sum_{m=0}^{H-1}\sum_{n=0}^{W-1} x(m,n)\, e^{-j 2\pi\left(\frac{um}{H}+\frac{vn}{W}\right)},$$

with inverse transform $\mathcal{F}^{-1}$. After FFT shifting to center DC, it defines the radial frequency

$r(u,v)=\sqrt{u^2+v^2},$

chooses a cutoff $c_f$, and constructs masks

$$M_{low}(u,v)=\mathbf{1}\{r(u,v)\le c_f\},\qquad M_{high}(u,v)=\mathbf{1}\{r(u,v)>c_f\}.$$

The corresponding components are reconstructed as

$$x_{low}=\mathcal{F}^{-1}(M_{low}\odot X),\qquad x_{high}=\mathcal{F}^{-1}(M_{high}\odot X),$$

so that $x \approx x_{low}+x_{high}$ up to transform normalization (Yavari et al., 25 Sep 2025).

Perturbations are likewise decomposed as

$x \in \mathbb{R}^{H\times W\times C}$0

with Fourier-domain masking applied separately to the two bands. FAMPE instantiates these perturbations through multiplicative Gaussian noise in frequency space, scaled separately in each band. If $x \in \mathbb{R}^{H\times W\times C}$1 i.i.d. over frequencies and $x \in \mathbb{R}^{H\times W\times C}$2, then

$x \in \mathbb{R}^{H\times W\times C}$3

The attacked input is constructed as

$x \in \mathbb{R}^{H\times W\times C}$4

The paper also gives the equivalent FFT/IFFT expression with frequency shift and multiplicative masks (Yavari et al., 25 Sep 2025).

The cutoff is not manually selected. Instead, FAMPE chooses $x \in \mathbb{R}^{H\times W\times C}$5 by an energy fraction $x \in \mathbb{R}^{H\times W\times C}$6, for example $x \in \mathbb{R}^{H\times W\times C}$7, on the magnitude spectrum $x \in \mathbb{R}^{H\times W\times C}$8:

$x \in \mathbb{R}^{H\times W\times C}$9

This rule ensures that the low-pass region contains a prescribed fraction of total energy and adapts the band split to each image (Yavari et al., 25 Sep 2025).

The attack objective is written as

$2$0

together with the low- and high-frequency masking constraints in the Fourier domain. Iterative updates average gradients over $2$1 frequency-aware variants and move along a nonlinear path:

$2$2

with discrete accumulation

$2$3

The attacks are described as transferable because frequency-constrained perturbations target generalizable spectral biases shared across architectures, with low-frequency attacks known to transfer strongly and high-frequency components probing edge and texture reliance (Yavari et al., 25 Sep 2025).

3. Attribution mechanism and algorithmic structure

FAMPE adopts the MPE perspective that modifying inputs along decision-boundary directions is equivalent to probing how parameters $2$4 support predictions. Its main output is an input attribution map obtained by accumulating sensitivities along the nonlinear path induced by frequency-aware adversarial samples:

$2$5

The paper describes $2$6 as an attribution map over input features enhanced by separate band explorations through $2$7 and $2$8 (Yavari et al., 25 Sep 2025).

An optional parameter-attribution extension computes sensitivities to $2$9 along the same path:

$$X(u,v)=\sum_{m=0}^{H-1}\sum_{n=0}^{W-1} x(m,n)\, e^{-j 2\pi\left(\frac{um}{H}+\frac{vn}{W}\right)},$$0

where $$X(u,v)=\sum_{m=0}^{H-1}\sum_{n=0}^{W-1} x(m,n)\, e^{-j 2\pi\left(\frac{um}{H}+\frac{vn}{W}\right)},$$1 can be chosen as $$X(u,v)=\sum_{m=0}^{H-1}\sum_{n=0}^{W-1} x(m,n)\, e^{-j 2\pi\left(\frac{um}{H}+\frac{vn}{W}\right)},$$2 and $$X(u,v)=\sum_{m=0}^{H-1}\sum_{n=0}^{W-1} x(m,n)\, e^{-j 2\pi\left(\frac{um}{H}+\frac{vn}{W}\right)},$$3 is typically $$X(u,v)=\sum_{m=0}^{H-1}\sum_{n=0}^{W-1} x(m,n)\, e^{-j 2\pi\left(\frac{um}{H}+\frac{vn}{W}\right)},$$4. While the method primarily reports input attributions, this extension is presented as consistent with the MPE philosophy introduced by AttEXplore (Yavari et al., 25 Sep 2025).

A notable feature is explicit separation of band contributions. The method allows a decomposition

$$X(u,v)=\sum_{m=0}^{H-1}\sum_{n=0}^{W-1} x(m,n)\, e^{-j 2\pi\left(\frac{um}{H}+\frac{vn}{W}\right)},$$5

with

$$X(u,v)=\sum_{m=0}^{H-1}\sum_{n=0}^{W-1} x(m,n)\, e^{-j 2\pi\left(\frac{um}{H}+\frac{vn}{W}\right)},$$6

and optional recombination

$$X(u,v)=\sum_{m=0}^{H-1}\sum_{n=0}^{W-1} x(m,n)\, e^{-j 2\pi\left(\frac{um}{H}+\frac{vn}{W}\right)},$$7

In practice, the paper varies $$X(u,v)=\sum_{m=0}^{H-1}\sum_{n=0}^{W-1} x(m,n)\, e^{-j 2\pi\left(\frac{um}{H}+\frac{vn}{W}\right)},$$8 across $$X(u,v)=\sum_{m=0}^{H-1}\sum_{n=0}^{W-1} x(m,n)\, e^{-j 2\pi\left(\frac{um}{H}+\frac{vn}{W}\right)},$$9 to analyze band roles rather than fixing a single hard decomposition (Yavari et al., 25 Sep 2025).

The procedural implementation is straightforward. Inputs are an image $\mathcal{F}^{-1}$0, label $\mathcal{F}^{-1}$1, model $\mathcal{F}^{-1}$2, hyperparameters $\mathcal{F}^{-1}$3, $\mathcal{F}^{-1}$4, $\mathcal{F}^{-1}$5, $\mathcal{F}^{-1}$6, $\mathcal{F}^{-1}$7, $\mathcal{F}^{-1}$8, $\mathcal{F}^{-1}$9, a norm $r(u,v)=\sqrt{u^2+v^2},$0, and pixel bounds. The algorithm computes the shifted FFT spectrum, determines $r(u,v)=\sqrt{u^2+v^2},$1 by the energy rule, builds $r(u,v)=\sqrt{u^2+v^2},$2 and $r(u,v)=\sqrt{u^2+v^2},$3, initializes $r(u,v)=\sqrt{u^2+v^2},$4, and iterates for $r(u,v)=\sqrt{u^2+v^2},$5: generating $r(u,v)=\sqrt{u^2+v^2},$6 frequency-aware variants, averaging gradients, updating along $r(u,v)=\sqrt{u^2+v^2},$7, accumulating $r(u,v)=\sqrt{u^2+v^2},$8, and projecting onto the $r(u,v)=\sqrt{u^2+v^2},$9 ball and valid pixel range. The reported computational complexity is approximately $c_f$0, with per-iteration FFT/IFFT cost $c_f$1 and gradient cost $c_f$2. The paper uses $c_f$3, $c_f$4, $c_f$5, $c_f$6, $c_f$7, and $c_f$8 (Yavari et al., 25 Sep 2025).

4. Evaluation protocol and reported performance

The evaluation uses an ImageNet subset of 1,000 images and four architectures: Inception-v3, ResNet-50, VGG-16, and MaxViT-T. Baselines include IG, DeepLIFT, GIG, AGI, and AttEXplore. Faithfulness is measured with Insertion Score (IS) and Deletion Score (DS), where IS progressively inserts top-ranked features into a baseline image and DS progressively removes top-ranked features from the original input. The paper states that lower DS is better (Yavari et al., 25 Sep 2025).

The main quantitative result is an average gain of 13.02% in Insertion Score over AttEXplore across architectures. The per-architecture Insertion/Deletion results are as follows:

Architecture	FAMPE IS / DS	AttEXplore IS / DS
Inception-v3	0.4802 / 0.0595	0.4244 / 0.0999
ResNet-50	0.3902 / 0.0953	0.3491 / 0.1256
VGG-16	0.3289 / 0.0829	0.2881 / 0.0962
MaxViT-T	0.5744 / 0.1015	0.4650 / 0.1753

Against AGI, the reported values are 0.4143 / 0.0653 for Inception-v3, 0.3572 / 0.0543 for ResNet-50, 0.2935 / 0.0431 for VGG-16, and 0.4792 / 0.2184 for MaxViT-T. The paper characterizes FAMPE as consistently improving IS and often reducing DS relative to AttEXplore, with the strongest gains on Inception-v3 and MaxViT-T (Yavari et al., 25 Sep 2025).

Qualitative examples are also emphasized. For strawberry, African hunting dog, and ruddy turnstone, FAMPE heatmaps with $c_f$9 are reported to better isolate object boundaries and fine details than AGI and AttEXplore. At mid $$M_{low}(u,v)=\mathbf{1}\{r(u,v)\le c_f\},\qquad M_{high}(u,v)=\mathbf{1}\{r(u,v)>c_f\}.$$0 values around $$M_{low}(u,v)=\mathbf{1}\{r(u,v)\le c_f\},\qquad M_{high}(u,v)=\mathbf{1}\{r(u,v)>c_f\}.$$1, the maps resemble AttEXplore, whereas at high $$M_{low}(u,v)=\mathbf{1}\{r(u,v)\le c_f\},\qquad M_{high}(u,v)=\mathbf{1}\{r(u,v)>c_f\}.$$2 the maps degrade (Yavari et al., 25 Sep 2025).

5. Ablation studies, robustness, and limitations

The ablation results strongly emphasize the role of high-frequency exploration. When varying $$M_{low}(u,v)=\mathbf{1}\{r(u,v)\le c_f\},\qquad M_{high}(u,v)=\mathbf{1}\{r(u,v)>c_f\}.$$3, emphasizing high-frequency exploration through small $$M_{low}(u,v)=\mathbf{1}\{r(u,v)\le c_f\},\qquad M_{high}(u,v)=\mathbf{1}\{r(u,v)>c_f\}.$$4 typically yields clearer, more localized attributions. On Inception-v3, 494 out of 1000 samples achieve their maximum IS at $$M_{low}(u,v)=\mathbf{1}\{r(u,v)\le c_f\},\qquad M_{high}(u,v)=\mathbf{1}\{r(u,v)>c_f\}.$$5; on MaxViT-T, 663 out of 1000 do so. At high $$M_{low}(u,v)=\mathbf{1}\{r(u,v)\le c_f\},\qquad M_{high}(u,v)=\mathbf{1}\{r(u,v)>c_f\}.$$6, IS drops and DS rises, which the paper interprets as evidence that overly perturbing low-frequency structure harms faithfulness (Yavari et al., 25 Sep 2025).

The paper also reports a scatter analysis for MaxViT-T in which images often have $$M_{low}(u,v)=\mathbf{1}\{r(u,v)\le c_f\},\qquad M_{high}(u,v)=\mathbf{1}\{r(u,v)>c_f\}.$$7 below 60, with a long tail beyond 80. Many low-$$M_{low}(u,v)=\mathbf{1}\{r(u,v)\le c_f\},\qquad M_{high}(u,v)=\mathbf{1}\{r(u,v)>c_f\}.$$8 maxima cluster within $$M_{low}(u,v)=\mathbf{1}\{r(u,v)\le c_f\},\qquad M_{high}(u,v)=\mathbf{1}\{r(u,v)>c_f\}.$$9, supporting the benefit of high-frequency focus across diverse spectral content. At the same time, the method is not presented as purely high-frequency. Low-frequency components tend to transfer strongly, while high-frequency exploration adds fine-grained sensitivity. A common misconception would therefore be to read FAMPE as discarding low-frequency structure; its actual mechanism is a controlled low/high decomposition with adaptive cutoff selection (Yavari et al., 25 Sep 2025).

Sensitivity analyses further characterize the hyperparameters. The energy-based cutoff $$x_{low}=\mathcal{F}^{-1}(M_{low}\odot X),\qquad x_{high}=\mathcal{F}^{-1}(M_{high}\odot X),$$0 robustly sets $$x_{low}=\mathcal{F}^{-1}(M_{low}\odot X),\qquad x_{high}=\mathcal{F}^{-1}(M_{high}\odot X),$$1 without manual tuning; lowering $$x_{low}=\mathcal{F}^{-1}(M_{low}\odot X),\qquad x_{high}=\mathcal{F}^{-1}(M_{high}\odot X),$$2 increases $$x_{low}=\mathcal{F}^{-1}(M_{low}\odot X),\qquad x_{high}=\mathcal{F}^{-1}(M_{high}\odot X),$$3 and shifts more energy into the low band. Larger $$x_{low}=\mathcal{F}^{-1}(M_{low}\odot X),\qquad x_{high}=\mathcal{F}^{-1}(M_{high}\odot X),$$4 increases attack strength but risks artifacts; $$x_{low}=\mathcal{F}^{-1}(M_{low}\odot X),\qquad x_{high}=\mathcal{F}^{-1}(M_{high}\odot X),$$5 and $$x_{low}=\mathcal{F}^{-1}(M_{low}\odot X),\qquad x_{high}=\mathcal{F}^{-1}(M_{high}\odot X),$$6 improve stability at the cost of runtime; $$x_{low}=\mathcal{F}^{-1}(M_{low}\odot X),\qquad x_{high}=\mathcal{F}^{-1}(M_{high}\odot X),$$7 controls movement along boundary directions, where values that are too large can overshoot and values that are too small reduce signal; and moderate $$x_{low}=\mathcal{F}^{-1}(M_{low}\odot X),\qquad x_{high}=\mathcal{F}^{-1}(M_{high}\odot X),$$8 works well, whereas extreme values can yield unstable spectra (Yavari et al., 25 Sep 2025).

The paper attributes improved robustness and stability to the decoupling of spectral bands and the adaptive cutoff. It states that FAMPE’s attributions remain more stable under frequency manipulations and real-world noise because nonlinear path integration accumulates robust gradient evidence over transferable, band-limited variations. It also notes several limitations: FFT band masks assume spatial stationarity, so wavelet transforms could be beneficial for strongly non-stationary signals; extreme $$x_{low}=\mathcal{F}^{-1}(M_{low}\odot X),\qquad x_{high}=\mathcal{F}^{-1}(M_{high}\odot X),$$9 values can degrade maps; and the $x \approx x_{low}+x_{high}$0 frequency variants over $x \approx x_{low}+x_{high}$1 iterations add computational overhead, even though FFTs are fast and parallelizable on GPUs. For practice, the paper recommends $x \approx x_{low}+x_{high}$2, sweeping $x \approx x_{low}+x_{high}$3, and starting from $x \approx x_{low}+x_{high}$4, $x \approx x_{low}+x_{high}$5, $x \approx x_{low}+x_{high}$6, $x \approx x_{low}+x_{high}$7, and $x \approx x_{low}+x_{high}$8. The implementation is reported in Python 3.11 and TensorFlow 2.18, with experiments run on an NVIDIA GeForce RTX 4090 (24 GB) and Intel Core i9 (Yavari et al., 25 Sep 2025).

6. Position within frequency-aware model analysis

Within attribution research, FAMPE is positioned as a refinement of adversarial boundary-based explanation. Relative to AttEXplore, the methodological difference is not the replacement of nonlinear path aggregation, but the replacement of all-pass frequency alteration with explicit low/high band masks and an adaptive, energy-based cutoff. The reported effect is more informative boundary exploration and improved fine-grained attribution (Yavari et al., 25 Sep 2025).

A broader interpretation is that FAMPE belongs to a larger frequency-aware turn in model analysis and adaptation. In vision transformers, frequency-domain modulation has been used to improve parameter-efficient fine-tuning by inserting a frequency fine-tuning module between ViT blocks (Ly et al., 2024). In large-model fine-tuning, sparse inverse-DCT parameterization has been proposed as an alternative to low-rank decomposition, with selective frequency locations treated as the basic trainable units (Du et al., 5 Feb 2025). In parameter-efficient multi-task learning, sinusoidal frequency switching has been used to generate task-specialized weights from a shared base through bounded frequencies (Liu et al., 22 Mar 2026). This suggests that FAMPE is part of a broader line of work that treats the frequency domain not merely as a preprocessing space, but as a structured axis for probing, modulating, and interpreting model behavior.

Its distinctive contribution within that broader landscape is narrower and more specific. FAMPE is not a general fine-tuning framework, a recommendation architecture, or a multi-task modulation scheme. It is an explainability method whose novelty lies in transferable, frequency-aware adversarial exploration, per-image adaptive cutoff selection, and attribution accumulation along a nonlinear path. In that sense, it links spectral bias, adversarial transferability, and attribution faithfulness into a single exploratory mechanism (Yavari et al., 25 Sep 2025).