---
title: Low-Frequency Perceptual Perturbations
url: https://www.emergentmind.com/topics/low-frequency-perceptual-perturbations
type: topic
---

# Low-Frequency Perceptual Perturbations

Low-frequency perceptual perturbations are perturbations whose energy is concentrated in low-frequency components of a signal and whose practical importance is determined by perceptual sensitivity rather than by amplitude alone. In images, low-frequency components correspond to global, slowly varying structure—object shape, coarse color distributions, and smooth backgrounds—whereas high-frequency components correspond to texture, fine edges, and noise; in time series, low-frequency components correspond to slow changes, level shifts, and square-wave or step-like signals [2310.20175][2503.19519]. Across adversarial machine learning, perceptual coding, and psychophysics, the central issue is whether altering these components yields changes that remain perceptually acceptable to humans while producing large effects on classifiers, generators, or sensory judgments [1903.00073][2003.05549].

## 1. Signal-theoretic formulation

Low-frequency perceptual perturbations are usually defined through an explicit frequency decomposition. In image attacks, one common formulation uses the 2D DCT and a binary mask over coefficients,
\[
\mathrm{FreqMask}(\delta)=\mathrm{IDCT}\big(m\odot \mathrm{DCT}(\delta)\big),
\]
so that optimization is restricted to prescribed frequency bands [1903.00073]. In Gaussian-filter formulations, the low-frequency part of an image is approximated by
\[
\mathbf{x}_{\mathrm{LF}} = W * \mathbf{x},
\]
and the high-frequency residual by
\[
\mathbf{x}_{\mathrm{HF}} = \mathbf{x} - W * \mathbf{x},
\]
with the Gaussian kernel acting as a spatial-domain proxy for frequency decomposition [2310.20175]. Wavelet-based methods instead isolate a low-frequency approximation band \(x_{\mathrm{LL}}\) and detail bands \(x_{\mathrm{HL}}, x_{\mathrm{LH}}, x_{\mathrm{HH}}\), enabling perturbation of global structure while leaving high-frequency detail largely intact [2508.20595].

The choice of transform changes the operational meaning of “low frequency.” FTUAP uses block-wise \(8\times 8\) DCT and groups coefficients into slanting bands defined by \(k_1+k_2=i\), with low-frequency bands \(i=0,1,2,3\), middle-frequency bands \(i=4,\dots,10\), and high-frequency bands \(i=11,\dots,14\) [2003.05549]. LFBA instead defines the low-frequency region as the top-left portion of the DCT spectrum and restricts the search to about 18.3% of the spectrum [2402.15653]. In MLLM analysis, low and high frequencies are separated in the Fourier plane by Gaussian low-pass and high-pass filters with cutoff \(\mathcal{D}_0\) [2503.14895]. This suggests that low-frequency perceptual perturbations are not tied to a single transform, but to a family of decompositions in which coarse, global structure is isolated and manipulated.

The same logic extends beyond images. In time series classification, DCT coefficients with small index \(k\) represent slow variations and baseline shifts, while large \(k\) represent oscillatory, noise-like variations; SFAttack explicitly suppresses the lowest \(T/4\) cosine modes and retains only higher-frequency perturbation components [2503.19519]. In tactile and auditory studies, “low frequency” may refer not to a spatial spectrum but to a slow temporal envelope or to slowly varying temporal structure, as in amplitude-modulated facial vibration or temporal fine structure of low-frequency tones [2508.01155][1206.1864].

## 2. Perceptual constraints and human sensitivity

A defining feature of low-frequency perceptual perturbations is that perceptual relevance is frequency-dependent. FTUAP replaces a fixed spatial-domain \(\ell_\infty\) bound with DCT-domain JND thresholds,
\[
|\Delta X(k_1,k_2)| \le \hat{t}_{\mathrm{DCT}}(k_1,k_2),
\]
where \(\hat{t}_{\mathrm{DCT}}\) is derived from a luminance-based contrast sensitivity model and scaled by \(\lambda\), with \(\lambda=2\) in most experiments [2003.05549]. The reported threshold matrix includes entries such as \(\hat{t}_{\mathrm{DCT}}(0,0)=34.61\), \(\hat{t}_{\mathrm{DCT}}(0,1)=24.48\), and \(\hat{t}_{\mathrm{DCT}}(7,7)=68.78\), illustrating that higher-frequency coefficients often have larger JND thresholds than some low- and middle-frequency coefficients. Because human observers are very sensitive to smooth luminance changes, low-frequency coefficients receive tight bounds and are frequently clipped during optimization.

A related but more abstract formulation is the perceptual ball. The perturbation is constrained not only in pixel space but also in feature space,
\[
\sum_{l\in\mathcal{L}}\left\|C^{(l)}(x')-C^{(l)}(x)\right\|_2^2 \le \rho',
\]
with the full admissible set given by the intersection of a feature-space ball and a pixel \(\ell_2\) ball [1912.09405]. This discourages highly oscillatory perturbations that change intermediate features and instead favors structured, spatially coherent changes. The resulting perturbations are semi-sparse, object-focused, and smoother than standard \(\ell_p\)-bounded noise.

Perceptual similarity metrics based on deep features play a similar role in unrestricted attacks. Demiguise uses an LPIPS-style perceptual distance computed on VGG feature maps and reports perturbations that resemble illumination or contrast changes rather than pixel-level speckle [2107.01396]. In compression, FDPQ operationalizes the same principle from the opposite direction: it preserves the DC coefficient and the very low frequency AC coefficients, quantizes higher-frequency AC coefficients more coarsely, achieves bitrate reductions of up to 41%, and is reported as perceptually indistinguishable from raw video at the tested visually lossless operating points [1906.03395]. The common result is that low-frequency content is often the most perceptually salient part of the signal, so perturbations placed there must be controlled more carefully than equally sized perturbations in higher bands.

## 3. Adversarial recognition: effectiveness versus visibility

The central controversy in the adversarial literature is that low-frequency perturbations can be highly effective against models while also being more visible to humans. A systematic DCT-masking study showed that defended ImageNet models, including adversarially trained models and top NeurIPS 2017 competition defenses, remain highly vulnerable when low frequencies are preserved, and that under \(\ell_\infty\) \(\epsilon=16/255\), low-frequency perturbations are indeed perceptible [1903.00073]. The paper concludes that the purported robustness of state-of-the-art ImageNet defenses is reliant upon adversarial perturbations being high frequency in nature, and questions the use of \(\ell_\infty\) as a perceptual distortion metric.

FTUAP demonstrates the opposite side of the trade-off when perceptual constraints are made explicit. Under JND-bounded optimization, low-frequency-only perturbations produce noticeable color shifts and large-scale artifacts and achieve a fooling rate of 30.9%, whereas middle-frequency-only perturbations achieve 84.9%, high-frequency-only perturbations 71.6%, middle+high 91.7%, and full-frequency 93.6% [2003.05549]. In white-box evaluation, FTUAP-FF reaches 93.5% on VGG16, 93.6% on ResNet50, and 82.7% on Inception3, versus 84.8%, 84.2%, and 55.1% for UAP; on defended VGG16, top-1 accuracy drops from 66.3% with no attack to 62.5% under UAP and 51.1% under FTUAP-FF. The empirical interpretation given in the paper is that optimal low-frequency perturbations often lie beyond the JND threshold and are clipped, whereas middle- and high-frequency bands admit enough amplitude for effective attacks.

The contrast between these two results is important. Low-frequency perturbations are highly effective when the attack space is restricted only by a pixel norm, but under perceptual JND constraints their available energy collapses and the best imperceptibility–effectiveness trade-off shifts toward middle and high bands. A plausible implication is that “low-frequency attack” and “imperceptible attack” are not synonymous categories; they coincide only under particular perceptual models and budgets.

## 4. Transferability, stealth, and non-classification settings

Low-frequency perturbations have also been used in targeted transfer, unrestricted attacks, backdoors, generative disruption, and multimodal mitigation. LFAA begins from the observation that replacing the high-frequency component of an image with the high-frequency component of a target-class image already increases misclassification, and then trains a conditional generator whose output is added to the low-frequency component \(W*\mathbf{x}\) under an \(\ell_\infty\) budget \(\epsilon=16\) [2310.20175]. In the hybrid-image experiment with a fixed “bull mastiff” target, untargeted attack success rates are 21.4% on ResNet101, 40.1% on DenseNet121, 35.4% on VGG19-BN, 41.5% on MobileNet v2, and 32.5% on Inception v3; the corresponding targeted success rates are 6.1%, 0.3%, 1.6%, 0.4%, and 0.9%. Kernel size matters: very small \(k\) weakens low-pass filtering, very large \(k\) over-blurs, and \(k=4\) with a \(17\times17\) kernel yields the best average targeted success.

Demiguise uses perceptual similarity instead of a small RGB-space norm and produces unrestricted perturbations that are large in \(\ell_p\) norm but low-frequency, global, and semantically aligned, often resembling illumination and contrast changes [2107.01396]. The paper reports that Demiguise-DI-MI-FGSM reaches up to ~92% transfer-based fooling rate in black-box scenarios and that Demiguise-CW retains 3–5% higher fooling rates than CW-\(\ell_2\) under JPEG compression and binary filtering. This is presented as evidence that low-frequency, perceptually consistent perturbations survive smoothing and quantization better than high-frequency noise.

LFBA applies the same idea to backdoor triggers in a black-box setting. It perturbs only a small number of low-frequency DCT coefficients, constrains their magnitude by \(\epsilon\), and adds a spectral penalty to maintain dual-space stealthiness [2402.15653]. Across GTSRB, CIFAR-10, Tiny-ImageNet, and CelebA, the paper reports PSNR \(>43\)–\(46\) dB, SSIM \(\approx 0.994\)–\(0.997\), and LPIPS \(\approx 0.0001\)–\(0.0003\). Under Gaussian filtering, Wiener filtering, BM3D, and JPEG compression, LFBA-Low maintains average ASR \(\approx 94.06\%\), whereas LFBA-Full loses robustness, indicating that low-frequency restriction is the key factor.

The same structural principle has been redirected from attack to defense. A face-swapping defense perturbs the low-frequency wavelet approximation of the target face, reconstructs the image with preserved high-frequency details, and optimizes
\[
L_{\mathrm{total}}=\lambda_1L_{\mathrm{rec}}+\lambda_2L_{\mathrm{adv}}+\lambda_3L_{\mathrm{swap}},
\]
with \(\lambda_1=5.0\), \(\lambda_2=0.05\), and \(\lambda_3=1.0\), so that the protected image remains visually plausible while the generated swap is degraded [2508.20595]. In multimodal language models, MFP decomposes images into low- and high-frequency components, perturbs visual tokens with both, and randomly attenuates these components at inference; on LLaVA-1.5-7B it reduces CHAIR\(_s\) from 50.2 to 41.2 and CHAIR\(_i\) from 15.0 to 11.7 while improving POPE F1 from 85.9 to 86.2 and MMBench from 63.0 to 68.2 [2503.14895]. Low-frequency perturbations therefore appear not only as a threat model, but also as a mechanism for active defense and inference-time regularization.

## 5. Cross-modal psychophysics

Outside machine vision, low-frequency perceptual perturbations are directly studied as sensory stimuli. In facial vibrotactile perception, amplitude modulation of a \(210\) Hz carrier produces a low-frequency envelope with stimulus frequencies \(2,4,8,16,\) and \(32\) Hz; because Pacinian corpuscles are absent on the face, the carrier is poorly perceived and the envelope is experienced as “pure low-frequency vibration” [2508.01155]. Experiment 1 shows that matching on the forehead is easier than on the forearm; Experiment 2 reports higher smoothness, distinctness, and clarity on the forehead; Experiment 3 finds that the original low-frequency vibration is clearly perceptible around the eyes, cheeks, and lower lip area. Here the perturbation is physically high-frequency at the actuator but perceptually low-frequency after sensory transduction.

A complementary result appears in noisy-vibration perception. After intensity equalization, perceived intensity of stationary texture vibrations is well predicted by power in the 80–200 Hz band with \(R^2=0.90\), whereas full-band power gives \(R^2=0.07\) [2311.10644]. Dissimilarity between equalized signals is then predicted almost entirely by the first PCA component of a perceptually motivated spectral representation, which encodes the balance between low and high frequencies. In a MUSHRA experiment, synthesized vibrations preserving only this component are equivalent, within the tested margin, to those preserving the full eight-component spectral representation. The relevant perceptual variable is therefore not absolute low-frequency energy but the low/high frequency balance.

Cross-modal interaction also makes low-frequency perturbations visible in vision. With a CRT flickering at about \(75\) Hz, a mechanically transmitted low-amplitude vibration below \(100\) Hz causes the displayed image to oscillate and appear to float out of the screen while the rest of the room remains stable [1211.6238]. Illusion strength peaks when the vibration frequency approaches the flicker frequency and decreases on either side; the authors model the effect with an emergent perceptual pulsation \(\Omega=(\omega-\omega_o)e^{-(\omega-\omega_o)^2/\delta^2}\) and estimate \(\delta\approx 10\) Hz. The perturbation is low-amplitude and mechanically applied, but its perceptual consequence is a selective visual instability.

Auditory psychophysics shows a related low-frequency dependence in temporal coding. When tones are constructed from wavelets whose phase changes randomly every few cycles, frequency discrimination worsens below a few kilohertz, where phase-locking preserves temporal fine structure, but no such effect appears at higher carrier frequencies where temporal information is unavailable in the central auditory system [1206.1864]. In this case, the perturbation is not a spatial low-frequency bias but a disruption of temporal fine structure that matters specifically for low-frequency tones.

## 6. Conceptual tensions and open problems

The literature does not support a single monotonic relation between low frequency and imperceptibility. In images and time series, low-frequency perturbations are often more visible because they alter global structure. SFAttack argues explicitly that low-frequency components in time series appear as noticeable vertical shifts or plateau changes, suppresses them with a DCT high-pass constraint, and reports about 17.4% reduction in average \(L_2\) distance compared with baselines while maintaining similar or better ASR [2503.19519]. In video coding, by contrast, the same perceptual salience of low frequencies means they must be preserved rather than attacked, leading FDPQ to protect DC and very low AC coefficients [1906.03395].

The main unresolved issue is therefore not whether low-frequency perturbations are “stronger” or “weaker,” but under which perceptual model they are admissible. Under an \(\ell_\infty\) budget they can be highly effective against defended classifiers and yet be visibly unacceptable [1903.00073]. Under DCT-domain JND constraints they may be too tightly bounded to dominate the attack, shifting the optimum toward middle and high frequencies [2003.05549]. In tactile perception, low-frequency content may be the envelope recovered from an unperceived high-frequency carrier [2508.01155]; in noisy vibrations, the decisive variable is the balance between low and high bands rather than low-frequency energy alone [2311.10644]. This suggests that low-frequency perceptual perturbations should be treated as a domain-dependent concept defined jointly by signal decomposition, sensory or feature-space constraints, and task-specific function.

For adversarial ML, the broader implication is that perceptual evaluation cannot be reduced to a single pixel norm. The strongest evidence comes from the repeated mismatch between \(\ell_p\) budgets and human judgments, from JND-constrained attacks that suppress low-frequency energy, from perceptual-ball and LPIPS-style formulations that favor structured perturbations, and from cross-modal studies showing that low-frequency content can dominate sensation even when it is not represented as the physically dominant carrier. Low-frequency perceptual perturbations are therefore best understood as perturbations that occupy the coarse, semantically loaded, and often perceptually sensitive part of a signal’s representation—sometimes to exploit that sensitivity, and sometimes to avoid it.

Source: https://www.emergentmind.com/topics/low-frequency-perceptual-perturbations