High-Frequency Edge Sharpening Is All You Need: FPR Beats Transferable Adversarial Attacks With a Single Convolution

Main Story

Deep neural networks (DNNs) underpin nearly every perception pipeline in modern autonomous systems — from object detection on commercial drones to target recognition in fixed-wing UAV payloads. Their pattern-recognition power is well established, but so is a structural fragility: carefully engineered, imperceptible perturbations to an input image can force a confident misclassification. Among the most operationally concerning variants of this problem is the transferable attack (TA) — a perturbation crafted against one "surrogate" model that then succeeds, without modification, against a completely different "victim" model the attacker has never seen.

Transferable attacks are dangerous precisely because they sidestep the need for direct access to the deployed system. An adversary can probe any accessible DNN, craft a perturbation exploiting structural weaknesses that are common across architectures, and then apply that perturbation at scale. Researchers studying UAV vision systems have confirmed this threat is not theoretical: adversarial patches transferred across DNN architectures have achieved attack success rates as high as 75–78% against aerial target detectors in experimental settings.

The conventional responses fall into two camps. Training-time defenses — adversarial training, robust architecture design, robustness-oriented regularisation — harden the model itself but typically impose a meaningful accuracy penalty on clean inputs. Post-attack (inference-time) defenses — input purification, adversarial detection, output correction — add overhead at every inference step and have shown limited effectiveness against the strongest transfer-based attacks. Both camps share a fundamental constraint: they respond to attacks after the threat landscape has already been defined.

A third, orthogonal paradigm — preemptive robustification (PR) — operates before any attack occurs. Rather than altering the model or the inference pipeline, PR subtly modifies benign input samples so they occupy regions of the input space that are inherently more resistant to adversarial displacement. Prior PR work, however, has required either well-trained task-specific surrogate classifiers (which may be unavailable in deployed settings), expensive iterative optimisation, or dedicated generator training — all of which limit practical deployment, particularly on compute-constrained embedded systems aboard UAVs.

A new preprint by Jiaming Liang and Chi-Man Pun, filed to arXiv as cs.CV paper 2603.25244, proposes a strikingly minimalist answer: Fast Preemptive Robustification (FPR). The core insight is a discovered numerical correlation — a significantly negative cosine similarity — between the shared vulnerability subspace exploited by transferable attacks and the high-frequency Laplacian response of images. In plain terms: the directions in pixel space that DNNs share as weaknesses are systematically anti-aligned with strong image edges and high-frequency texture detail. Amplifying those high-frequency components therefore crowds out the shared vulnerability directions, making the image harder to perturb along the axes that transfer across architectures.

FPR operationalises this insight with maximum economy: a single channel-wise convolution using a 3×3 Laplacian kernel. The operation, known as Laplacian sharpening, enhances edge contrast and fine texture without altering the semantic content of an image in any way perceptible to a human observer. There is no surrogate model, no gradient computation, no iterative loop, no learned parameters — just one deterministic linear filter applied once per image before the image enters any potentially adversarial channel.

The experimental record reported in the paper is notable for its breadth. FPR was evaluated across 18 DNN architectures — spanning convolutional networks (ResNet variants, VGG, DenseNet, EfficientNet, MobileNet) and vision transformers (ViT, CaiT, PiT, Visformer, Swin, DeiT, CoaT) — using the NIPS'17 Adversarial Competition benchmark. Against untargeted transferable attacks, FPR reduced the mean attack success rate by 12.7 percentage points. Against targeted transferable attacks — a considerably harder problem — it reduced ASR from 10.7% down to 4.1%. Laplacian sharpening proved particularly effective in the transfer-based (black-box) threat setting that dominates real-world adversarial scenarios, and complementary gains were also demonstrated in white-box scenarios. The method was shown to be composable with adversarially trained models, suggesting it can stack with, rather than replace, existing hardening approaches.

Because FPR requires no model-specific knowledge and introduces only a single fixed convolution into the pre-processing pipeline, it is architecture-agnostic and embeddable in any image ingestion path — including on-device preprocessing on an embedded vision processor or a ground-control-station image buffer. Code will be released publicly.

Technical Breakdown

The theoretical grounding rests on the negative cosine similarity between the shared DNN vulnerability subspace and Laplacian responses — i.e., high-frequency spatial components. Prior empirical work noted that adversarial perturbations tend to concentrate in mid-to-high frequency bands, and a prior optimisation-based PR method separately observed that robustified samples tend to exhibit enhanced texture and contrast. FPR provides a direct, closed-form realisation of that empirical observation.

Industry Impact

For UAV and autonomous-systems integrators: FPR's compute footprint is minimal enough to be deployed as a preprocessing stage on embedded vision systems — ISPs, edge AI accelerators, or ground-station image buffers — without modifying the underlying perception DNN. Systems operating in environments where sensor feeds pass through untrusted or shared communications links (the man-in-the-middle threat model explicitly studied in prior PR literature) stand to benefit most directly.

For perception software developers: The surrogate-free, training-free property is significant. Most prior adversarial defenses require knowledge of the model architecture or sustained retraining cycles. FPR can in principle be bolted onto any existing frozen model as a preprocessing step, dramatically lowering the integration cost for operators who cannot retrain their deployed networks.

For airborne remote-sensing platforms: Adversarial robustness in aerial imagery pipelines — object detection, SAR target recognition, change detection — has been an active concern. The demonstrated architecture-agnostic performance across both CNN and vision-transformer backbones means FPR applies equally to legacy convolutional detection stacks and newer transformer-based aerial perception systems.

For standards bodies and certification authorities: FPR's human interpretability is an underappreciated regulatory asset. Regulators assessing AI-based airborne systems increasingly require that processing transformations applied to sensor data be auditable and explainable. A fixed, deterministic linear filter has a closed-form mathematical description and introduces no learned parameters — a substantially simpler certification argument than stochastic or model-dependent defenses.

For the research community: FPR opens a productive direction for frequency-domain analysis of DNN vulnerability geometry. The cosine-similarity correlation between Laplacian responses and shared vulnerability directions suggests that further exploration of the spectral structure of adversarial transfer — and corresponding spectral defenses — could yield additional efficiency gains beyond what a single 3×3 kernel achieves.