ML Security PapersLearning Fourier shapes to probe the geometric world of deep neural networks
Jian Wang , Yixing Yong , Haixia Bi , Lijun He , Fan Li
Published on arXiv
2511.04970
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
Optimized geometric shapes (defined purely by their contour, without texture) can generate high-confidence misclassifications in DNNs and deceive downstream visual tasks, establishing a geometry-based adversarial paradigm distinct from pixel-level perturbation methods.
Fourier Shape Adversarial Framework
Novel technique introduced
While both shape and texture are fundamental to visual recognition, research on deep neural networks (DNNs) has predominantly focused on the latter, leaving their geometric understanding poorly probed. Here, we show: first, that optimized shapes can act as potent semantic carriers, generating high-confidence classifications from inputs defined purely by their geometry; second, that they are high-fidelity interpretability tools that precisely isolate a model's salient regions; and third, that they constitute a new, generalizable adversarial paradigm capable of deceiving downstream visual tasks. This is achieved through an end-to-end differentiable framework that unifies a powerful Fourier series to parameterize arbitrary shapes, a winding number-based mapping to translate them into the pixel grid required by DNNs, and signal energy constraints that enhance optimization efficiency while ensuring physically plausible shapes. Our work provides a versatile framework for probing the geometric world of DNNs and opens new frontiers for challenging and understanding machine perception.
Key Contributions
- End-to-end differentiable framework using Fourier series to parameterize arbitrary closed shapes as adversarial inputs to DNNs
- Winding number-based differentiable mapping that translates Fourier shape coefficients into pixel-grid images compatible with standard vision models
- Signal energy regularization that constrains high-frequency components to produce physically plausible adversarial shapes while improving optimization efficiency
🛡️ Threat Analysis
The paper's primary security contribution is a novel adversarial input paradigm — optimized closed contour shapes parameterized via Fourier series — that causes high-confidence misclassification in DNNs at inference time. The framework is end-to-end differentiable (gradient-based) and explicitly described as 'a new, generalizable adversarial paradigm capable of deceiving downstream visual tasks,' squarely within input manipulation attacks.