May I ask how the high-frequency disturbance in Figure 2 of the paper is realized? Random select an image and replace all the high-frequency information of the original image with the high-frequency information of the random image? Is this high-frequency perturbation the image of all the verification sets? Or partial verification set? Or should we also perturb the training set?
May I ask how the high-frequency disturbance in Figure 2 of the paper is realized? Random select an image and replace all the high-frequency information of the original image with the high-frequency information of the random image? Is this high-frequency perturbation the image of all the verification sets? Or partial verification set? Or should we also perturb the training set?