Exploring the space of adversarial images

Adversarial examples have raised questions regarding the robustness and security of deep neural networks. In this work we formalize the problem of adversarial images given a pretrained classifier, showing that even in the linear case the resulting optimization problem is nonconvex. We generate adversarial images using shallow and deep classifiers on the MNIST and ImageNet datasets. We probe the pixel space of adversarial images using noise of varying intensity and distribution. We bring novel visualizations that showcase the phenomenon and its high variability. We show that adversarial images appear in large regions in the pixel space, but that, for the same task, a shallow classifier seems more robust to adversarial images than a deep convolutional network.

• Publication year

  2015

• Venue

  IEEE International Joint Conference on Neural Network

• Publication date

  2015-10-19

• Fields of study

  Mathematics, Computer Science

• Identifiers
  DOI 10.1109/IJCNN.2016.7727230arXiv 1510.05328
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Numerical Optimization

  2018cited by this paper
• Learning With Adversary

  2015cited by this paper
• Analysis of classifiers’ robustness to adversarial perturbations

  2015cited by this paper
• Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks

  2015cited by this paper
• Adversarial Manipulation of Deep Representations

  2015cited by this paper
• Improving Back-Propagation by Adding an Adversarial Gradient

  2015cited by this paper
• Learning with a Strong Adversary

  2015cited by this paper
• Towards Deep Neural Network Architectures Robust to Adversarial Examples

  2014cited by this paper
• Explaining and Harnessing Adversarial Examples

  2014cited by this paper
• Deep neural networks are easily fooled: High confidence predictions for unrecognizable images

  2014cited by this paper
• Intriguing properties of neural networks

  2013cited by this paper
• OverFeat: Integrated Recognition, Localization and Detection using Convolutional Networks

  2013cited by this paper
• ImageNet classification with deep convolutional neural networks

  2012cited by this paper
• Numerical Methods with Applications

  2011cited by this paper
• Torch7: A Matlab-like Environment for Machine Learning

  2011cited by this paper
• ImageNet: A large-scale hierarchical image database

  2009cited by this paper
• Learning Deep Architectures for AI

  2007cited by this paper
• The mnist database of handwritten digits

  2005cited by this paper
• Algorithm 778: L-BFGS-B: Fortran subroutines for large-scale bound-constrained optimization

  1997cited by this paper

• Towards Robust Universal Perturbation Attacks: A Float-Coded, Penalty-Driven Evolutionary Approach

  2026cites this paper
• The Built-In Robustness of Decentralized Federated Averaging to Bad Data

  2025cites this paper
• Adaptive patch transformation for adversarial defense

  2025cites this paper
• Typographic Attacks in a Multi-Image Setting

  2025cites this paper
• Advancing Trustworthy AI: A Comparative Evaluation of AI Robustness Toolboxes

  2025cites this paper
• Assessing Evasion Attacks on Tree-Based Machine Learning Models: Supervised vs. Unsupervised Approaches

  2025cites this paper
• Testing the Limit of Atmospheric Predictability with a Machine Learning Weather Model

  2025cites this paper
• Exploiting Adversarial Learning and Topology Augmentation for Open-Set Visual Recognition

  2025cites this paper
• Low-rank matrix recovery with total generalized variation for defending adversarial examples

  2024cites this paper
• Explainable and Transferable Adversarial Attack for ML-Based Network Intrusion Detectors

  2024cites this paper
• Are Objective Explanatory Evaluation metrics Trustworthy? An Adversarial Analysis

  2024cites this paper
• Enhancing trustworthy deep learning for image classification against evasion attacks: a systematic literature review

  2024influential citation
• Targeted Deep Learning System Boundary Testing

  2024cites this paper
• A Theoretically Grounded Extension of Universal Attacks from the Attacker's Viewpoint

  2024cites this paper
• Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey

  2024cites this paper
• The Effect of Adversarial Machine Learning Attack on Agriculture Field and Food Security

  2024cites this paper
• Dynamic Gradient Influencing for Viral Marketing Using Graph Neural Networks

  2024cites this paper
• Adversarial training via multi-guidance and historical memory enhancement

  2024cites this paper
• Evaluation of the Explanatory Power Of Layer-wise Relevance Propagation using Adversarial Examples

  2023cites this paper
• Learning video embedding space with Natural Language Supervision

  2023cites this paper
• SoK: Realistic Adversarial Attacks and Defenses for Intelligent Network Intrusion Detection

  2023cites this paper
• Comparing Detection Schemes for Adversarial Images against Deep Learning Models for Cancer Imaging

  2023cites this paper
• Building Trusted Federated Learning: Key Technologies and Challenges

  2023cites this paper
• Identifying Adversarially Attackable and Robust Samples

  2023cites this paper
• F<inline-formula><tex-math notation="LaTeX">$^{2}$</tex-math><alternatives><mml:math><mml:msup><mml:mrow/><mml:mn>2</mml:mn></mml:msup></mml:math><inline-graphic xlink:href="qian-ieq1-3580116.gif"/></alternatives></inline-formula>AT: Feature-Focusing Adversarial Training via Disentanglement of Natur

  2023cites this paper
• Machine learning and blockchain technologies for cybersecurity in connected vehicles

  2023cites this paper
• Splitting the Difference on Adversarial Training

  2023cites this paper
• Adversarial Defense Method Based on Latent Representation Guidance for Remote Sensing Image Scene Classification

  2023cites this paper
• On the Relationship Between Interpretability and Explainability in Machine Learning

  2023cites this paper
• A Novel Adversarial Detection Method for UAV Vision Systems via Attribution Maps

  2023cites this paper
• On-Manifold Projected Gradient Descent

  2023cites this paper
• Decision Boundary-Aware Data Augmentation for Adversarial Training

  2023cites this paper
• From Pixel to Peril: Investigating Adversarial Attacks on Aerial Imagery Through Comprehensive Review and Prospective Trajectories

  2023cites this paper
• Attack Some while Protecting Others: Selective Attack Strategies for Attacking and Protecting Multiple Concepts

  2023cites this paper
• DeepPatch: Maintaining Deep Learning Model Programs to Retain Standard Accuracy with Substantial Robustness Improvement

  2023cites this paper
• One Pixel Adversarial Attacks via Sketched Programs

  2023cites this paper
• Maintaining Deep Learning Model Programs to Retain Standard Accuracy with Substantial Robustness Improvement

  2023cites this paper
• An Adversarial Attack Method against Specified Objects Based on Instance Segmentation

  2022cites this paper
• Global Translation of Classification Models

  2022cites this paper
• ABCAttack: A Gradient-Free Optimization Black-Box Attack for Fooling Deep Image Classifiers

  2022cites this paper
• Evaluation of neural networks defenses and attacks using NDCG and reciprocal rank metrics

  2022cites this paper
• Robustness of classifiers to uniform ℓ _ p and Gaussian noise

  2022cites this paper
• VeNuS: Neural Network Robustness Specifications via Verifier-guided Optimization

  2022cites this paper
• Block-term Dropout For Robust Adversarial Defense

  2022cites this paper
• Adversarial Attacks on Deep Learning-Based Methods for Network Traffic Classification

  2022cites this paper
• GRIP-GAN: An Attack-Free Defense Through General Robust Inverse Perturbation

  2022cites this paper
• Using Adversarial Images to Assess the Robustness of Deep Learning Models Trained on Diagnostic Images in Oncology

  2022cites this paper
• Detection and Correction of Adversarial Examples Based on IPEG-Compression-Derived Distortion

  2022cites this paper
• Efficiently Finding Adversarial Examples with DNN Preprocessing

  2022cites this paper
• Task-Guided Denoising Network for Adversarial Defense of Remote Sensing Scene Classification

  2022cites this paper
• Guidance Through Surrogate: Toward a Generic Diagnostic Attack

  2022cites this paper
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: Survey II

  2021cites this paper
• Towards Explaining Adversarial Examples Phenomenon in Artificial Neural Networks

  2021cites this paper
• Dual-Domain-Based Adversarial Defense With Conditional VAE and Bayesian Network

  2021cites this paper
• Adversarial Attack Vulnerability of Deep Learning Models for Oncologic Images

  2021cites this paper
• Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspective

  2021cites this paper
• Understanding Robustness in Teacher-Student Setting: A New Perspective

  2021cites this paper
• Enhancing Transformation-based Defenses against Adversarial Examples with First-Order Perturbations

  2021cites this paper
• Domain Invariant Adversarial Learning

  2021cites this paper
• Defense Mechanism Against Adversarial Attacks Using Density-based Representation of Images

  2021cites this paper
• Robustness Analysis for VGG-16 Model in Image Classification of Post-Hurricane Buildings

  2021cites this paper
• NeuronFair: Interpretable White-Box Fairness Testing through Biased Neuron Identification

  2021cites this paper
• Data-free Universal Adversarial Perturbation and Black-box Attack

  2021cites this paper
• Multi-concept adversarial attacks

  2021cites this paper
• Securing IoT Devices: A Robust and Efficient Deep Learning with a Mixed Batch Adversarial Generation Process for CAPTCHA Security Verification

  2021cites this paper
• Utilizing Adversarial Targeted Attacks to Boost Adversarial Robustness

  2021cites this paper
• Advances in adversarial attacks and defenses in computer vision: A survey

  2021influential citation
• Attacks and defenses in user authentication systems: A survey

  2021cites this paper
• Backpropagating Smoothly Improves Transferability of Adversarial Examples

  2021cites this paper
• Analyzing Adversarial Robustness of Deep Neural Networks in Pixel Space: a Semantic Perspective

  2021cites this paper
• Visualizing Representations of Adversarially Perturbed Inputs

  2021cites this paper
• Improving Transformation-based Defenses against Adversarial Examples with First-order Perturbations

  2021cites this paper
• Learn2Perturb: An End-to-End Feature Perturbation Learning to Improve Adversarial Robustness

  2020cites this paper
• Towards Robustness of Convolutional Neural Network against Adversarial Examples

  2020cites this paper
• Robustness to adversarial examples can be improved with overfitting

  2020cites this paper
• Can the state of relevant neurons in a deep neural networks serve as indicators for detecting adversarial attacks?

  2020cites this paper
• Heat and Blur: An Effective and Fast Defense Against Adversarial Examples

  2020cites this paper
• Bag of Tricks for Adversarial Training

  2020cites this paper
• Security and Privacy Issues in Deep Learning: A Brief Review

  2020cites this paper
• PEACEPACT: Prioritizing Examples to Accelerate Perturbation-Based Adversary Generation for DNN Classification Testing

  2020cites this paper
• Principal Component Adversarial Example

  2020cites this paper
• Adversarial Machine Learning in Image Classification: A Survey Toward the Defender’s Perspective

  2020cites this paper
• Cognitive Relevance Transform for Population Re-Targeting

  2020cites this paper
• Adversarial Examples on Object Recognition

  2020influential citation
• Improving Security of Neural Networks in the Identification Module of Decision Support Systems

  2020cites this paper
• A System-Driven Taxonomy of Attacks and Defenses in Adversarial Machine Learning

  2020cites this paper
• Understanding Adversarial Examples From the Mutual Influence of Images and Perturbations

  2020cites this paper
• THE PURDUE UNIVERSITY GRADUATE SCHOOL STATEMENT OF THESIS APPROVAL

  2020cites this paper
• Analysis of Random Perturbations for Robust Convolutional Neural Networks

  2020cites this paper
• An Empirical Evaluation of Perturbation-based Defenses

  2020cites this paper
• Explainable Deep Learning: A Field Guide for the Uninitiated

  2020cites this paper
• Enhancing Resilience of Deep Learning Networks By Means of Transferable Adversaries

  2020cites this paper
• T OWARDS COUNTERACTING ADVERSARIAL PERTUR - BATIONS TO RESIST ADVERSARIAL EXAMPLES

  2020cites this paper
• Heat and Blur: An Effective and Fast Defense Against Adversarial Examples

  2020cites this paper
• Detection of Adversarial Examples Based on Sensitivities to Noise Removal Filter

  2020cites this paper
• Universal Adversarial Perturbations are Not Bugs, They are Features

  2020cites this paper
• Universal adversarial attacks on deep neural networks for medical image classification

  2020cites this paper
• On the Robustness to Adversarial Examples of Neural ODE Image Classifiers

  2019cites this paper
• An abstract domain for certifying neural networks

  2019cites this paper
• Generating Adversarial Perturbation with Root Mean Square Gradient

  2019cites this paper