# Exploring the Space of Adversarial Images

arXiv: https://arxiv.org/abs/1510.05328 · HTML: https://mlsanity.com/paper/1510.05328/

## Key facts

- Cited by 28 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 19 Oct 2015.

## Built on by (most cited first, 28 of 28)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [NeuronFair: Interpretable White-Box Fairness Testing through Biased Neuron Identification](https://mlsanity.com/paper/2112.13214/) (2021)
- [Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey](https://mlsanity.com/paper/2410.23687/) (2024)
- [Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspective](https://mlsanity.com/paper/2102.06479/) (2021)
- [SoK: Realistic Adversarial Attacks and Defenses for Intelligent Network Intrusion Detection](https://mlsanity.com/paper/2308.06819/) (2023)
- [Domain Invariant Adversarial Learning](https://mlsanity.com/paper/2104.00322/) (2021)
- [Identifying Adversarially Attackable and Robust Samples](https://mlsanity.com/paper/2301.12896/) (2023)
- [Splitting the Difference on Adversarial Training](https://mlsanity.com/paper/2310.02480/) (2023)
- [Atmospheric Predictability Beyond 30 Days with Machine Learning](https://mlsanity.com/paper/2504.20238/) (2025)
- [On the Relationship Between Interpretability and Explainability in Machine Learning](https://mlsanity.com/paper/2311.11491/) (2023)
- [Targeted Deep Learning System Boundary Testing](https://mlsanity.com/paper/2408.06258/) (2024)
- [Utilizing Adversarial Targeted Attacks to Boost Adversarial Robustness](https://mlsanity.com/paper/2109.01945/) (2021)
- [Evaluation of Neural Networks Defenses and Attacks using NDCG and Reciprocal Rank Metrics](https://mlsanity.com/paper/2201.05071/) (2022)
- [Are Objective Explanatory Evaluation metrics Trustworthy? An Adversarial Analysis](https://mlsanity.com/paper/2406.07820/) (2024)
- [Understanding Robustness in Teacher-Student Setting: A New Perspective](https://mlsanity.com/paper/2102.13170/) (2021)
- [Towards Explaining Adversarial Examples Phenomenon in Artificial Neural Networks](https://mlsanity.com/paper/2107.10599/) (2021)
- [Guidance Through Surrogate: Towards a Generic Diagnostic Attack](https://mlsanity.com/paper/2212.14875/) (2022)
- [Learning video embedding space with Natural Language Supervision](https://mlsanity.com/paper/2303.14584/) (2023)
- [Improving Transformation-based Defenses against Adversarial Examples with First-order Perturbations](https://mlsanity.com/paper/2103.04565/) (2021)
- [Visualizing Representations of Adversarially Perturbed Inputs](https://mlsanity.com/paper/2105.14116/) (2021)
- [Analyzing Adversarial Robustness of Deep Neural Networks in Pixel Space: a Semantic Perspective](https://mlsanity.com/paper/2106.09872/) (2021)
- [Multi-concept adversarial attacks](https://mlsanity.com/paper/2110.10287/) (2021)
- [Efficiently Finding Adversarial Examples with DNN Preprocessing](https://mlsanity.com/paper/2211.08706/) (2022)
- [On-Manifold Projected Gradient Descent](https://mlsanity.com/paper/2308.12279/) (2023)
- [F2AT: Feature-Focusing Adversarial Training via Disentanglement of Natural and Perturbed Patterns](https://mlsanity.com/paper/2310.14561/) (2023)
- [Dynamic Gradient Influencing for Viral Marketing Using Graph Neural Networks](https://mlsanity.com/paper/2403.12399/) (2024)
- [The Built-In Robustness of Decentralized Federated Averaging to Bad Data](https://mlsanity.com/paper/2502.18097/) (2025)
- [Towards Robust Universal Perturbation Attacks: A Float-Coded, Penalty-Driven Evolutionary Approach](https://mlsanity.com/paper/2601.12624/) (2026)

## Abstract (arXiv)

Adversarial examples have raised questions regarding the robustness and security of deep neural networks. In this work we formalize the problem of adversarial images given a pretrained classifier, showing that even in the linear case the resulting optimization problem is nonconvex. We generate adversarial images using shallow and deep classifiers on the MNIST and ImageNet datasets. We probe the pixel space of adversarial images using noise of varying intensity and distribution. We bring novel visualizations that showcase the phenomenon and its high variability. We show that adversarial images appear in large regions in the pixel space, but that, for the same task, a shallow classifier seems more robust to adversarial images than a deep convolutional network.