Data to 7 Oct 2026

DeepFool: a simple and accurate method to fool deep neural networks

arXiv 1511.04599 ↗First posted 14 Nov 2015cs.LG cs.CVcited by 1,315

Not on the map. Why?

Cited by 29 in Multimodal LLMs / vision-language models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

State-of-the-art deep neural networks have achieved impressive results on many image classification tasks. However, these same architectures have been shown to be unstable to small, well sought, perturbations of the images. Despite the importance of this phenomenon, no effective methods have been proposed to accurately compute the robustness of state-of-the-art deep classifiers to such perturbations on large-scale datasets. In this paper, we fill this gap and propose the DeepFool algorithm to efficiently compute perturbations that fool deep networks, and thus reliably quantify the robustness of these classifiers. Extensive experimental results show that our approach outperforms recent methods in the task of computing adversarial perturbations and making classifiers more robust.

Key facts. Cited by 1,315 papers in the map (data through 7 Oct 2026). First posted on arXiv 14 Nov 2015.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 381; 2022: 280; 2023: 256; 2024: 183; 2025: 146; 2026: 69.

1,315 papers.

Sort:

By area:

2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Modelscited by 260
2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
2021Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Modelscited by 227
2021Vision Transformers are Robust Learnerscited by 208
2021Trustworthy AI: From Principles to Practicescited by 206
2023Data-centric Artificial Intelligence: A Surveycited by 202
2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 193
2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
2021Anti-Adversarially Manipulated Attributions for Weakly and Semi-Supervised Semantic Segmentationcited by 134
2022Frequency Domain Model Augmentation for Adversarial Attackcited by 128
2023Open Sesame! Universal Black Box Jailbreaking of Large Language Modelscited by 128
2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127

38 more

2022Understanding Zero-Shot Adversarial Robustness for Large-Scale Modelscited by 117
2023Anti-DreamBooth: Protecting users from personalized text-to-image synthesiscited by 114
2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
2023Self-Supervised Learning for Time Series Analysis: Taxonomy, Progress, and Prospectscited by 97
2022Adversarial Texture for Fooling Person Detectors in the Physical Worldcited by 96
2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 94
2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 93
2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 92
2021Domain Impression: A Source Data Free Domain Adaptation Methodcited by 91
2021Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attackscited by 91
2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
2022SegPGD: An Effective and Efficient Adversarial Attack for Evaluating and Boosting Segmentation Robustnesscited by 74
2021Practical Blind Membership Inference Attack via Differential Comparisonscited by 73
2024Jailbreaking Prompt Attack: A Controllable Adversarial Attack against Diffusion Modelscited by 68
2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
2021Are we ready for a new paradigm shift? A Survey on Visual Deep MLPcited by 63
2022Active Learning by Feature Mixingcited by 63
2021HIRE-SNN: Harnessing the Inherent Robustness of Energy-Efficient Deep Spiking Neural Networks by Training with Crafted Input Noisecited by 61
2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
2021A Survey On Universal Adversarial Attackcited by 59
2021Reverse Engineering of Generative Models: Inferring Model Hyperparameters from Generated Imagescited by 58
2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 58
2023X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detectioncited by 58
2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
2021Certified Robustness to Text Adversarial Attacks by Randomized [MASK]cited by 57
2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57
2021Person Re-identification Method Based on Color Attack and Joint Defencecited by 56
2021On the Adversarial Robustness of Causal Algorithmic Recoursecited by 56
2021Meta Gradient Adversarial Attackcited by 55
2021AdvDrop: Adversarial Attack to DNNs by Dropping Informationcited by 55
2021Can stable and accurate neural networks be computed? -- On the barriers of deep learning and Smale's 18th problemcited by 53
2021Boosting Adversarial Transferability through Enhanced Momentumcited by 53
2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
2022Robust Semantic Communications with Masked VQ-VAE Enabled Codebookcited by 53
2023StyleAdv: Meta Style Adversarial Training for Cross-Domain Few-Shot Learningcited by 53
2021Exploring Counterfactual Explanations Through the Lens of Adversarial Examples: A Theoretical and Empirical Analysiscited by 52

50 most cited of 1,315 All 1,315 (JSON)