# Provably Minimally-Distorted Adversarial Examples

arXiv: https://arxiv.org/abs/1709.10207 · HTML: https://mlsanity.com/paper/1709.10207/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Sep 2017.

## Built on by (most cited first, 12 of 12)

- [Person Re-identification Method Based on Color Attack and Joint Defence](https://mlsanity.com/paper/2111.09571/) (2021)
- [MMG-Ego4D: Multi-Modal Generalization in Egocentric Action Recognition](https://mlsanity.com/paper/2305.07214/) (2023)
- [Clip-and-Verify: Linear Constraint-Driven Domain Clipping for Accelerating Neural Network Verification](https://mlsanity.com/paper/2512.11087/) (2025)
- [Fast Certification of Vision-Language Models Using Incremental Randomized Smoothing](https://mlsanity.com/paper/2311.09024/) (2023)
- [Detect and Defense Against Adversarial Examples in Deep Learning using Natural Scene Statistics and Adaptive Denoising](https://mlsanity.com/paper/2107.05780/) (2021)
- [Evaluation of Neural Networks Defenses and Attacks using NDCG and Reciprocal Rank Metrics](https://mlsanity.com/paper/2201.05071/) (2022)
- [VQUNet: Vector Quantization U-Net for Defending Adversarial Atacks by Regularizing Unwanted Noise](https://mlsanity.com/paper/2406.03117/) (2024)
- [Adaptive Clustering of Robust Semantic Representations for Adversarial Image Purification](https://mlsanity.com/paper/2104.02155/) (2021)
- [Smooth-Reduce: Leveraging Patches for Improved Certified Robustness](https://mlsanity.com/paper/2205.06154/) (2022)
- [RADA: Robust Adversarial Data Augmentation for Camera Localization in Challenging Weather](https://mlsanity.com/paper/2112.02469/) (2021)
- [Towards Improving Robustness Against Common Corruptions in Object Detectors Using Adversarial Contrastive Learning](https://mlsanity.com/paper/2311.07928/) (2023)
- [Towards Improving Robustness Against Common Corruptions using Mixture of Class Specific Experts](https://mlsanity.com/paper/2311.10177/) (2023)

## Abstract (arXiv)

The ability to deploy neural networks in real-world, safety-critical systems is severely limited by the presence of adversarial examples: slightly perturbed inputs that are misclassified by the network. In recent years, several techniques have been proposed for increasing robustness to adversarial examples --- and yet most of these have been quickly shown to be vulnerable to future attacks. For example, over half of the defenses proposed by papers accepted at ICLR 2018 have already been broken. We propose to address this difficulty through formal verification techniques. We show how to construct provably minimally distorted adversarial examples: given an arbitrary neural network and input sample, we can construct adversarial examples which we prove are of minimal distortion. Using this approach, we demonstrate that one of the recent ICLR defense proposals, adversarial retraining, provably succeeds at increasing the distortion required to construct adversarial examples by a factor of 4.2.