mlsanityData to 14 Oct 2026

One pixel attack for fooling deep neural networks

arXiv 1710.08864 ↗First posted 24 Oct 2017cs.LG cs.CV stat.MLcited by 582

Not on the map. Why?

Abstract (arXiv)

Recent research has revealed that the output of Deep Neural Networks (DNN) can be easily altered by adding relatively small perturbations to the input vector. In this paper, we analyze an attack in an extremely limited scenario where only one pixel can be modified. For that we propose a novel method for generating one-pixel adversarial perturbations based on differential evolution (DE). It requires less adversarial information (a black-box attack) and can fool more types of networks due to the inherent features of DE. The results show that 67.97% of the natural images in Kaggle CIFAR-10 test dataset and 16.04% of the ImageNet (ILSVRC 2012) test images can be perturbed to at least one target class by modifying just one pixel with 74.03% and 22.91% confidence on average. We also show the same vulnerability on the original CIFAR-10 dataset. Thus, the proposed attack explores a different take on adversarial machine learning in an extreme limited scenario, showing that current DNNs are also vulnerable to such low dimension attacks. Besides, we also illustrate an important application of DE (or broadly speaking, evolutionary computation) in the domain of adversarial machine learning: creating tools that can effectively generate low-cost adversarial attacks against neural networks for evaluating robustness.

Key facts. Cited by 582 papers in the map (data through 14 Oct 2026). First posted on arXiv 24 Oct 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2018: 1; 2019: 0; 2020: 0; 2021: 148; 2022: 116; 2023: 124; 2024: 93; 2025: 72; 2026: 28.

582 papers.

Sort:

By area:

  1. 2022Handling Distribution Shifts on Graphs: An Invariance Perspectivecited by 164
  2. 2021Deep Stable Learning for Out-Of-Distribution Generalizationcited by 153
  3. 2021Fit without fear: remarkable mathematical phenomena of deep learning through the prism of interpolationcited by 132
  4. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  5. 2023End-to-End Diffusion Latent Optimization Improves Classifier Guidancecited by 108
  6. 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 93
  7. 2023On the Robustness of Large Multimodal Models Against Image Adversarial Attackscited by 92
  8. 2024Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Roboticscited by 73
  9. 2021Generalizing Graph Neural Networks on Out-Of-Distribution Graphscited by 71
  10. 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
  11. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 67
  12. 2022Probable Domain Generalization via Quantile Risk Minimizationcited by 66
38 more
  1. 2021FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysiscited by 61
  2. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  3. 2023StyleAdv: Meta Style Adversarial Training for Cross-Domain Few-Shot Learningcited by 53
  4. 2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 52
  5. 2021Entropy-based Logic Explanations of Neural Networkscited by 51
  6. 2023Adversarial attacks and defenses in explainable artificial intelligence: A surveycited by 48
  7. 2021Single Node Injection Attack against Graph Neural Networkscited by 45
  8. 2022A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologiescited by 44
  9. 2022Towards Formal XAI: Formally Approximate Minimal Explanations of Neural Networkscited by 42
  10. 2021Towards Unsupervised Domain Generalizationcited by 40
  11. 2021Improved Text Classification via Contrastive Adversarial Trainingcited by 38
  12. 2023Variational Positive-incentive Noise: How Noise Benefits Modelscited by 38
  13. 2022Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspectivecited by 37
  14. 2023Deep networks for system identification: a Surveycited by 37
  15. 2021Imperceptible Transfer Attack and Defense on 3D Point Cloud Classificationcited by 36
  16. 2021Inspect, Understand, Overcome: A Survey of Practical Methods for AI Safetycited by 35
  17. 2021Physical Adversarial Attacks on an Aerial Imagery Object Detectorcited by 35
  18. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 34
  19. 2023Human-Centric Multimodal Machine Learning: Recent Advances and Testbed on AI-based Recruitmentcited by 33
  20. 2025R-TPT: Improving Adversarial Robustness of Vision-Language Models through Test-Time Prompt Tuningcited by 33
  21. 2021Are socially-aware trajectory prediction models really socially-aware?cited by 32
  22. 2021Deep Learning-Based Autonomous Driving Systems: A Survey of Attacks and Defensescited by 30
  23. 2022One-Pixel Shortcut: on the Learning Preference of Deep Neural Networkscited by 29
  24. 2021AdvRush: Searching for Adversarially Robust Neural Architecturescited by 28
  25. 2021A Frequency Perspective of Adversarial Robustnesscited by 28
  26. 2023Towards quantum enhanced adversarial robustness in machine learningcited by 28
  27. 2021ECINN: Efficient Counterfactuals from Invertible Neural Networkscited by 26
  28. 20213D Adversarial Attacks Beyond Point Cloudcited by 26
  29. 2021Understanding the Dynamics of DNNs Using Graph Modularitycited by 26
  30. 2021IMAGINE: Image Synthesis by Image-Guided Model Inversioncited by 25
  31. 2021Learning to Break Deep Perceptual Hashing: The Use Case NeuralHashcited by 25
  32. 2022Debiased Graph Neural Networks with Agnostic Label Selection Biascited by 25
  33. 2022Restricted Black-box Adversarial Attack Against DeepFake Face Swappingcited by 25
  34. 2021LAFEAT: Piercing Through Adversarial Defenses with Latent Featurescited by 24
  35. 2021Parameter identifiability of a deep feedforward ReLU neural networkcited by 24
  36. 2023Formally Explaining Neural Networks within Reactive Systemscited by 24
  37. 2025Eva-VLA: Evaluating Vision-Language-Action Models' Robustness Under Real-World Physical Variationscited by 24
  38. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 23

50 most cited of 582 All 582 (JSON)