# Intriguing Properties of Adversarial Examples

arXiv: https://arxiv.org/abs/1711.02846 · HTML: https://mlsanity.com/paper/1711.02846/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Nov 2017.

## Built on by (most cited first, 20 of 20)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [A Comprehensive Survey on Hardware-Aware Neural Architecture Search](https://mlsanity.com/paper/2101.09336/) (2021)
- [Do better ImageNet classifiers assess perceptual similarity better?](https://mlsanity.com/paper/2203.04946/) (2022)
- [Physical Adversarial Attacks For Camera-based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlook](https://mlsanity.com/paper/2308.06173/) (2023)
- [Learning Diverse-Structured Networks for Adversarial Robustness](https://mlsanity.com/paper/2102.01886/) (2021)
- [State-of-the-art optical-based physical adversarial attacks for deep learning computer vision systems](https://mlsanity.com/paper/2303.12249/) (2023)
- [Adversarial Fine-Tuning of Language Models: An Iterative Optimisation Approach for the Generation and Detection of Problematic Content](https://mlsanity.com/paper/2308.13768/) (2023)
- [How many dimensions are required to find an adversarial example?](https://mlsanity.com/paper/2303.14173/) (2023)
- [The Effect of Prior Lipschitz Continuity on the Adversarial Robustness of Bayesian Neural Networks](https://mlsanity.com/paper/2101.02689/) (2021)
- [Tiny Adversarial Mulit-Objective Oneshot Neural Architecture Search](https://mlsanity.com/paper/2103.00363/) (2021)
- [Improving Generalization via Uncertainty Driven Perturbations](https://mlsanity.com/paper/2202.05737/) (2022)
- [Image Steganography based on Iteratively Adversarial Samples of A Synchronized-directions Sub-image](https://mlsanity.com/paper/2101.05209/) (2021)
- [Analyzing Adversarial Robustness of Deep Neural Networks in Pixel Space: a Semantic Perspective](https://mlsanity.com/paper/2106.09872/) (2021)
- [Deep Bayesian Image Set Classification: A Defence Approach against Adversarial Attacks](https://mlsanity.com/paper/2108.10217/) (2021)
- [Automated Robustness with Adversarial Training as a Post-Processing Step](https://mlsanity.com/paper/2109.02532/) (2021)
- [Associative Adversarial Learning Based on Selective Attack](https://mlsanity.com/paper/2112.13989/) (2021)
- [Extending Neural Network Verification to a Larger Family of Piece-wise Linear Activation Functions](https://mlsanity.com/paper/2311.10780/) (2023)
- [DisPatch: Disarming Adversarial Patches in Object Detection with Diffusion Models](https://mlsanity.com/paper/2509.04597/) (2025)
- [Almost for Free: Crafting Adversarial Examples with Convolutional Image Filters](https://mlsanity.com/paper/2605.01098/) (2026)
- [Evaluation of Adversarial Robustness in Arabic Language Models](https://mlsanity.com/paper/2607.25814/) (2026)

## Abstract (arXiv)

It is becoming increasingly clear that many machine learning classifiers are vulnerable to adversarial examples. In attempting to explain the origin of adversarial examples, previous studies have typically focused on the fact that neural networks operate on high dimensional data, they overfit, or they are too linear. Here we argue that the origin of adversarial examples is primarily due to an inherent uncertainty that neural networks have about their predictions. We show that the functional form of this uncertainty is independent of architecture, dataset, and training protocol; and depends only on the statistics of the logit differences of the network, which do not change significantly during training. This leads to adversarial error having a universal scaling, as a power-law, with respect to the size of the adversarial perturbation. We show that this universality holds for a broad range of datasets (MNIST, CIFAR10, ImageNet, and random data), models (including state-of-the-art deep networks, linear models, adversarially trained networks, and networks trained on randomly shuffled labels), and attacks (FGSM, step l.l., PGD). Motivated by these results, we study the effects of reducing prediction entropy on adversarial robustness. Finally, we study the effect of network architectures on adversarial sensitivity. To do this, we use neural architecture search with reinforcement learning to find adversarially robust architectures on CIFAR10. Our resulting architecture is more robust to white and black box attacks compared to previous attempts.