# Towards Imperceptible and Robust Adversarial Example Attacks against Neural Networks

arXiv: https://arxiv.org/abs/1801.04693 · HTML: https://mlsanity.com/paper/1801.04693/

## Key facts

- Cited by 38 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Jan 2018.

## Built on by (most cited first, 30 of 38)

- [Relating Adversarially Robust Generalization to Flat Minima](https://mlsanity.com/paper/2104.04448/) (2021)
- [A Comprehensive Evaluation Framework for Deep Model Robustness](https://mlsanity.com/paper/2101.09617/) (2021)
- [Delving into Data: Effectively Substitute Training for Black-box Attack](https://mlsanity.com/paper/2104.12378/) (2021)
- [Unsupervised Robust Domain Adaptation without Source Data](https://mlsanity.com/paper/2103.14577/) (2021)
- [A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attacks](https://mlsanity.com/paper/2310.00633/) (2023)
- [Towards Good Practices in Evaluating Transfer Adversarial Attacks](https://mlsanity.com/paper/2211.09565/) (2022)
- [Why adversarial training can hurt robust accuracy](https://mlsanity.com/paper/2203.02006/) (2022)
- [Ten Years of Generative Adversarial Nets (GANs): A survey of the state-of-the-art](https://mlsanity.com/paper/2308.16316/) (2023)
- [Imperceptible Adversarial Attack via Invertible Neural Networks](https://mlsanity.com/paper/2211.15030/) (2022)
- [Imperceptible Protection against Style Imitation from Diffusion Models](https://mlsanity.com/paper/2403.19254/) (2024)
- [fakeWeather: Adversarial Attacks for Deep Neural Networks Emulating Weather Conditions on the Camera Lens of Autonomous Systems](https://mlsanity.com/paper/2205.13807/) (2022)
- [FedRight: An Effective Model Copyright Protection for Federated Learning](https://mlsanity.com/paper/2303.10399/) (2023)
- [AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks](https://mlsanity.com/paper/2503.09124/) (2025)
- [Integer-arithmetic-only Certified Robustness for Quantized Neural Networks](https://mlsanity.com/paper/2108.09413/) (2021)
- [Nearly Zero-Cost Protection Against Mimicry by Personalized Diffusion Models](https://mlsanity.com/paper/2412.11423/) (2024)
- [Landmark Breaker: Obstructing DeepFake By Disturbing Landmark Extraction](https://mlsanity.com/paper/2102.00798/) (2021)
- [Exploring Adversarial Attacks on Neural Networks: An Explainable Approach](https://mlsanity.com/paper/2303.06032/) (2023)
- [Generating Robust Adversarial Examples against Online Social Networks (OSNs)](https://mlsanity.com/paper/2310.12708/) (2023)
- [MAP: MAsk-Pruning for Source-Free Model Intellectual Property Protection](https://mlsanity.com/paper/2403.04149/) (2024)
- [Investigating Imperceptibility of Adversarial Attacks on Tabular Data: An Empirical Analysis](https://mlsanity.com/paper/2407.11463/) (2024)
- [Fashion-Guided Adversarial Attack on Person Segmentation](https://mlsanity.com/paper/2104.08422/) (2021)
- [Amicable Aid: Perturbing Images to Improve Classification Performance](https://mlsanity.com/paper/2112.04720/) (2021)
- [Testing autonomous vehicles and AI: perspectives and challenges from cybersecurity, transparency, robustness and fairness](https://mlsanity.com/paper/2403.14641/) (2024)
- [Robust Universal Adversarial Perturbations](https://mlsanity.com/paper/2206.10858/) (2022)
- [NoiseCAM: Explainable AI for the Boundary Between Noise and Adversarial Attacks](https://mlsanity.com/paper/2303.06151/) (2023)
- [Test-Time Defense Against Adversarial Attacks via Stochastic Resonance of Latent Ensembles](https://mlsanity.com/paper/2510.03224/) (2025)
- [ExploreADV: Towards exploratory attack for Neural Networks](https://mlsanity.com/paper/2301.01223/) (2023)
- [Venomancer: Towards Imperceptible and Target-on-Demand Backdoor Attacks in Federated Learning](https://mlsanity.com/paper/2407.03144/) (2024)
- [Defending Against Frequency-Based Attacks with Diffusion Models](https://mlsanity.com/paper/2504.11034/) (2025)
- [IAP: Invisible Adversarial Patch Attack through Perceptibility-Aware Localization and Perturbation Optimization](https://mlsanity.com/paper/2507.06856/) (2025)

## Abstract (arXiv)

Machine learning systems based on deep neural networks, being able to produce state-of-the-art results on various perception tasks, have gained mainstream adoption in many applications. However, they are shown to be vulnerable to adversarial example attack, which generates malicious output by adding slight perturbations to the input. Previous adversarial example crafting methods, however, use simple metrics to evaluate the distances between the original examples and the adversarial ones, which could be easily detected by human eyes. In addition, these attacks are often not robust due to the inevitable noises and deviation in the physical world. In this work, we present a new adversarial example attack crafting method, which takes the human perceptual system into consideration and maximizes the noise tolerance of the crafted adversarial example. Experimental results demonstrate the efficacy of the proposed technique.