# First-order Adversarial Vulnerability of Neural Networks and Input Dimension

arXiv: https://arxiv.org/abs/1802.01421 · HTML: https://mlsanity.com/paper/1802.01421/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 5 Feb 2018.

## Built on by (most cited first, 5 of 5)

- [Relating Adversarially Robust Generalization to Flat Minima](https://mlsanity.com/paper/2104.04448/) (2021)
- [What Do Deep Nets Learn? Class-wise Patterns Revealed in the Input Space](https://mlsanity.com/paper/2101.06898/) (2021)
- [Rethinking the Vulnerability of Concept Erasure and a New Method](https://mlsanity.com/paper/2502.17537/) (2025)
- [On Procedural Adversarial Noise Attack And Defense](https://mlsanity.com/paper/2108.04409/) (2021)
- [A Learning Paradigm for Interpretable Gradients](https://mlsanity.com/paper/2404.15024/) (2024)

## Abstract (arXiv)

Over the past few years, neural networks were proven vulnerable to adversarial images: targeted but imperceptible image perturbations lead to drastically different predictions. We show that adversarial vulnerability increases with the gradients of the training objective when viewed as a function of the inputs. Surprisingly, vulnerability does not depend on network topology: for many standard network architectures, we prove that at initialization, the ℓ1-norm of these gradients grows as the square root of the input dimension, leaving the networks increasingly vulnerable with growing image size. We empirically show that this dimension dependence persists after either usual or robust training, but gets attenuated with higher regularization.