mlsanityData to 7 Oct 2026

SparseFool: a few pixels make a big difference

arXiv 1811.02248 ↗First posted 6 Nov 2018cs.CV cs.CR cs.LGcited by 94

Not on the map. Why?

Abstract (arXiv)

Deep Neural Networks have achieved extraordinary results on image classification tasks, but have been shown to be vulnerable to attacks with carefully crafted perturbations of the input data. Although most attacks usually change values of many image's pixels, it has been shown that deep networks are also vulnerable to sparse alterations of the input. However, no computationally efficient method has been proposed to compute sparse perturbations. In this paper, we exploit the low mean curvature of the decision boundary, and propose SparseFool, a geometry inspired sparse attack that controls the sparsity of the perturbations. Extensive evaluations show that our approach computes sparse perturbations very fast, and scales efficiently to high dimensional data. We further analyze the transferability and the visual effects of the perturbations, and show the existence of shared semantic information across the images and the networks. Finally, we show that adversarial training can only slightly improve the robustness against sparse additive perturbations computed with SparseFool.

Key facts. Cited by 94 papers in the map (data through 7 Oct 2026). First posted on arXiv 6 Nov 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 23; 2022: 19; 2023: 11; 2024: 20; 2025: 14; 2026: 7.

94 papers.

Sort:

By area:

  1. 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
  2. 2021Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraintscited by 50
  3. 2021Mind the box: l1-APGD for sparse adversarial attacks on image classifierscited by 50
  4. 2022Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?cited by 47
  5. 2021A Zeroth-Order Block Coordinate Descent Algorithm for Huge-Scale Black-Box Optimizationcited by 46
  6. 2021GRNN: Generative Regression Neural Network -- A Data Leakage Attack for Federated Learningcited by 35
  7. 2022A Survey on Physical Adversarial Attack in Computer Visioncited by 24
  8. 2021Adversarial Robustness against Multiple and Single lp-Threat Models via Quick Fine-Tuning of Robust Classifierscited by 23
  9. 2022Physical-World Optical Adversarial Attacks on 3D Face Recognitioncited by 23
  10. 2022Pixle: a fast and effective black-box attack based on rearranging pixelscited by 20
  11. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  12. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
38 more
  1. 2021Adversarial Imaging Pipelinescited by 15
  2. 2021Sparse and Imperceptible Adversarial Attack via a Homotopy Algorithmcited by 15
  3. 2021Adversarial Attacks on Spiking Convolutional Neural Networks for Event-based Visioncited by 14
  4. 2024AttackBench: Evaluating Gradient-based Attacks for Adversarial Examplescited by 14
  5. 2022Query Efficient Decision Based Sparse Attacks Against Black-Box Deep Learning Modelscited by 13
  6. 2022Fooling Explanations in Text Classifierscited by 13
  7. 2024Understanding Robustness of Visual State Space Models for Image Classificationcited by 12
  8. 2024Exploring Vulnerabilities of No-Reference Image Quality Assessment Models: A Query-Based Black-Box Methodcited by 10
  9. 2025Rethinking Adversarial Attacks in Reinforcement Learning from Policy Distribution Perspectivecited by 10
  10. 2021Transferable Sparse Adversarial Attackcited by 9
  11. 2023Hierarchical Randomized Smoothingcited by 9
  12. 2025Towards Effective and Sparse Adversarial Attack on Spiking Neural Networks via Breaking Invisible Surrogate Gradientscited by 9
  13. 2021PDPGD: Primal-Dual Proximal Gradient Descent Adversarial Attackcited by 8
  14. 2024Imperceptible Protection against Style Imitation from Diffusion Modelscited by 8
  15. 2022AdvMask: A Sparse Adversarial Attack Based Data Augmentation Method for Image Classificationcited by 7
  16. 2024σ-zero: Gradient-based Optimization of ℓ0-norm Adversarial Examplescited by 7
  17. 2024BruSLeAttack: A Query-Efficient Score-Based Black-Box Sparse Adversarial Attackcited by 7
  18. 2025TarPro: Targeted Protection against Malicious Image Editingcited by 7
  19. 2024Nearly Zero-Cost Protection Against Mimicry by Personalized Diffusion Modelscited by 6
  20. 2021Robust Classification Under ℓ0 Attack for the Gaussian Mixture Modelcited by 5
  21. 2022Adversarial Scratches: Deployable Attacks to CNN Classifierscited by 5
  22. 2023Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Surveycited by 5
  23. 2023GSE: Group-wise Sparse and Explainable Adversarial Attackscited by 5
  24. 2021Reachability Analysis of Convolutional Neural Networkscited by 4
  25. 2022On the uncertainty principle of neural networkscited by 4
  26. 2023Continual Adversarial Defensecited by 4
  27. 2024Quantum-Inspired Analysis of Neural Network Vulnerabilities: The Role of Conjugate Variables in System Attackscited by 4
  28. 2024Sparse-PGD: A Unified Framework for Sparse Adversarial Perturbations Generationcited by 4
  29. 2024Natural Language Induced Adversarial Imagescited by 4
  30. 2021Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization in Adversarial Trainingcited by 3
  31. 2021An Overview of Laser Injection against Embedded Neural Network Modelscited by 3
  32. 2021Transferable Adversarial Examples for Anchor Free Object Detectioncited by 3
  33. 2021EG-Booster: Explanation-Guided Booster of ML Evasion Attackscited by 3
  34. 2021Amicable Aid: Perturbing Images to Improve Classification Performancecited by 3
  35. 2022Learning to Accelerate Approximate Methods for Solving Integer Programming via Early Fixingcited by 3
  36. 2022LP-BFGS attack: An adversarial attack based on the Hessian with limited pixelscited by 3
  37. 2023Attacking Important Pixels for Anchor-free Detectorscited by 3
  38. 2024Theoretical Understanding of Learning from Adversarial Perturbationscited by 2

50 most cited of 94 All 94 (JSON)