# Characterizing and evaluating adversarial examples for Offline Handwritten Signature Verification

arXiv: https://arxiv.org/abs/1901.03398 · HTML: https://mlsanity.com/paper/1901.03398/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Jan 2019.

## Built on by (most cited first, 9 of 9)

- [A White-Box False Positive Adversarial Attack Method on Contrastive Loss Based Offline Handwritten Signature Verification Models](https://mlsanity.com/paper/2308.08925/) (2023)
- [Demystifying the Transferability of Adversarial Attacks in Computer Networks](https://mlsanity.com/paper/2110.04488/) (2021)
- [Beyond Vulnerabilities: A Survey of Adversarial Attacks as Both Threats and Defenses in Computer Vision Systems](https://mlsanity.com/paper/2508.01845/) (2025)
- [Deep representation learning: Fundamentals, Perspectives, Applications, and Open Challenges](https://mlsanity.com/paper/2211.14732/) (2022)
- [Recognizing Handwriting Styles in a Historical Scanned Document Using Unsupervised Fuzzy Clustering](https://mlsanity.com/paper/2210.16780/) (2022)
- [Leveraging Expert Models for Training Deep Neural Networks in Scarce Data Domains: Application to Offline Handwritten Signature Verification](https://mlsanity.com/paper/2308.01136/) (2023)
- [Deep Generative Attacks and Countermeasures for Data-Driven Offline Signature Verification](https://mlsanity.com/paper/2312.00987/) (2023)
- [Online Handwritten Signature Verification Based on Temporal-Spatial Graph Attention Transformer](https://mlsanity.com/paper/2510.19321/) (2025)
- [Adversarial Attacks on Online Handwriting using Salience-based Temporal Editing](https://mlsanity.com/paper/2607.12500/) (2026)

## Abstract (arXiv)

The phenomenon of Adversarial Examples is attracting increasing interest from the Machine Learning community, due to its significant impact to the security of Machine Learning systems. Adversarial examples are similar (from a perceptual notion of similarity) to samples from the data distribution, that "fool" a machine learning classifier. For computer vision applications, these are images with carefully crafted but almost imperceptible changes, that are misclassified. In this work, we characterize this phenomenon under an existing taxonomy of threats to biometric systems, in particular identifying new attacks for Offline Handwritten Signature Verification systems. We conducted an extensive set of experiments on four widely used datasets: MCYT-75, CEDAR, GPDS-160 and the Brazilian PUC-PR, considering both a CNN-based system and a system using a handcrafted feature extractor (CLBP). We found that attacks that aim to get a genuine signature rejected are easy to generate, even in a limited knowledge scenario, where the attacker does not have access to the trained classifier nor the signatures used for training. Attacks that get a forgery to be accepted are harder to produce, and often require a higher level of noise - in most cases, no longer "imperceptible" as previous findings in object recognition. We also evaluated the impact of two countermeasures on the success rate of the attacks and the amount of noise required for generating successful attacks.