mlsanityData to 14 Oct 2026

A Simple Explanation for the Existence of Adversarial Examples with Small Hamming Distance

arXiv 1901.10861 ↗First posted 30 Jan 2019cs.LG cs.CR stat.MLcited by 32

Not on the map. Why?

Abstract (arXiv)

The existence of adversarial examples in which an imperceptible change in the input can fool well trained neural networks was experimentally discovered by Szegedy et al in 2013, who called them "Intriguing properties of neural networks". Since then, this topic had become one of the hottest research areas within machine learning, but the ease with which we can switch between any two decisions in targeted attacks is still far from being understood, and in particular it is not clear which parameters determine the number of input coordinates we have to change in order to mislead the network. In this paper we develop a simple mathematical framework which enables us to think about this baffling phenomenon from a fresh perspective, turning it into a natural consequence of the geometry of ℝn with the L0 (Hamming) metric, which can be quantitatively analyzed. In particular, we explain why we should expect to find targeted adversarial examples with Hamming distance of roughly m in arbitrarily deep neural networks which are designed to distinguish between m input classes.

Key facts. Cited by 32 papers in the map (data through 14 Oct 2026). First posted on arXiv 30 Jan 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 11; 2022: 7; 2023: 8; 2024: 2; 2025: 2; 2026: 2.

32 papers.

Sort:

By area:

  1. 2021Amplitude-Phase Recombination: Rethinking Robustness of Convolutional Neural Networks in Frequency Domaincited by 71
  2. 2022Planting Undetectable Backdoors in Machine Learning Modelscited by 59
  3. 2021The 2021 Image Similarity Dataset and Challengecited by 44
  4. 2022Gradient Methods Provably Converge to Non-Robust Networkscited by 27
  5. 2021A single gradient step finds adversarial examples on random two-layers neural networkscited by 26
  6. 2021Adversarial Examples in Multi-Layer Random ReLU Networkscited by 26
  7. 2023The Double-Edged Sword of Implicit Bias: Generalization vs. Robustness in ReLU Networkscited by 23
  8. 2021Shift Invariance Can Reduce Adversarial Robustnesscited by 16
  9. 2021Dompteur: Taming Audio Adversarial Examplescited by 10
  10. 2021Thief, Beware of What Get You There: Towards Understanding Model Extraction Attackcited by 9
  11. 2023It Is All About Data: A Survey on the Effects of Data on Adversarial Robustnesscited by 9
  12. 2023Adversarial Examples Exist in Two-Layer ReLU Networks for Low Dimensional Linear Subspacescited by 8
20 more
  1. 2021Who's Afraid of Adversarial Transferability?cited by 6
  2. 2022Adversarial Robustness is at Odds with Lazy Trainingcited by 6
  3. 2021Robust Classification Under ℓ0 Attack for the Gaussian Mixture Modelcited by 5
  4. 2022Fairness Increases Adversarial Vulnerabilitycited by 5
  5. 2023Hamming Similarity and Graph Laplacians for Class Partitioning and Adversarial Image Detectioncited by 4
  6. 2022Dual Graphs of Polyhedral Decompositions for the Detection of Adversarial Attackscited by 2
  7. 2023Upper and lower bounds for the Lipschitz constant of random neural networkscited by 2
  8. 2021Understanding Robustness in Teacher-Student Setting: A New Perspectivecited by 1
  9. 2021Towards Explaining Adversarial Examples Phenomenon in Artificial Neural Networkscited by 1
  10. 2022Efficient and Robust Classification for Sparse Attackscited by 1
  11. 2024MALT Powers Up Adversarial Attackscited by 1
  12. 2026A Provable Energy-Guided Test-Time Defense Boosting Adversarial Robustness of Large Vision-Language Modelscited by 1
  13. 2022Binary Classification Under ℓ0 Attacks for General Noise Distributioncited by 0
  14. 2023Beyond Empirical Risk Minimization: Local Structure Preserving Regularization for Improving Adversarial Robustnesscited by 0
  15. 2023A Theoretical Perspective on Subnetwork Contributions to Adversarial Robustnesscited by 0
  16. 2023On the Computational Entanglement of Distant Features in Adversarial Machine Learningcited by 0
  17. 2024Generalization Properties of Adversarial Training for ℓ0-Bounded Adversarial Attackscited by 0
  18. 2025Human-Imperceptible Physical Adversarial Attack for NIR Face Recognition Modelscited by 0
  19. 2025Existence of Adversarial Examples for Random Convolutional Networks via Isoperimetric Inequalities on mathbbso(d)cited by 0
  20. 2026Most Convolutional Networks Suffer from Small Adversarial Perturbationscited by 0