# Understanding the One-Pixel Attack: Propagation Maps and Locality Analysis

arXiv: https://arxiv.org/abs/1902.02947 · HTML: https://mlsanity.com/paper/1902.02947/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Feb 2019.

## Built on by (most cited first, 10 of 10)

- [Single Node Injection Attack against Graph Neural Networks](https://mlsanity.com/paper/2108.13049/) (2021)
- [Just Noticeable Difference for Machine Perception and Generation of Regularized Adversarial Images with Minimal Perturbation](https://mlsanity.com/paper/2102.08079/) (2021)
- [Deep neural network loses attention to adversarial images](https://mlsanity.com/paper/2106.05657/) (2021)
- [Systematically Assessing the Security Risks of AI/ML-enabled Connected Healthcare Systems](https://mlsanity.com/paper/2401.17136/) (2024)
- [Understanding Robustness in Teacher-Student Setting: A New Perspective](https://mlsanity.com/paper/2102.13170/) (2021)
- [Chromatic and spatial analysis of one-pixel attacks against an image classifier](https://mlsanity.com/paper/2105.13771/) (2021)
- [A reading survey on adversarial machine learning: Adversarial attacks and their understanding](https://mlsanity.com/paper/2308.03363/) (2023)
- [Towards Improving Robustness Against Common Corruptions in Object Detectors Using Adversarial Contrastive Learning](https://mlsanity.com/paper/2311.07928/) (2023)
- [Systems-Theoretic and Data-Driven Security Analysis in ML-enabled Medical Devices](https://mlsanity.com/paper/2506.15028/) (2025)
- [A Comprehensive Review of One-Pixel Attack: Research Status, Taxonomy, Applications, Regulation Policy and Future Directions](https://mlsanity.com/paper/2610.00125/) (2026)

## Abstract (arXiv)

Deep neural networks were shown to be vulnerable to single pixel modifications. However, the reason behind such phenomena has never been elucidated. Here, we propose Propagation Maps which show the influence of the perturbation in each layer of the network. Propagation Maps reveal that even in extremely deep networks such as Resnet, modification in one pixel easily propagates until the last layer. In fact, this initial local perturbation is also shown to spread becoming a global one and reaching absolute difference values that are close to the maximum value of the original feature maps in a given layer. Moreover, we do a locality analysis in which we demonstrate that nearby pixels of the perturbed one in the one-pixel attack tend to share the same vulnerability, revealing that the main vulnerability lies in neither neurons nor pixels but receptive fields. Hopefully, the analysis conducted in this work together with a new technique called propagation maps shall shed light into the inner workings of other adversarial samples and be the basis of new defense systems to come.