# SmoothFool: An Efficient Framework for Computing Smooth Adversarial Perturbations

arXiv: https://arxiv.org/abs/1910.03624 · HTML: https://mlsanity.com/paper/1910.03624/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Oct 2019.

## Built on by (most cited first, 12 of 12)

- [Rethinking the Backdoor Attacks' Triggers: A Frequency Perspective](https://mlsanity.com/paper/2104.03413/) (2021)
- [How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses](https://mlsanity.com/paper/2305.10862/) (2023)
- [AdvDrop: Adversarial Attack to DNNs by Dropping Information](https://mlsanity.com/paper/2108.09034/) (2021)
- [Generalization Bound and New Algorithm for Clean-Label Backdoor Attack](https://mlsanity.com/paper/2406.00588/) (2024)
- [Robust Ensemble Morph Detection with Domain Generalization](https://mlsanity.com/paper/2209.08130/) (2022)
- [Revisiting Outer Optimization in Adversarial Training](https://mlsanity.com/paper/2209.01199/) (2022)
- [Hide and Seek: on the Stealthiness of Attacks against Deep Learning Systems](https://mlsanity.com/paper/2205.15944/) (2022)
- [LISArD: Learning Image Similarity to Defend Against Gray-box Adversarial Attacks](https://mlsanity.com/paper/2502.20562/) (2025)
- [ZQBA: Zero Query Black-box Adversarial Attack](https://mlsanity.com/paper/2510.00769/) (2025)
- [AdvSerial: Physical Adversarial Attacks on Infrastructure-mounted Pedestrian Detectors via Semantic Feature Suppression](https://mlsanity.com/paper/2607.17069/) (2026)
- [Showing Many Labels in Multi-label Classification Models: An Empirical Study of Adversarial Examples](https://mlsanity.com/paper/2409.17568/) (2024)
- [Identifying Adversary Characteristics from an Observed Attack](https://mlsanity.com/paper/2603.05625/) (2026)

## Abstract (arXiv)

Deep neural networks are susceptible to adversarial manipulations in the input domain. The extent of vulnerability has been explored intensively in cases of ℓp-bounded and ℓp-minimal adversarial perturbations. However, the vulnerability of DNNs to adversarial perturbations with specific statistical properties or frequency-domain characteristics has not been sufficiently explored. In this paper, we study the smoothness of perturbations and propose SmoothFool, a general and computationally efficient framework for computing smooth adversarial perturbations. Through extensive experiments, we validate the efficacy of the proposed method for both the white-box and black-box attack scenarios. In particular, we demonstrate that: (i) there exist extremely smooth adversarial perturbations for well-established and widely used network architectures, (ii) smoothness significantly enhances the robustness of perturbations against state-of-the-art defense mechanisms, (iii) smoothness improves the transferability of adversarial perturbations across both data points and network architectures, and (iv) class categories exhibit a variable range of susceptibility to smooth perturbations. Our results suggest that smooth APs can play a significant role in exploring the vulnerability extent of DNNs to adversarial examples.