# EdgeFool: An Adversarial Image Enhancement Filter

arXiv: https://arxiv.org/abs/1910.12227 · HTML: https://mlsanity.com/paper/1910.12227/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 Oct 2019.

## Built on by (most cited first, 10 of 10)

- [Natural Color Fool: Towards Boosting Black-box Unrestricted Attacks](https://mlsanity.com/paper/2210.02041/) (2022)
- [Unrestricted Adversarial Attacks on ImageNet Competition](https://mlsanity.com/paper/2110.09903/) (2021)
- [A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attacks](https://mlsanity.com/paper/2310.00633/) (2023)
- [ALA: Naturalness-aware Adversarial Lightness Attack](https://mlsanity.com/paper/2201.06070/) (2022)
- [Differential Evolution based Dual Adversarial Camouflage: Fooling Human Eyes and Object Detectors](https://mlsanity.com/paper/2210.08870/) (2022)
- [Effective Universal Unrestricted Adversarial Attacks using a MOE Approach](https://mlsanity.com/paper/2103.00250/) (2021)
- [Black-box Attacks on Image Activity Prediction and its Natural Language Explanations](https://mlsanity.com/paper/2310.00503/) (2023)
- [Light as Deception: GPT-driven Natural Relighting Against Vision-Language Pre-training Models](https://mlsanity.com/paper/2505.24227/) (2025)
- [SCOOTER: A Human Evaluation Framework for Unrestricted Adversarial Examples](https://mlsanity.com/paper/2507.07776/) (2025)
- [Almost for Free: Crafting Adversarial Examples with Convolutional Image Filters](https://mlsanity.com/paper/2605.01098/) (2026)

## Abstract (arXiv)

Adversarial examples are intentionally perturbed images that mislead classifiers. These images can, however, be easily detected using denoising algorithms, when high-frequency spatial perturbations are used, or can be noticed by humans, when perturbations are large. In this paper, we propose EdgeFool, an adversarial image enhancement filter that learns structure-aware adversarial perturbations. EdgeFool generates adversarial images with perturbations that enhance image details via training a fully convolutional neural network end-to-end with a multi-task loss function. This loss function accounts for both image detail enhancement and class misleading objectives. We evaluate EdgeFool on three classifiers (ResNet-50, ResNet-18 and AlexNet) using two datasets (ImageNet and Private-Places365) and compare it with six adversarial methods (DeepFool, SparseFool, Carlini-Wagner, SemanticAdv, Non-targeted and Private Fast Gradient Sign Methods). Code is available at https://github.com/smartcameras/EdgeFool.git.