# Potential adversarial samples for white-box attacks

arXiv: https://arxiv.org/abs/1912.06409 · HTML: https://mlsanity.com/paper/1912.06409/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Dec 2019.

## Built on by (most cited first, 3 of 3)

- [Feature Importance Guided Attack: A Model Agnostic Adversarial Attack](https://mlsanity.com/paper/2106.14815/) (2021)
- [Noise Optimization for Artificial Neural Networks](https://mlsanity.com/paper/2102.04450/) (2021)
- [MISLEAD: Manipulating Importance of Selected features for Learning Epsilon in Evasion Attack Deception](https://mlsanity.com/paper/2404.15656/) (2024)

## Abstract (arXiv)

Deep convolutional neural networks can be highly vulnerable to small perturbations of their inputs, potentially a major issue or limitation on system robustness when using deep networks as classifiers. In this paper we propose a low-cost method to explore marginal sample data near trained classifier decision boundaries, thus identifying potential adversarial samples. By finding such adversarial samples it is possible to reduce the search space of adversarial attack algorithms while keeping a reasonable successful perturbation rate. In our developed strategy, the potential adversarial samples represent only 61% of the test data, but in fact cover more than 82% of the adversarial samples produced by iFGSM and 92% of the adversarial samples successfully perturbed by DeepFool on CIFAR10.