# AdvFoolGen: Creating Persistent Troubles for Deep Classifiers

arXiv: https://arxiv.org/abs/2007.10485 · HTML: https://mlsanity.com/paper/2007.10485/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Jul 2020.

## Built on by (most cited first, 2 of 2)

- [PAT: Pseudo-Adversarial Training For Detecting Adversarial Videos](https://mlsanity.com/paper/2109.05695/) (2021)
- [Deep generative models as an adversarial attack strategy for tabular machine learning](https://mlsanity.com/paper/2409.12642/) (2024)

## Abstract (arXiv)

Researches have shown that deep neural networks are vulnerable to malicious attacks, where adversarial images are created to trick a network into misclassification even if the images may give rise to totally different labels by human eyes. To make deep networks more robust to such attacks, many defense mechanisms have been proposed in the literature, some of which are quite effective for guarding against typical attacks. In this paper, we present a new black-box attack termed AdvFoolGen, which can generate attacking images from the same feature space as that of the natural images, so as to keep baffling the network even though state-of-the-art defense mechanisms have been applied. We systematically evaluate our model by comparing with well-established attack algorithms. Through experiments, we demonstrate the effectiveness and robustness of our attack in the face of state-of-the-art defense techniques and unveil the potential reasons for its effectiveness through principled analysis. As such, AdvFoolGen contributes to understanding the vulnerability of deep networks from a new perspective and may, in turn, help in developing and evaluating new defense mechanisms.