Delving into the pixels of adversarial samples
Not on the map. Why?
Abstract (arXiv)
Despite extensive research into adversarial attacks, we do not know how adversarial attacks affect image pixels. Knowing how image pixels are affected by adversarial attacks has the potential to lead us to better adversarial defenses. Motivated by instances that we find where strong attacks do not transfer, we delve into adversarial examples at pixel level to scrutinize how adversarial attacks affect image pixel values. We consider several ImageNet architectures, InceptionV3, VGG19 and ResNet50, as well as several strong attacks. We find that attacks can have different effects at pixel level depending on classifier architecture. In particular, input pre-processing plays a previously overlooked role in the effect that attacks have on pixels. Based on the insights of pixel-level examination, we find new ways to detect some of the strongest current attacks.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 30 of its 32 references that are in the map. First posted on arXiv 21 Jun 2021.
Builds on
30 of 32 references.
References · 30
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
- 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2016Xception: Deep Learning with Depthwise Separable Convolutionscited by 2,320
- 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
18 more
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
- 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
- 2016Adversarial Machine Learning at Scalecited by 934
- 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
- 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
- 2019On Evaluating Adversarial Robustnesscited by 442
- 2018Adversarial Robustness Toolbox v1.0.0cited by 214
- 2017The Space of Transferable Adversarial Examplescited by 156
- 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 139
- 2018Adversarial Attacks and Defences Competitioncited by 96
- 2020Backpropagating Linearly Improves Transferability of Adversarial Examplescited by 79
- 2016Defensive Distillation is Not Robust to Adversarial Examplescited by 60
- 2020Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferabilitycited by 57
- 2015Adversarial Manipulation of Deep Representationscited by 56
- 2020Transferable Perturbations of Deep Feature Distributionscited by 51
- 2017MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examplescited by 46
Built on by
Citing papers per year: 2025: 1.
1 paper.