mlsanityData to 14 Oct 2026

How many dimensions are required to find an adversarial example?

arXiv 2303.14173 ↗First posted 24 Mar 2023cs.LG cs.CR stat.MLcited by 5

Not on the map. Why?

Abstract (arXiv)

Past work exploring adversarial vulnerability have focused on situations where an adversary can perturb all dimensions of model input. On the other hand, a range of recent works consider the case where either (i) an adversary can perturb a limited number of input parameters or (ii) a subset of modalities in a multimodal problem. In both of these cases, adversarial examples are effectively constrained to a subspace V in the ambient input space X. Motivated by this, in this work we investigate how adversarial vulnerability depends on dim(V). In particular, we show that the adversarial success of standard PGD attacks with ℓp norm constraints behaves like a monotonically increasing function of ε (fracdim(V)dim X)^frac1q where ε is the perturbation budget and frac1p + frac1q =1, provided p > 1 (the case p=1 presents additional subtleties which we analyze in some detail). This functional form can be easily derived from a simple toy linear model, and as such our results land further credence to arguments that adversarial examples are endemic to locally linear models on high dimensional spaces.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Builds on 24 of its 43 references that are in the map. First posted on arXiv 24 Mar 2023.

Builds on

24 of 43 references.

References · 24

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2013Intriguing properties of neural networkscited by 5,155
  6. 2018On the Spectral Bias of Neural Networkscited by 1,341
  7. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  8. 2019A Fourier Perspective on Model Robustness in Computer Visioncited by 288
  9. 2017Adversarial Examples for Semantic Segmentation and Object Detectioncited by 275
  10. 2018Disentangling Adversarial Robustness and Generalizationcited by 172
  11. 2017The Space of Transferable Adversarial Examplescited by 158
  12. 2018Are adversarial examples inevitable?cited by 113
12 more
  1. 2016Robustness of classifiers: from adversarial to random noisecited by 88
  2. 2017Measuring the tendency of CNNs to Learn Surface Statistical Regularitiescited by 87
  3. 2019Functional Adversarial Attackscited by 82
  4. 2018Low Frequency Adversarial Perturbationcited by 80
  5. 2015Analysis of classifiers' robustness to adversarial perturbationscited by 76
  6. 2018Motivating the Rules of the Game for Adversarial Example Researchcited by 57
  7. 2019On the Effectiveness of Low Frequency Perturbationscited by 56
  8. 2018On the Geometry of Adversarial Examplescited by 43
  9. 2021A single gradient step finds adversarial examples on random two-layers neural networkscited by 26
  10. 2021Adversarial Examples in Multi-Layer Random ReLU Networkscited by 26
  11. 2017Intriguing Properties of Adversarial Examplescited by 20
  12. 2022Origins of Low-dimensional Adversarial Perturbationscited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 1; 2024: 2; 2025: 1; 2026: 1.

5 papers.

  1. 2024A High Dimensional Statistical Model for Adversarial Training: Geometry and Trade-Offscited by 7
  2. 2023Eigenpatches -- Adversarial Patches from Principal Componentscited by 1
  3. 2024Traversing the Subspace of Adversarial Patchescited by 1
  4. 2025Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Storescited by 0
  5. 2026A combination of noise and bilateral filters achieve supralinear and scalable adversarial robustness in CNNscited by 0