# A Comprehensive Review of One-Pixel Attack: Research Status, Taxonomy, Applications, Regulation Policy and Future Directions

arXiv: https://arxiv.org/abs/2610.00125 · HTML: https://mlsanity.com/paper/2610.00125/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 24 of its 130 references that are in the map.
- First posted on arXiv 9 Sep 2026.

## Builds on (most cited first, 24 of 24)

- [One pixel attack for fooling deep neural networks](https://mlsanity.com/paper/1710.08864/) (2017)
- [Adversarial Examples: Attacks and Defenses for Deep Learning](https://mlsanity.com/paper/1712.07107/) (2017)
- [CNN-Based Projected Gradient Descent for Consistent Image Reconstruction](https://mlsanity.com/paper/1709.01809/) (2017)
- [Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attacks](https://mlsanity.com/paper/2006.12834/) (2020)
- [Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey](https://mlsanity.com/paper/2410.23687/) (2024)
- [Attack to Fool and Explain Deep Networks](https://mlsanity.com/paper/2106.10606/) (2021)
- [Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges](https://mlsanity.com/paper/2303.14133/) (2023)
- [A Survey on Adversarial Attacks for Malware Analysis](https://mlsanity.com/paper/2111.08223/) (2021)
- [Perceptual Evaluation of Adversarial Attacks for CNN-based Image Classification](https://mlsanity.com/paper/1906.00204/) (2019)
- [Understanding the One-Pixel Attack: Propagation Maps and Locality Analysis](https://mlsanity.com/paper/1902.02947/) (2019)
- [When and How to Fool Explainable Models (and Humans) with Adversarial Examples](https://mlsanity.com/paper/2107.01943/) (2021)
- [Convolution in Convolution for Network in Network](https://mlsanity.com/paper/1603.06759/) (2016)
- [Probabilistic Jacobian-based Saliency Maps Attacks](https://mlsanity.com/paper/2007.06032/) (2020)
- [Cert-SSBD: Certified Backdoor Defense with Sample-Specific Smoothing Noises](https://mlsanity.com/paper/2504.21730/) (2025)
- [GreedyPixel: Fine-Grained Black-Box Adversarial Attack Via Greedy Algorithm](https://mlsanity.com/paper/2501.14230/) (2025)
- [Exploring Adversarial Examples: Patterns of One-Pixel Attacks](https://mlsanity.com/paper/1806.09410/) (2018)
- [One-Pixel Attack Deceives Computer-Assisted Diagnosis of Cancer](https://mlsanity.com/paper/2012.00517/) (2020)
- [Towards Robust Semantic Segmentation against Patch-based Attack via Attention Refinement](https://mlsanity.com/paper/2401.01750/) (2024)
- [Systematically Assessing the Security Risks of AI/ML-enabled Connected Healthcare Systems](https://mlsanity.com/paper/2401.17136/) (2024)
- [Hybrid Spatial-spectral Neural Network for Hyperspectral Image Denoising](https://mlsanity.com/paper/2406.08782/) (2024)
- [One-Index Vector Quantization Based Adversarial Attack on Image Classification](https://mlsanity.com/paper/2409.01282/) (2024)
- [Multi-Faceted Attack: Exposing Cross-Model Vulnerabilities in Defense-Equipped Vision-Language Models](https://mlsanity.com/paper/2511.16110/) (2025)
- [Chromatic and spatial analysis of one-pixel attacks against an image classifier](https://mlsanity.com/paper/2105.13771/) (2021)
- [A Survey of Adversarial Defenses in Vision-based Systems: Categorization, Methods and Challenges](https://mlsanity.com/paper/2503.00384/) (2025)

## Abstract (arXiv)

One-Pixel Attacks (OPAs) represent one of the most extreme demonstrations of adversarial fragility in deep learning, where modifying a single pixel can reliably induce high-confidence misclassification across domains such as medical diagnosis, autonomous driving, biometrics, and quantum communication. Despite their conceptual simplicity, OPAs remain underexamined in existing adversarial-attack surveys, which provide only fragmented or cursory coverage. This PRISMA-guided review synthesizes high-quality studies from 2017 to 2026 and delivers a unified, multi-axis taxonomy of OPA research spanning algorithmic foundations, black-box evolutionary optimization, emerging hybrid and program-synthesis attacks, defence mechanisms, interpretability tools, and domain-specific vulnerabilities. Our analysis reveals the dominance of Differential Evolution-based strategies, the rise of efficiency-optimized and saliency-guided methods, and persistent gaps in dataset diversity, transferability, and standardized evaluation. We summarized and assess defence paradigms including pixel restoration, anomaly detection, input-space transformations, and robust training highlighting their trade-offs in robustness, imperceptibility, and computational overhead. Building on these insights, we outline future research priorities involving selective pixel recovery, transformer-specific vulnerability analysis, saliency-driven optimization, and real-world domain-adaptive defences. We further propose a regulatory framework emphasizing robustness testing, incident disclosure, and AI security governance. This review establishes a comprehensive foundation for understanding, evaluating, and mitigating ultra-sparse adversarial threats in contemporary AI systems.