Pith. sign in

REVIEW 4 major objections 4 minor 51 references

Random Directional Attack for Fooling Deep Neural Networks

T0 review · 4 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Rotating the gradient direction improves one-step adversarial attacks.

desk verdict A cleanly described one-step attack whose black-box claim rests on an unfair comparison: RDA gets soft-label queries on the target while the baselines are transfer-only. read the letter →

arxiv 1908.02658 v1 pith:T6JFESIX submitted 2019-08-06 cs.CR cs.LGcs.NE

Wenjian Luo , Chenwang Wu , Nan Zhou , Li Ni This is my paper · ORCID
classification cs.CRcs.LGcs.NE
keywords adversarialexamplesattackrandomdirectionalhillclimbingsearchgradientdirectionblack-boxone-stepdeepneuralnetworks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the gradient direction is a poor default for one-step adversarial attacks because deep networks are nonlinear: moving along the gradient does not reliably increase loss or force misclassification. It proposes RDA, a one-step attack that keeps the perturbation size fixed but searches for a better direction by first-choice hill climbing: repeatedly rotate the gradient direction on a small, randomly chosen set of dimensions, keep the first rotation that lowers the model's confidence in the true class, and stop when the perturbed image is misclassified. On MNIST, SVHN, CIFAR-10, and a 10-class ImageNet subset, RDA matches or exceeds FGSM, L.L.Class, BIM, and MI-FGSM at most perturbation sizes, and in black-box settings its success rate stays close to its white-box rate, unlike gradient-transfer attacks. The larger point is that effective attack directions often deviate substantially from the gradient direction, so direction search can replace gradient-following as the core of a one-step attack.

What carries the argument

The mechanism is first-choice hill climbing over random rotations of the current direction vector. RDA generates rotation matrices that act on pairs of coordinates: for each candidate angle $\beta$ it randomly selects an even number of dimensions and applies $2\times 2$ rotation blocks to them; because only a few dimensions are moved, the rotated vector stays close to the original (cosine similarity no less than about $1 - 2\ell/m$), so the search behaves as local neighbor moves. The objective minimized is the probability the model assigns to the true class, obtained from the model output; the first rotation that lowers this probability is accepted, and the process repeats until misclassification or no improving move exists. The gradient of the target model (white-box) or of a substitute model (black-box) supplies the initial direction, and the final vector's sign is the perturbation.

What would settle it

Run RDA against a deployed classifier that exposes only the top-1 predicted label; if the attack success rate collapses toward the transfer-only baseline while still succeeding in white-box settings, the claim that black-box performance approaches white-box performance depends on full probability outputs and fails in hard-label settings. More directly, a dataset where every successful RDA direction coincides with the gradient direction to within a few degrees would falsify the paper's central observation that effective directions deviate irregularly.

Watch

Extended reading notes

Core claim

The central claim is that a successful one-step adversarial perturbation does not need to point along the gradient; the direction itself can be treated as a search variable. RDA starts from the gradient direction and applies first-choice hill climbing: at each step it generates rotations of the current direction on a few randomly chosen coordinate pairs, evaluates each candidate by querying the classifier for the confidence in the true class, and adopts the first rotation that reduces that confidence. The final direction is applied as a single sign-based perturbation, so the attack is one-step even though finding the direction takes iterations. Experiments on four datasets show that RDA's attack success rate is competitive with or better than FGSM and its iterative variants, and in black-box settings—where only the target model's probability outputs are used—its performance in most cases remains close to the white-box result. The paper also reports that the angle between the found direction and the gradient varies widely, with no consistent law, which it reads as evidence that successful attack directions are irregularly distributed and can lie far from the gradient.

Load-bearing premise

The black-box claim assumes the attacker can query the target model and read the full probability vector for each candidate direction; if the model returns only a hard class label, RDA's objective—confidence in the true class—is unavailable and the near-white-box black-box success would not transfer.

Editorial extensions

If this is right

  • One-step attacks can be made substantially stronger than FGSM without increasing perturbation size, since RDA's advantage comes from direction choice rather than iterative pixel modification.
  • In black-box settings, an attacker who can read the model's output probability vector can attack almost as effectively as with full gradient access, because the search uses only confidence values.
  • Iterative attacks like BIM and MI-FGSM are no longer strictly necessary for high success at moderate perturbation sizes; a direction-searching one-step attack reaches comparable rates.
  • The measured angles between RDA and gradient directions suggest that the adversarial region around a sample is not aligned with the gradient, challenging explanations that treat local gradient ascent as the essential mechanism of adversarial examples.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the direction-search view is right, defenses that only obscure or clip gradients, such as gradient masking or non-differentiable preprocessing, may not stop attackers who can still query output probabilities; confidence-based direction search bypasses gradient dependence.
  • RDA's design suggests a natural extension: replacing the hill-climbing acceptance rule with a learned or estimated direction model could reduce the many queries per image, since RDA's iteration counts on ImageNet are in the hundreds.
  • The black-box result depends on full probability outputs; a testable implication is that under hard-label-only feedback RDA would need a different objective, such as decision-boundary distance, and would likely lose its near-white-box edge.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes RDA, a one-step adversarial attack that starts from the gradient direction of the target model (white-box) or a substitute model (black-box) and uses first-choice hill climbing over random rotations of a randomly selected subset of dimensions to find a direction that reduces the true-class confidence, finally applying a sign perturbation. The authors report attack success rates on MNIST, SVHN, CIFAR-10, and an ImageNet-10 subset, comparing with FGSM, L.L.Class, BIM, and MI-FGSM in both white-box and black-box settings, and they analyze the angle between RDA's chosen direction and the gradient direction.

Significance. The paper makes a useful conceptual point: the effective direction for a one-step attack need not coincide with the gradient direction, and a cheap local search over rotated gradient directions can outperform FGSM and match iterative methods in white-box settings. The empirical study spans four datasets and the authors provide source code, which supports reproducibility. However, the headline black-box claim is weakened by an asymmetric experimental setup, and some reported baseline numbers appear to contain data-entry errors, so the central claim is defensible but not yet fully established.

major comments (4)
  1. [Section IV-C2 and Table V] The black-box comparison is asymmetric. In Algorithm 1, lines 9-10, RDA evaluates candidate directions on the target model using its full probability output P = F(x + eps * sign(R_j * v_i)) and accepts a direction when the true-class confidence drops. This gives RDA iterative query access to the target's soft labels, whereas the four baselines are pure transfer attacks computed on the substitute model and then submitted once to the target. The near-white-box black-box performance of RDA may therefore be a consequence of the extra query budget rather than the proposed search mechanism. To support the claim in the abstract and Section V that such performance is 'difficult to achieve using existing gradient-based attack methods,' the authors should include score-based query baselines with a comparable query budget (e.g., ZOO, NES, or finite-difference gradient estimation), or restrict RDA to hard-label feedback and show it still performs comparably.
  2. [Table V, CIFAR-10 block] The CIFAR-10 black-box success rates for epsilon=0.3 are identical to the epsilon=0.03 entries for three baselines: FGSM 42.15, BIM 34.15, and MI-FGSM 51.57. Since this exact duplication is implausible and contradicts the monotonic trends in the other datasets, it suggests copy-paste errors in the table. These baseline numbers need to be corrected and the experiments re-run, because the black-box comparison is the basis of the paper's central claim.
  3. [Section IV-B1, IV-B2, and IV-C] The two hyperparameters l=10 and theta=180 are selected by running experiments on the same datasets used for the headline comparisons, as shown in Figures 4 and 6 and stated in Section IV-C. This tuning on the test data may inflate RDA's reported performance relative to the baselines, whose parameters are taken from standard configurations without equivalent tuning. The authors should either fix the parameters a priori, perform a proper validation split, or report the sensitivity of the comparison to these choices.
  4. [Section IV-C2 and Algorithm 1] The black-box protocol assumes the attacker can access the target model's complete probability vector, since the hill-climbing acceptance criterion is based on the soft-label confidence P_y. If the target returns only a hard label (as in many practical black-box settings), RDA's search objective is unavailable and the claimed near-white-box black-box performance would not transfer. This limitation should be stated explicitly in Section IV-C2, or the method should be evaluated under a hard-label setting.
minor comments (4)
  1. [Algorithm 1, line 7] The variable name 'Setp Forward' is a typo and should read 'Step Forward'.
  2. [Fig. 8 caption] The caption mentions FMNIST, but Fashion-MNIST is not among the four datasets used in the experiments; the text in Section IV-B3 refers to MNIST, SVHN, CIFAR-10, and ImageNet-10. The caption and the figure labels should be made consistent.
  3. [Tables IV and V] Only point estimates of attack success rates are reported, with no variance or confidence intervals. Given that some comparisons are close (e.g., MNIST epsilon=0.03 in Table IV), standard deviations or a statement about statistical significance would strengthen the conclusions.
  4. [Section III-B3] The similarity bound derivation is informal: the step from 'similarity(A,B) = ...' to '>= 1 - 2l/m' assumes more than is stated about the magnitudes of the rotated components, and the approximation sign hides the dependence on the actual vector entries. A more careful statement of the bound, or a citation for it, would improve clarity.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's claims are empirical measurements of attack success, not derivations from fitted quantities.

full rationale

RDA is an optimization heuristic; the reported attack success rates are measured outcomes of running Algorithm 1 on test data, not quantities derived from the algorithm's own parameters. No equation in the paper defines a prediction in terms of a fitted parameter or a self-citation. The hyperparameter choices (l=10, θ=180) are selected based on exploratory experiments on the same datasets, which could inflate performance, but this is a methodological concern about overfitting, not circularity: the success rates are not equivalent by construction to the chosen hyperparameters, and the comparison with FGSM/BIM/MI-FGSM provides external empirical content. There are no self-citations or imported uniqueness theorems. The black-box comparison's asymmetry in query access is a fairness/correctness concern, not a circularity of the derivation chain.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The central claim rests on two tuned hyperparameters (l, theta) and several domain assumptions about the threat model and the local structure of adversarial regions. No new entities are introduced.

free parameters (2)
  • l (number of rotated dimensions) = 10
    Selected based on experiments in Section IV-B1; used in all comparison experiments. Affects attack success rate and iteration count.
  • theta (rotation angle range in degrees) = 180
    Selected based on experiments in Section IV-B2; the paper sets theta to maximum 180 for comparisons because the dataset is unknown in practice. Larger theta increases computational cost and saturates performance.
assumptions (5)
  • domain assumption Cross-entropy loss and true-class confidence are used as the objective for direction search.
    Section III-B2; the algorithm minimizes the target model's confidence in the true class, assuming this scalar is a reliable guide to finding misclassification.
  • domain assumption The target model returns the full probability vector (soft labels), not just the top-1 label, in black-box attacks.
    Section IV-C2; RDA queries P = F(x + eps*sign(...)) to obtain class probabilities, which is not available in strict label-only black-box settings.
  • standard math Rotating a small, randomly selected subset of dimensions produces a neighbor direction with cosine similarity at least 1 - 2l/m.
    Section III-B3; the inequality is derived from the rotation construction, but assumes the direction vector has roughly uniform component magnitudes, which is an approximation.
  • ad hoc to paper The adversarial region can be reached by local rotations around the gradient direction within the allowed step sizes.
    Section III-B4 and Fig. 3; the method's success depends on this empirical assumption, which is not proven and is dataset-dependent.
  • domain assumption The substitute model's gradient direction is a useful starting point for black-box attacks.
    Section I and IV-C2; RDA initializes v0 from the substitute model's gradient, relying on transferability of gradient information.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Random Directional Attack for Fooling Deep Neural Networks." pith.science (2026). https://pith.science/paper/T6JFESIX

@misc{pith2026190802658,
  author       = {Pith},
  title        = {Pith review of: Random Directional Attack for Fooling Deep Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/T6JFESIX}},
  note         = {Machine review of arXiv:1908.02658}
}
read the original abstract

Deep neural networks (DNNs) have been widely used in many fields such as images processing, speech recognition; however, they are vulnerable to adversarial examples, and this is a security issue worthy of attention. Because the training process of DNNs converge the loss by updating the weights along the gradient descent direction, many gradient-based methods attempt to destroy the DNN model by adding perturbations in the gradient direction. Unfortunately, as the model is nonlinear in most cases, the addition of perturbations in the gradient direction does not necessarily increase loss. Thus, we propose a random directed attack (RDA) for generating adversarial examples in this paper. Rather than limiting the gradient direction to generate an attack, RDA searches the attack direction based on hill climbing and uses multiple strategies to avoid local optima that cause attack failure. Compared with state-of-the-art gradient-based methods, the attack performance of RDA is very competitive. Moreover, RDA can attack without any internal knowledge of the model, and its performance under black-box attack is similar to that of the white-box attack in most cases, which is difficult to achieve using existing gradient-based attack methods.

Figures

Figures reproduced from arXiv: 1908.02658 by the authors.

Figure 1
Figure 1. Examples of attacks on the same image by FGSM and RDA based [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Use different perturbation sizes  to attack the image. The first column is the original image, and the following columns are the images after the attacks using  = 0.05, 0.1, 0.2, and 0.3. the loss by introducing a slight perturbation in the gradient direction to make model suggest a wrong prediction. Further, these methods have indeed achieved obvious attack effects [14]. However, it must be noted that adding a pe… view at source ↗
Figure 3
Figure 3. The simplified contour map of loss. selecting the neighbors (small step size; here, the rotation angle). Let the direction vectors before and after the rotation be A and B, respectively. If the similarity of A and B is measured by cosine similarity, then, similarity(A, B) = A · B kAk kBk = Pm i=1 Ai × Bi pPm i=1(Ai) 2 × pPm i=1(Bi) 2 . Let the number of selected dimensions be l. Without loss of generality, we assume… view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: The effect of the number of selected dimensions [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: The relationship between the number of selected dimensions [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: The impact of the selected angle on attack performance. Experimental results on MNIST, SVHN, CIFAR-10, and ImageNet-10 are given from left to [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Some examples of RDA attack the classifier in ImageNet-10. The first line lists clean examples, the second line lists adversarial examples generated [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: The distribution of the included angles between the direction of the RDA and the gradient direction. The results from left to right are from MNIST, [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 23 canonical work pages

  1. [1]

    Image denoising and inpainting with deep neural networks,

    J. Xie, L. Xu, and E. Chen, “Image denoising and inpainting with deep neural networks,” in Advances in Neural Information Processing Systems, 2012, pp. 341–349. 11 TABLE III NUMBER OF ITERATIONS Dataset ϵ 0.03 0.05 0.1 0.2 0.3 only RDAS AS only RDAS AS only RDAS AS only RDAS AS only RDAS AS MNIST 219.7 213.8 230.3 196.1 124.7 69.2 41.3 11.3 20.1 4.1 SVHN ...

    work page 2012

  2. [2]

    Context encoders: Feature learning by inpainting,

    D. Pathak, P. Krahenbuhl, J. Donahue, T. Darrell, and A. A. Efros, “Context encoders: Feature learning by inpainting,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2016, pp. 2536–2544

    work page 2016

  3. [3]

    A unified architecture for natural language processing: Deep neural networks with multitask learning,

    R. Collobert and J. Weston, “A unified architecture for natural language processing: Deep neural networks with multitask learning,” in Proceed- ings of the 25th International Conference on Machine Learning . ACM, 2008, pp. 160–167

    work page 2008

  4. [4]

    Deep neural networks for acoustic modeling in speech recognition,

    G. Hinton, L. Deng, D. Yu, G. Dahl, A.-r. Mohamed, N. Jaitly, A. Senior, V . Vanhoucke, P. Nguyen, B. Kingsbury et al., “Deep neural networks for acoustic modeling in speech recognition,” IEEE Signal Processing Magazine, vol. 29, 2012

    work page 2012

  5. [5]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    arXiv 2013

  6. [6]

    Univer- sal adversarial perturbations,

    S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Univer- sal adversarial perturbations,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2017, pp. 1765–1773

    2017

  7. [7]

    Synthesizing robust adversarial examples,

    A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing robust adversarial examples,” arXiv preprint arXiv:1707.07397 , 2017

    arXiv 2017

  8. [8]

    Adversarial examples for semantic segmentation and object detection,

    C. Xie, J. Wang, Z. Zhang, Y . Zhou, L. Xie, and A. Yuille, “Adversarial examples for semantic segmentation and object detection,” in Proceed- ings of the IEEE International Conference on Computer Vision , 2017, pp. 1369–1378

    2017

Show all 51 references
  1. [9]

    Audio adversarial examples: Targeted attacks on speech-to-text,

    N. Carlini and D. Wagner, “Audio adversarial examples: Targeted attacks on speech-to-text,” in 2018 IEEE Security and Privacy Workshops (SPW). IEEE, 2018, pp. 1–7

    2018

  2. [10]

    Did you hear that? adver- sarial examples against automatic speech recognition,

    M. Alzantot, B. Balaji, and M. Srivastava, “Did you hear that? adver- sarial examples against automatic speech recognition,” arXiv preprint arXiv:1801.00554, 2018

    2018 arXiv

  3. [11]

    Hotflip: White-box adver- sarial examples for text classification,

    J. Ebrahimi, A. Rao, D. Lowd, and D. Dou, “Hotflip: White-box adver- sarial examples for text classification,” arXiv preprint arXiv:1712.06751, 2017

    2017 arXiv

  4. [12]

    Threat of adversarial attacks on deep learning in computer vision: A survey,

    N. Akhtar and A. Mian, “Threat of adversarial attacks on deep learning in computer vision: A survey,” IEEE Access, vol. 6, pp. 14 410–14 430, 2018

    2018

  5. [13]

    Adversarial machine learning at scale,

    A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” arXiv preprint arXiv:1611.01236 , 2016

    2016 arXiv

  6. [14]

    Boosting adversarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” in Proceedings of the IEEE Con- ference on Computer Vision and Pattern Recognition , 2018, pp. 9185– 9193

    2018

  7. [15]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    2014 arXiv

  8. [16]

    A boundary tilting persepective on the phenomenon of adversarial examples,

    T. Tanay and L. Griffin, “A boundary tilting persepective on the phenomenon of adversarial examples,”arXiv preprint arXiv:1608.07690, 2016

    2016 arXiv

  9. [17]

    Towards deep neural network architectures robust to adversarial examples,

    S. Gu and L. Rigazio, “Towards deep neural network architectures robust to adversarial examples,” arXiv preprint arXiv:1412.5068 , 2014

    2014 arXiv

  10. [18]

    Exploring the space of adversarial images,

    P. Tabacof and E. Valle, “Exploring the space of adversarial images,” in 2016 International Joint Conference on Neural Networks (IJCNN) . IEEE, 2016, pp. 426–433

    2016

  11. [19]

    E. D. Cubuk, B. Zoph, S. S. Schoenholz, and Q. V . Le, “Intriguing 12 TABLE V ATTACK SUCCESS RATE (%) UNDER BLACK -BOX ATTACK Dataset Attack ϵ 0.03 0.05 0.1 0.2 0.3 MNIST FGSM 0.60 1.51 9.54 48.30 70.08 L.L.Class 0.70 6.15 13.52 36.64 53.47 BIM 0.96 4.15 26.92 74.60 90.33 MI-F...

    2017 arXiv

  12. [20]

    Adver- sarially robust generalization requires more data,

    L. Schmidt, S. Santurkar, D. Tsipras, K. Talwar, and A. Madry, “Adver- sarially robust generalization requires more data,” in Advances in Neural Information Processing Systems , 2018, pp. 5014–5026

    2018

  13. [21]

    Adversarial examples from computational constraints,

    S. Bubeck, E. Price, and I. Razenshteyn, “Adversarial examples from computational constraints,” arXiv preprint arXiv:1805.10204 , 2018

    2018 arXiv

  14. [22]

    Adversarial examples are not bugs, they are features,

    A. Ilyas, S. Santurkar, D. Tsipras, L. Engstrom, B. Tran, and A. Madry, “Adversarial examples are not bugs, they are features,” arXiv preprint arXiv:1905.02175, 2019

    1905 arXiv

  15. [23]

    Disentangling adversarial robust- ness and generalization,

    D. Stutz, M. Hein, and B. Schiele, “Disentangling adversarial robust- ness and generalization,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2019, pp. 6976–6987

    2019

  16. [24]

    Adversarial examples in the physical world,

    A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” arXiv preprint arXiv:1607.02533 , 2016

    2016 arXiv

  17. [25]

    Deepfool: a simple and accurate method to fool deep neural networks,

    S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “Deepfool: a simple and accurate method to fool deep neural networks,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2016, pp. 2574–2582

    2016

  18. [26]

    The limitations of deep learning in adversarial settings,

    N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in adversarial settings,” in 2016 IEEE European Symposium on Security and Privacy (EuroS&P) . IEEE, 2016, pp. 372–387

    2016

  19. [27]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in 2017 IEEE Symposium on Security and Privacy (SP) . IEEE, 2017, pp. 39–57

    2017

  20. [28]

    One pixel attack for fooling deep neural networks,

    J. Su, D. V . Vargas, and K. Sakurai, “One pixel attack for fooling deep neural networks,” IEEE Transactions on Evolutionary Computation , 2019

    2019

  21. [29]

    Ead: elastic- net attacks to deep neural networks via adversarial examples,

    P.-Y . Chen, Y . Sharma, H. Zhang, J. Yi, and C.-J. Hsieh, “Ead: elastic- net attacks to deep neural networks via adversarial examples,” in Thirty- second AAAI Conference on Artificial Intelligence , 2018

    2018

  22. [30]

    Improving transferability of adversarial examples with input diversity,

    C. Xie, Z. Zhang, Y . Zhou, S. Bai, J. Wang, Z. Ren, and A. L. Yuille, “Improving transferability of adversarial examples with input diversity,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2019, pp. 2730–2739

    2019

  23. [31]

    Semantic adversarial examples,

    H. Hosseini and R. Poovendran, “Semantic adversarial examples,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, 2018, pp. 1614–1619

    2018

  24. [32]

    Structure-preserving transforma- tion: Generating diverse and transferable adversarial examples,

    D. Peng, Z. Zheng, and X. Zhang, “Structure-preserving transforma- tion: Generating diverse and transferable adversarial examples,” arXiv preprint arXiv:1809.02786, 2018

    2018 arXiv

  25. [33]

    Distillation as a defense to adversarial perturbations against deep neural networks,

    N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in 2016 IEEE Symposium on Security and Privacy (SP) . IEEE, 2016, pp. 582–597

    2016

  26. [34]

    Ensemble selection from libraries of models,

    R. Caruana, A. Niculescu-Mizil, G. Crew, and A. Ksikes, “Ensemble selection from libraries of models,” in Proceedings of the Twenty-first International Conference on Machine Learning . ACM, 2004, p. 18

    2004

  27. [35]

    Dimensionality reduction as a defense against evasion attacks on machine learning classifiers,

    A. N. Bhagoji, D. Cullina, and P. Mittal, “Dimensionality reduction as a defense against evasion attacks on machine learning classifiers,” arXiv preprint arXiv:1704.02654, 2017

    2017 arXiv

  28. [36]

    Thermometer encoding: One hot way to resist adversarial examples,

    J. Buckman, A. Roy, C. Raffel, and I. Goodfellow, “Thermometer encoding: One hot way to resist adversarial examples,” 2018

    2018

  29. [37]

    Defense-gan: Protecting classifiers against adversarial attacks using generative models,

    P. Samangouei, M. Kabkab, and R. Chellappa, “Defense-gan: Protecting classifiers against adversarial attacks using generative models,” arXiv preprint arXiv:1805.06605, 2018

    2018 arXiv

  30. [38]

    Comdefend: An efficient image compression model to defend adversarial examples,

    X. Jia, X. Wei, X. Cao, and H. Foroosh, “Comdefend: An efficient image compression model to defend adversarial examples,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2019, pp. 6084–6092

    2019

  31. [39]

    Divide, denoise, and defend against adversarial attacks,

    S.-M. Moosavi-Dezfooli, A. Shrivastava, and O. Tuzel, “Divide, denoise, and defend against adversarial attacks,” arXiv preprint arXiv:1802.06806, 2018

    2018 arXiv

  32. [40]

    Image blind denoising with generative adversarial network based noise modeling,

    J. Chen, J. Chen, H. Chao, and M. Yang, “Image blind denoising with generative adversarial network based noise modeling,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2018, pp. 3155–3164

    2018

  33. [41]

    Deflecting adversarial attacks with pixel deflection,

    A. Prakash, N. Moran, S. Garber, A. DiLillo, and J. Storer, “Deflecting adversarial attacks with pixel deflection,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2018, pp. 8571–8580

    2018

  34. [42]

    Detecting adversarial samples from artifacts,

    R. Feinman, R. R. Curtin, S. Shintre, and A. B. Gardner, “Detecting adversarial samples from artifacts,” arXiv preprint arXiv:1703.00410 , 2017

    2017 arXiv

  35. [43]

    On the (statistical) detection of adversarial examples,

    K. Grosse, P. Manoharan, N. Papernot, M. Backes, and P. McDaniel, “On the (statistical) detection of adversarial examples,” arXiv preprint arXiv:1702.06280, 2017

    2017 arXiv

  36. [44]

    Characterizing adversar- 13 ial subspaces using local intrinsic dimensionality,

    X. Ma, B. Li, Y . Wang, S. M. Erfani, S. Wijewickrema, G. Schoenebeck, D. Song, M. E. Houle, and J. Bailey, “Characterizing adversar- 13 ial subspaces using local intrinsic dimensionality,” arXiv preprint arXiv:1801.02613, 2018

    2018 arXiv

  37. [45]

    Safetynet: Detecting and rejecting adversarial examples robustly,

    J. Lu, T. Issaranon, and D. Forsyth, “Safetynet: Detecting and rejecting adversarial examples robustly,” inProceedings of the IEEE International Conference on Computer Vision , 2017, pp. 446–454

    2017

  38. [46]

    Detecting adversarial image examples in deep neural networks with adaptive noise reduction,

    B. Liang, H. Li, M. Su, X. Li, W. Shi, and X. Wang, “Detecting adversarial image examples in deep neural networks with adaptive noise reduction,” IEEE Transactions on Dependable and Secure Computing , 2018

    2018

  39. [47]

    A simple unified framework for detecting out-of-distribution samples and adversarial attacks,

    K. Lee, K. Lee, H. Lee, and J. Shin, “A simple unified framework for detecting out-of-distribution samples and adversarial attacks,” in Advances in Neural Information Processing Systems , 2018, pp. 7167– 7177

    2018

  40. [48]

    S. J. Russell and P. Norvig, Artificial intelligence: a modern approach . Malaysia; Pearson Education Limited,, 2016

    2016

  41. [49]

    Optimization by simulated annealing,

    S. Kirkpatrick, C. D. Gelatt, and M. P. Vecchi, “Optimization by simulated annealing,” Science, vol. 220, no. 4598, pp. 671–680, 1983

    1983

  42. [50]

    A. P. Engelbrecht, Computational intelligence: an introduction . John Wiley & Sons, 2007

    2007

  43. [51]

    Technical report on the cleverhans v2.1.0 adversarial examples library,

    N. Papernot, F. Faghri, N. Carlini, I. Goodfellow, R. Feinman, A. Ku- rakin, C. Xie, Y . Sharma, T. Brown, A. Roy, A. Matyasko, V . Behzadan, K. Hambardzumyan, Z. Zhang, Y .-L. Juang, Z. Li, R. Sheatsley, A. Garg, J. Uesato, W. Gierke, Y . Dong, D. Berthelot, P. Hendricks, J. ...

    arXiv

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.