Pith. sign in

REVIEW 3 major objections 2 minor 88 references

Almost for Free: Crafting Adversarial Examples with Convolutional Image Filters

T0 review · 3 major / 2 minor · reviewed 2026-05-09 · grok-4.3

Challenge this review Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Optimized 3x3 convolutional filters based on edge detection can generate transferable adversarial examples using five orders of magnitude fewer parameters than generative models.

desk verdict Optimized 3x3 filters produce efficient untargeted adversarial examples with claimed transferability, but the no-retraining claim needs direct verification in the experiments. read the letter →

arxiv 2605.01098 v1 submitted 2026-05-01 cs.LG cs.CV

Alexander Warnecke , Konrad Rieck This is my paper · ORCID
classification cs.LGcs.CV
keywords adversarialexamplesconvolutionalfiltersedgedetectiontransferableattacksneuralnetworkvulnerabilityefficientmachinelearningsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper establishes that adversarial examples can be crafted by optimizing small convolutional filters drawn from classic edge detection methods rather than relying on gradients or large generative models. These filters produce untargeted attacks that transfer across different neural networks and require only a single pass over each input image. Experiments demonstrate success rates between 30 and 80 percent on various networks while drastically reducing the number of parameters needed. A sympathetic reader would care because this reveals a low-cost mechanism for exposing model weaknesses that links basic image processing to machine learning vulnerabilities.

What carries the argument

Adversarial image filters: small 3x3 convolutional kernels derived from edge detection algorithms and optimized to maximize model misclassification in one forward pass.

What would settle it

Applying the optimized filters to a new neural network architecture or a different dataset and measuring attack success rates that drop to the level of random guessing would falsify the transferability claim.

Watch

Extended reading notes

Core claim

Adversarial image filters are created by taking classic edge detection algorithms and optimizing their parameters specifically to deceive learning models. The resulting untargeted attacks transfer across models and require only a single pass over the input. With 3x3 filters, success rates reach 30 to 80 percent on different neural networks, and the approach reduces the number of parameters by five orders of magnitude compared to methods that use generative models.

Load-bearing premise

Filters optimized on a limited set of models and data will remain effective and transferable to unseen architectures and datasets without additional per-model tuning or retraining.

Editorial extensions

If this is right

  • Adversarial example generation becomes possible with only a single forward pass and no need for gradient computation or model queries during the attack.
  • Attacks can be performed with parameters reduced by five orders of magnitude relative to generative-model approaches, enabling very efficient execution.
  • Learned filters exhibit structures common to classic image filters, providing a direct link between standard image processing and model vulnerabilities.
  • High transferability between models allows attacks optimized on one network to succeed on others without retraining.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • This method could be tested on other data types such as audio or text to check whether similar low-parameter filter-based attacks exist outside images.
  • The filters might serve as a lightweight benchmark for measuring robustness across a wide range of models without requiring full retraining for each test.
  • If the approach scales, it could motivate new preprocessing defenses that detect or neutralize perturbations resembling optimized edge filters.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 2 minor

Summary. The paper proposes adversarial image filters: 3x3 convolutional kernels inspired by edge-detection algorithms but with weights optimized to maximize model misclassification. These filters generate untargeted adversarial examples via a single forward pass through the filter, claiming 30-80% success rates across neural networks, high transferability, and a five-order-of-magnitude reduction in parameters relative to generative-model attacks.

Significance. If the empirical claims are substantiated with proper optimization details, baselines, and cross-architecture transfer results, the work would demonstrate that extremely low-parameter structured perturbations can reliably fool deep networks. This would strengthen understanding of model fragility to simple, interpretable noise and offer a computationally cheap attack primitive that could inform both attack and defense research.

major comments (3)
  1. [§4] §4 (Experiments): the abstract states success rates of 30-80% but provides no information on the optimization procedure (loss function, surrogate models/datasets used to learn the filter weights, number of optimization steps, or whether a single filter set is used for all target models). Without these details the central efficiency and transferability claims cannot be evaluated.
  2. [§4.3] §4.3 (Transferability): the claim that the learned 3x3 filters exhibit 'high transferability between models' and require 'no per-model tuning' is load-bearing for the practical utility argument. The manuscript must report success rates when filters optimized on one architecture family (e.g., CNNs) are applied to held-out families (e.g., Vision Transformers) and on datasets disjoint from the optimization set; current evidence appears limited to the models used for filter learning.
  3. [Table 1] Table 1 / §4.1: the five-order-of-magnitude parameter reduction is compared only to generative-model baselines. The paper should also include simple non-learned baselines (random 3x3 filters, classic Sobel/Prewitt kernels, Gaussian noise of matched magnitude) to establish that the optimization step itself is responsible for the reported success rates rather than the filter structure alone.
minor comments (2)
  1. [Abstract / §3] The abstract and introduction use 'almost for free' and 'single pass' without clarifying that filter optimization itself requires gradient access or queries to surrogate models; this should be stated explicitly in the method section.
  2. [§3] Notation for the filter coefficients and the exact convolution operation applied to produce the adversarial image should be formalized with an equation in §3.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for the constructive feedback. The comments highlight important areas for improving the clarity, reproducibility, and strength of the empirical claims. We address each major comment below and will revise the manuscript to incorporate the requested details and comparisons.

read point-by-point responses

  1. Referee: [§4] §4 (Experiments): the abstract states success rates of 30-80% but provides no information on the optimization procedure (loss function, surrogate models/datasets used to learn the filter weights, number of optimization steps, or whether a single filter set is used for all target models). Without these details the central efficiency and transferability claims cannot be evaluated.

    Authors: We agree that these optimization details are essential for evaluating the claims. The current manuscript provides only a high-level description. In the revised version we will expand §4 with a dedicated paragraph (or subsection) that explicitly states the loss function, the surrogate models and datasets used to learn the filter weights, the number of optimization steps, and confirms that a single filter set is learned and applied to all target models without per-model retuning. revision: yes

  2. Referee: [§4.3] §4.3 (Transferability): the claim that the learned 3x3 filters exhibit 'high transferability between models' and require 'no per-model tuning' is load-bearing for the practical utility argument. The manuscript must report success rates when filters optimized on one architecture family (e.g., CNNs) are applied to held-out families (e.g., Vision Transformers) and on datasets disjoint from the optimization set; current evidence appears limited to the models used for filter learning.

    Authors: We acknowledge that transfer results are currently limited to the CNN architectures used during filter optimization. The manuscript already shows that the same 3x3 filter works across those models with no per-model tuning. To strengthen the claim we will add, in the revised §4.3, success rates obtained by applying the CNN-optimized filters to Vision Transformers and on a dataset partition held out from the optimization set. revision: yes

  3. Referee: [Table 1] Table 1 / §4.1: the five-order-of-magnitude parameter reduction is compared only to generative-model baselines. The paper should also include simple non-learned baselines (random 3x3 filters, classic Sobel/Prewitt kernels, Gaussian noise of matched magnitude) to establish that the optimization step itself is responsible for the reported success rates rather than the filter structure alone.

    Authors: We agree that non-learned baselines are needed to isolate the benefit of optimization. In the revised manuscript we will augment Table 1 and the §4.1 discussion with results for random 3x3 filters, the classic Sobel and Prewitt kernels, and Gaussian noise of matched magnitude. These additions will demonstrate that the learned filters outperform the unoptimized alternatives. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity in derivation chain

full rationale

The paper presents an empirical attack construction: 3x3 convolutional filters are explicitly optimized against model outputs to produce adversarial perturbations, with success rates measured directly on held-out models and datasets. No equations or first-principles derivations are offered that reduce to the optimization inputs by construction; the reported 30-80% success rates and five-order parameter reduction are comparative experimental outcomes, not fitted predictions renamed as results. No self-citation chains, uniqueness theorems, or ansatzes are invoked to justify the core method. The approach is self-contained against external benchmarks via direct measurement.

Assumptions & free parameters 1 free parameters · 1 assumptions · 0 invented entities

The central claim rests on the empirical observation that nine-parameter filters can be optimized to produce transferable adversarial effects; the only free parameters are the filter coefficients themselves.

free parameters (1)
  • 3x3 filter coefficients
    Nine scalar values per filter that are optimized to maximize model deception on chosen networks.
assumptions (1)
  • domain assumption Neural networks remain vulnerable to structured, low-parameter perturbations derived from image-processing primitives
    Invoked when the authors assume that edge-detection-inspired kernels can be tuned to produce effective attacks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Almost for Free: Crafting Adversarial Examples with Convolutional Image Filters." pith.science (2026). https://pith.science/paper/2605.01098

@misc{pith2026260501098,
  author       = {Pith},
  title        = {Pith review of: Almost for Free: Crafting Adversarial Examples with Convolutional Image Filters},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2605.01098}},
  note         = {Machine review of arXiv:2605.01098}
}
read the original abstract

Adversarial examples in machine learning are typically generated using gradients, obtained either directly through access to the model or approximated via queries to it. In this paper, we propose a much simpler approach to craft adversarial examples, drawing inspiration from insights of explainable machine learning. In particular, we design \emph{adversarial image filters} that are based on classic edge detection algorithms but optimized to deceive learning models. The resulting untargeted attacks are transferable and require only a single pass over the input. Empirically, we find that 3x3 filters already enable success rates between 30% and 80% on different neural networks. Compared to related approaches using generative models for crafting adversarial examples, we reduce the number of parameters by five orders of magnitude, resulting in a very efficient attack. When investigating the parameters of the learned filters, we observe interesting properties such as a high transferability between models and structures common to classic image filters. Our results provide further insights into the vulnerability of neural networks and their fragility to malicious noise.

Figures

Figures reproduced from arXiv: 2605.01098 by the authors.

Figure 1
Figure 1. Example of adversarial image filters. An input image (left) is perturbed using a convolutional filter (middle) to generate an adversarial example (right). In this paper, we deviate from this paradigm and propose adversarial image filters as a simple strategy for crafting adversarial examples. These filters deceive learning mod￾els through a single convolution and hence do not require the gradient information. Our ap… view at source ↗
Figure 2
Figure 2. Input images (top row) with LRP explanations (middle row) and edges (bottom row) detected by a Sobel filter [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Examples for spatial filters that can be convolved with an image to transform it in various ways. we can initialize the filters with random values and apply optimization schemes like SGD to solve the problem above. An example for a resulting filter is shown in [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Success rate of the edge filter attack for Sobel- and Laplacian-of-Gaussian (LoG) filter (left) and PSNR between origi￾nal image and the outcome of the attack (right). The dashed line indicate an attack where amplified Gaussian noise is added to the image such that the…
Figure 5
Figure 5. Figure 5: Outcome of the Sobel attack for different magnitudes µ. The classification result is based on a VGG-13 model and is shown under the images. The Gaussian noise is computed such that the success rate is equal to the Sobel attack. is clearly more prone to our attack, wher…
Figure 6
Figure 6. Figure 6: Success rate of the adaptive filter attack for different numbers of training examples and filter sizes. The PSNR is fixed to 20 for all models. 56 % with only 100 training examples. With 1 000 training examples, the success rate of the ResNet- and Inception model are i…
Figure 7
Figure 7. Figure 7: Resulting convolution filters of the adversarial filter attack after optimization with 2 000 training examples. VGG filters for channel one and three: The left and right neighbor pixels are subtracted from the current pixel with an (approximately) equal factor, resulti…
Figure 8
Figure 8. Figure 8: Perturbations after convolving inputs with the adversarial filters optimized on different models. Filter training model PSNR=20 PSNR=30 VGG ResNet Inception VGG ResNet Inception VGG 100% 102% 96% 100% 98% 102% ResNet 93% 100% 82% 50% 100% 51% Inception 86% 69% 100% 91%…
Figure 9
Figure 9. Figure 9: Adversarial examples resulting from the adversarial filter attack on the ResNet. Classification is given below the images. proach that allows creating highly imperceptible and highly effective adversarial examples with a fraction of parameters compared to the state of …
Figure 10
Figure 10. Figure 10: Adversarial filters of size 3 × 3 and a PSNR value of 20 for all models.       −0.97 0.34 0.63 −0.05 −0.23 0.53 −0.95 0.03 0.5 −0.09 0.71 0.0 −0.45 0.12 0.56 −0.38 0.6 0.36 −1.0 0.33 −0.04 −0.11 0.38 0.27 −0.8       Channel 1       0.04 0.29 −0.37 −0…
Figure 11
Figure 11. Figure 11: Adversarial filters of size 5 × 5 for a PSNR value of 20 for the ResNet architecture [PITH_FULL_IMAGE:figures/full_fig_p013_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

88 extracted references · 88 canonical work pages

  1. [1]

    ImageNet Classification with Deep Convolutional Neural Networks , author =

    work page

  2. [2]

    Very Deep Convolutional Networks for Large-Scale Image Recognition , booktitle = iclr, year =

    Karen Simonyan and Andrew Zisserman , @editor =. Very Deep Convolutional Networks for Large-Scale Image Recognition , booktitle = iclr, year =

    work page

  3. [3]

    , author =

    Towards Evaluating the Robustness of Neural Networks. , author =

    work page

  4. [4]

    Goodfellow and Rob Fergus , title =

    Christian Szegedy and Wojciech Zaremba and Ilya Sutskever and Joan Bruna and Dumitru Erhan and Ian J. Goodfellow and Rob Fergus , title =. 2014 , @url =

    work page 2014

  5. [5]

    Goodfellow and Jonathon Shlens and Christian Szegedy , title =

    Ian J. Goodfellow and Jonathon Shlens and Christian Szegedy , title =. 2015 , @url =

    work page 2015

  6. [6]

    2018 , @url =

    Andrew Ilyas and Logan Engstrom and Anish Athalye and Jessy Lin , title =. 2018 , @url =

    work page 2018

  7. [7]

    Gardner and Yurong You and Andrew Gordon Wilson and Kilian Q

    Chuan Guo and Jacob R. Gardner and Yurong You and Andrew Gordon Wilson and Kilian Q. Weinberger , @editor =. Simple Black-box Adversarial Attacks , booktitle = icml, @series =. 2019 , @url =

    work page 2019

  8. [8]

    2017 , pages =

    ZOO: Zeroth Order Optimization Based Black-box Attacks to Deep Neural Networks without Training Substitute Models , author=. 2017 , pages =

    work page 2017

Show all 88 references
  1. [9]

    2016 , pages=

    Universal Adversarial Perturbations , author=. 2016 , pages=

    2016

  2. [10]

    2021 , pages =

    Learning Transferable Adversarial Perturbations , author=. 2021 , pages =

    2021

  3. [11]

    Xiao, Chaowei and Li, Bo and Zhu, Jun-Yan and He, Warren and Liu, Mingyan and Song, Dawn , title =. Proc. of the International Joint Conference on Artificial Intelligence , pages =. 2018 , @isbn =

    2018

  4. [12]

    Marco Ancona and Enea Ceolini and Cengiz

  5. [13]

    2018 , pages=

    Sanity Checks for Saliency Maps , author=. 2018 , pages=

    2018

  6. [14]

    Kaiming He and Xiangyu Zhang and Shaoqing Ren and Jian Sun , booktitle = cvpr, pages =

  7. [15]

    2016 , volume=

    Szegedy, Christian and Vanhoucke, Vincent and Ioffe, Sergey and Shlens, Jon and Wojna, Zbigniew , booktitle=cvpr, title=. 2016 , volume=

    2016

  8. [16]

    , title=

    Sun, Rui and Lei, Tao and Chen, Qi and Wang, Zexuan and Du, Xiaogang and Zhao, Weiqiang and Nandi, Asoke K. , title=. Frontiers in Signal Processing , volume=

  9. [17]

    2009 IEEE conference on computer vision and pattern recognition , pages=

    Imagenet: A large-scale hierarchical image database , author=. 2009 IEEE conference on computer vision and pattern recognition , pages=. 2009 , organization=

    2009

  10. [18]

    2019 , pages =

    Do ImageNet Classifiers Generalize to ImageNet? , author=. 2019 , pages =

    2019

  11. [19]

    2017 , pages=

    Generative Adversarial Perturbations , author=. 2017 , pages=

    2017

  12. [20]

    Learning to Attack: Adversarial Transformation Networks , volume=

    Baluja, Shumeet and Fischer, Ian , pages =. Learning to Attack: Adversarial Transformation Networks , volume=. doi:10.1609/aaai.v32i1.11672 , @number=

    doi

  13. [21]

    On Pixel-Wise Explanations for Non-Linear Classifier Decisions by Layer-Wise Relevance Propagation , journal =

    Sebastian Bach and Alexander Binder and Grégoire Montavon and Frederick Klauschen and Klaus-Robert M. On Pixel-Wise Explanations for Non-Linear Classifier Decisions by Layer-Wise Relevance Propagation , journal =

  14. [22]

    Niels J. S. M. Visualization of neural networks using saliency maps , booktitle =. 1995 , @url =. doi:10.1109/ICNN.1995.488997 , timestamp =

    1995 doi

  15. [23]

    Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Maps , Author =

  16. [24]

    Axiomatic Attribution for Deep Networks , author =. Proc. of International Conference on Machine Learning (ICML) , pages =

  17. [25]

    Prewitt, J. M. S. Object enhancement and extraction. Picture Processing and. Psychopictorics. 1970

    1970

  18. [26]

    Scharr, Hanno , year =

  19. [27]

    Image Segmentation using Extended Edge Operator for Mammographic Images , volume =

    Kekre, Hemant and Gharge, Saylee , year =. Image Segmentation using Extended Edge Operator for Mammographic Images , volume =

  20. [28]

    A 3×3 isotropic gradient operator for image processing , journal =

    Sobel, Irwin and Feldman, Gary , year =. A 3×3 isotropic gradient operator for image processing , journal =

  21. [30]

    2016 , pages =

    Practical Black-Box Attacks against Machine Learning , author=. 2016 , pages =

    2016

  22. [31]

    Berkay Celik and Ananthram Swami , title =

    Nicolas Papernot and Patrick McDaniel and Somesh Jha and Matt Fredrikson and Z. Berkay Celik and Ananthram Swami , title =

  23. [32]

    Moosavi-Dezfooli, Seyed-Mohsen and Fawzi, Alhussein and Frossard, Pascal , title =

  24. [33]

    Andrew Ilyas and Logan Engstrom and Aleksander Madry , title =

  25. [34]

    2019 , pages=

    HopSkipJumpAttack: A Query-Efficient Decision-Based Attack , author=. 2019 , pages=

    2019

  26. [35]

    International Conference on Learning Representations (ICLR) , @publisher =

    Wieland Brendel and Jonas Rauber and Matthias Bethge , title =. International Conference on Learning Representations (ICLR) , @publisher =. 2018 , biburl =

    2018

  27. [36]

    Generative Adversarial Nets , year =

    Goodfellow, Ian and Pouget-Abadie, Jean and Mirza, Mehdi and Xu, Bing and Warde-Farley, David and Ozair, Sherjil and Courville, Aaron and Bengio, Yoshua , booktitle = nips, pages=. Generative Adversarial Nets , year =

  28. [37]

    2018 , @url =

    Aleksander Madry and Aleksandar Makelov and Ludwig Schmidt and Dimitris Tsipras and Adrian Vladu , title =. 2018 , @url =

    2018

  29. [38]

    2019 , @url=

    Adversarial Training for Free! , author=. 2019 , @url=

    2019

  30. [39]

    The Space of Transferable Adversarial Examples , journal =

    Florian Tram. The Space of Transferable Adversarial Examples , journal =

  31. [40]

    , booktitle=

    Agarwal, Akshay and Vatsa, Mayank and Singh, Richa and Ratha, Nalini K. , booktitle=. Noise is Inside Me! Generating Adversarial Perturbations with Noise Derived from Natural Filters , year=

  32. [41]

    Crafting Adversarial Perturbations via Transformed Image Component Swapping , year=

    Agarwal, Akshay and Ratha, Nalini and Vatsa, Mayank and Singh, Richa , journal=. Crafting Adversarial Perturbations via Transformed Image Component Swapping , year=

  33. [42]

    Edgefool: an Adversarial Image Enhancement Filter , year=

    Shamsabadi, Ali Shahin and Oh, Changjae and Cavallaro, Andrea , booktitle=. Edgefool: an Adversarial Image Enhancement Filter , year=

  34. [44]

    2023 , eprint=

    Don't Look into the Sun: Adversarial Solarization Attacks on Image Classifiers , author=. 2023 , eprint=

    2023

  35. [46]

    Zeiler and Rob Fergus , title =

    Matthew D. Zeiler and Rob Fergus , title =. Proceedings of the European Conference on Computer Vision (ECCV) , volume =. 2014 , url =

    2014

  36. [47]

    Proceedings of the International Conference on Learning Representations 2018 , year=

    ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness , author=. Proceedings of the International Conference on Learning Representations 2018 , year=

    2018

  37. [48]

    Watch out! Motion is Blurring the Vision of Your Deep Neural Networks , url =

    Guo, Qing and Juefei-Xu, Felix and Xie, Xiaofei and Ma, Lei and Wang, Jian and Yu, Bing and Feng, Wei and Liu, Yang , booktitle =. Watch out! Motion is Blurring the Vision of Your Deep Neural Networks , url =

  38. [49]

    J., Hardt, M., and Kim, B

    Adebayo, J., Gilmer, J., Muelly, M., Goodfellow, I. J., Hardt, M., and Kim, B. Sanity checks for saliency maps. In Advances in Neural Information Proccessing Systems ( NIPS ) , pp.\ 9505--9515, 2018

    2018

  39. [50]

    Agarwal, A., Vatsa, M., Singh, R., and Ratha, N. K. Noise is inside me! generating adversarial perturbations with noise derived from natural filters. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp.\ 3354--3363, 2020. doi:10.1109/CV...

    2020 doi

  40. [51]

    Towards better understanding of gradient-based attribution methods for deep neural networks

    Ancona, M., Ceolini, E., \" O ztireli, C., and Gross, M. Towards better understanding of gradient-based attribution methods for deep neural networks. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2018

    2018

  41. [52]

    On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation

    Bach, S., Binder, A., Montavon, G., Klauschen, F., M \"u ller, K.-R., and Samek, W. On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation. PLoS ONE, 10 0 (7), July 2015

    2015

  42. [53]

    and Fischer, I

    Baluja, S. and Fischer, I. Learning to attack: Adversarial transformation networks. In Proc. of the AAAI Conference on Artificial Intelligence (AAAI) , volume 32, pp.\ 2687--2695, 2018

    2018

  43. [54]

    Decision-based adversarial attacks: Reliable attacks against black-box machine learning models

    Brendel, W., Rauber, J., and Bethge, M. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In International Conference on Learning Representations (ICLR), 2018

    2018

  44. [55]

    and Wagner, D

    Carlini, N. and Wagner, D. A. Towards evaluating the robustness of neural networks. In Proc. of the IEEE Symposium on Security and Privacy (S&P) , pp.\ 39--57, 2017

    2017

  45. [56]

    and Jordan, M

    Chen, J. and Jordan, M. I. Hopskipjumpattack: A query-efficient decision-based attack. pp.\ 1277--1294, 2019

    2019

  46. [57]

    Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models

    Chen, P.-Y., Zhang, H., Sharma, Y., Yi, J., and Hsieh, C.-J. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. Proc. of ACM Workshop on Artificial Intelligence and Security ( AISEC ) , pp.\ 15--26, 2017

    2017

  47. [58]

    Intriguing properties of adversarial examples

    Cubuk, E., Zoph, B., Schoenholz, S., and Le, Q. Intriguing properties of adversarial examples. arXiv:1711.02846, 11 2017

    2017

  48. [59]

    Evading black-box classifiers without breaking eggs

    Debenedetti, E., Carlini, N., and Tramer, F. Evading black-box classifiers without breaking eggs. In 2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pp.\ 408--424, apr 2024. doi:10.1109/SaTML59370.2024.00027. URL https://doi.ieeecomputersociety.org/10....

    2024 doi

  49. [60]

    Imagenet: A large-scale hierarchical image database

    Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp.\ 248--255. Ieee, 2009

    2009

  50. [61]

    Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness

    Geirhos, R., Rubisch, P., Michaelis, C., Bethge, M., Wichmann, F., and Brendel, W. Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness. In Proceedings of the International Conference on Learning Representations 2018, volume ...

    2018

  51. [62]

    Generative adversarial nets

    Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y. Generative adversarial nets. In Advances in Neural Information Proccessing Systems ( NIPS ) , pp.\ 2672--2680, 2014

    2014

  52. [63]

    J., Shlens, J., and Szegedy, C

    Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2015

    2015

  53. [64]

    R., You, Y., Wilson, A

    Guo, C., Gardner, J. R., You, Y., Wilson, A. G., and Weinberger, K. Q. Simple black-box adversarial attacks. In Proc. of the International Conference on Machine Learning ( ICML ) , volume 97, pp.\ 2484--2493, 2019

    2019

  54. [65]

    Watch out! motion is blurring the vision of your deep neural networks

    Guo, Q., Juefei-Xu, F., Xie, X., Ma, L., Wang, J., Yu, B., Feng, W., and Liu, Y. Watch out! motion is blurring the vision of your deep neural networks. In Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M., and Lin, H. (eds.), Advances in Neural Information Processing System...

    2020

  55. [66]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Proc. of the International Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 770--778, 2016

    2016

  56. [67]

    Edge enhancement improves adversarial robustness in image classification

    He, L., Ai, Q., Lei, Y., Pan, L., Ren, Y., and Xu, Z. Edge enhancement improves adversarial robustness in image classification. Neurocomputing, 518: 0 122--132, 2023. ISSN 0925-2312. doi:https://doi.org/10.1016/j.neucom.2022.10.059. URL https://www.sciencedirect.com/science/ar...

    2023 doi

  57. [68]

    Black-box adversarial attacks with limited queries and information

    Ilyas, A., Engstrom, L., Athalye, A., and Lin, J. Black-box adversarial attacks with limited queries and information. In Proc. of the International Conference on Machine Learning ( ICML ) , pp.\ 2142--2151, 2018

    2018

  58. [69]

    Prior convictions: Black-box adversarial attacks with bandits and priors

    Ilyas, A., Engstrom, L., and Madry, A. Prior convictions: Black-box adversarial attacks with bandits and priors. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2019

    2019

  59. [70]

    and Gharge, S

    Kekre, H. and Gharge, S. Image segmentation using extended edge operator for mammographic images. International Journal on Computer Science and Engineering, 2, 07 2010

    2010

  60. [71]

    Krizhevsky, A., Sutskever, I., and Hinton, G. E. Imagenet classification with deep convolutional neural networks. In Advances in Neural Information Proccessing Systems ( NIPS ) , pp.\ 1106--1114. Curran Associates, Inc., 2012

    2012

  61. [72]

    Towards deep learning models resistant to adversarial attacks

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2018

    2018

  62. [73]

    Universal adversarial perturbations

    Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., and Frossard, P. Universal adversarial perturbations. Proc. of the International Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 86--94, 2016 a

    2016

  63. [74]

    Deepfool: A simple and accurate method to fool deep neural networks

    Moosavi-Dezfooli, S.-M., Fawzi, A., and Frossard, P. Deepfool: A simple and accurate method to fool deep neural networks. In Proc. of the International Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 2574--2582, June 2016 b

    2016

  64. [75]

    Nakka, K. K. and Salzmann, M. Learning transferable adversarial perturbations. In Advances in Neural Information Proccessing Systems ( NIPS ) , pp.\ 13950--13962, 2021

    2021

  65. [76]

    J., Jha, S., Celik, Z

    Papernot, N., Mcdaniel, P., Goodfellow, I. J., Jha, S., Celik, Z. B., and Swami, A. Practical black-box attacks against machine learning. Proc. of the ACM Asia Conference on Computer and Communications Security ( ASIA CCS ) , pp.\ 506--519, 2016 a

    2016

  66. [77]

    B., and Swami, A

    Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., and Swami, A. The limitations of deep learning in adversarial settings. In Proc. of the IEEE European Symposium on Security and Privacy ( EuroS&P ) , pp.\ 372--387, 2016 b

    2016

  67. [78]

    Poursaeed, O., Katsman, I., Gao, B., and Belongie, S. J. Generative adversarial perturbations. Proc. of the International Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 4422--4431, 2017

    2017

  68. [79]

    Prewitt, J. M. S. Object enhancement and extraction. Picture Processing and. Psychopictorics, 1970

    1970

  69. [80]

    Do imagenet classifiers generalize to imagenet? In Proc

    Recht, B., Roelofs, R., Schmidt, L., and Shankar, V. Do imagenet classifiers generalize to imagenet? In Proc. of the International Conference on Machine Learning ( ICML ) , pp.\ 5389--5400, 2019

    2019

  70. [81]

    Optimal operators in digital image processing [Elektronische Ressource] /

    Scharr, H. Optimal operators in digital image processing [Elektronische Ressource] /. PhD thesis, 09 2014

    2014

  71. [82]

    P., Studer, C., Davis, L

    Shafahi, A., Najibi, M., Ghiasi, A., Xu, Z., Dickerson, J. P., Studer, C., Davis, L. S., Taylor, G., and Goldstein, T. Adversarial training for free! In Advances in Neural Information Proccessing Systems ( NIPS ) , pp.\ 3353--3364, 2019

    2019

  72. [83]

    S., Oh, C., and Cavallaro, A

    Shamsabadi, A. S., Oh, C., and Cavallaro, A. Edgefool: an adversarial image enhancement filter. In ICASSP 2020 - 2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp.\ 1898--1902, 2020. doi:10.1109/ICASSP40776.2020.9054368

    2020 doi

  73. [84]

    and Zisserman, A

    Simonyan, K. and Zisserman, A. Very deep convolutional networks for large-scale image recognition. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2015

    2015

  74. [85]

    and Feldman, G

    Sobel, I. and Feldman, G. A 3×3 isotropic gradient operator for image processing. Pattern Classification and Scene Analysis, pp.\ 271--272, 01 1973

    1973

  75. [86]

    Sun, R., Lei, T., Chen, Q., Wang, Z., Du, X., Zhao, W., and Nandi, A. K. Survey of image edge detection. Frontiers in Signal Processing, 2, 2022

    2022

  76. [87]

    Axiomatic attribution for deep networks

    Sundararajan, M., Taly, A., and Yan, Q. Axiomatic attribution for deep networks. In Proc. of International Conference on Machine Learning (ICML), pp.\ 3319--3328, 2017

    2017

  77. [88]

    J., and Fergus, R

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I. J., and Fergus, R. Intriguing properties of neural networks. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2014

    2014

  78. [89]

    Rethinking the inception architecture for computer vision

    Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., and Wojna, Z. Rethinking the inception architecture for computer vision. In Proc. of the International Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 2818--2826, 2016

    2016

  79. [90]

    J., Boneh, D., and McDaniel, P

    Tram \` e r, F., Papernot, N., Goodfellow, I. J., Boneh, D., and McDaniel, P. D. The space of transferable adversarial examples. arxiv:1704.03453, 2017

    2017

  80. [91]

    Generating adversarial examples with adversarial networks

    Xiao, C., Li, B., Zhu, J.-Y., He, W., Liu, M., and Song, D. Generating adversarial examples with adversarial networks. In Proc. of the International Joint Conference on Artificial Intelligence, pp.\ 3905–3911, 2018

    2018

Pith tools

Reviewed May 9, 2026 · model on record in the stance chip above.