Pith. sign in

REVIEW 5 cited by

One pixel attack for fooling deep neural networks

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 1710.08864 v7 pith:M5HWWKEG submitted 2017-10-24 cs.LG cs.CVstat.ML

Jiawei Su , Danilo Vasconcellos Vargas , Sakurai Kouichi This is my paper · ORCID
classification cs.LGcs.CVstat.ML
keywords adversarialattacknetworksneuralpixelattackscifar-10dataset
verification ladder T0 review T1 audit T2 compute T3 formal

Signed reviews

No signed human review yet.

0 comments
read the original abstract

Recent research has revealed that the output of Deep Neural Networks (DNN) can be easily altered by adding relatively small perturbations to the input vector. In this paper, we analyze an attack in an extremely limited scenario where only one pixel can be modified. For that we propose a novel method for generating one-pixel adversarial perturbations based on differential evolution (DE). It requires less adversarial information (a black-box attack) and can fool more types of networks due to the inherent features of DE. The results show that 67.97% of the natural images in Kaggle CIFAR-10 test dataset and 16.04% of the ImageNet (ILSVRC 2012) test images can be perturbed to at least one target class by modifying just one pixel with 74.03% and 22.91% confidence on average. We also show the same vulnerability on the original CIFAR-10 dataset. Thus, the proposed attack explores a different take on adversarial machine learning in an extreme limited scenario, showing that current DNNs are also vulnerable to such low dimension attacks. Besides, we also illustrate an important application of DE (or broadly speaking, evolutionary computation) in the domain of adversarial machine learning: creating tools that can effectively generate low-cost adversarial attacks against neural networks for evaluating robustness.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 5 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Reliable Evaluation of Attribution Maps in CNNs: A Perturbation-Based Approach

    cs.CV 2024-11 conditional novelty 6.0 of 10

    A perturbation-based metric using FGSM flips of ±1/255 instead of zero-masking gives more consistent and monotonic evaluation of attribution maps across 15 CNN-dataset pairs, with SmoothGrad ranked first.

  2. Adversarial Edit Attacks for Tree Data

    cs.LG 2019-08 conditional novelty 6.0 of 10

    A black-box adversarial attack for tree data using tree edit distance and binary search along the shortest edit path to a differently labeled reference tree.

  3. AdvHat: Real-world adversarial attack on ArcFace Face ID system

    cs.CV 2019-08 conditional novelty 6.0 of 10

    A printable hat sticker, optimized with an off-plane bending transformation, reduces ArcFace face-ID similarity enough to dodge recognition in real-world photos.

  4. A principled approach for generating adversarial images under non-smooth dissimilarity metrics

    cs.LG 2019-08 conditional novelty 6.0 of 10

    ProxLogBarrier extends the LogBarrier adversarial attack to non-smooth metrics via proximal gradient, achieving state-of-the-art ℓ0 perturbation results.

  5. On the Complexity-Faithfulness Trade-off of Gradient-Based Explanations

    cs.LG 2025-08 reject novelty 4.0 of 10

    The paper introduces EF and ΔEF as spectral metrics, but ΔEF is derived from EF, making the complexity-faithfulness trade-off partly tautological.

Pith tools