--- title: "Explaining and Harnessing Adversarial — Goodfellow 2014" description: "Classifiers, including state-of-the-art neural networks, can be pushed into confident errors by tiny input changes chosen to do the most damage." authors: ["Ian J. Goodfellow", "Jonathon Shlens", "Christian Szegedy"] year: 2014 venue: "arXiv:1412.6572" source: "https://arxiv.org/abs/1412.6572" doi: "10.48550/arxiv.1412.6572" arxiv: "1412.6572" licence: "arXiv — non-exclusive licence to distribute" licence_url: "http://arxiv.org/licenses/nonexclusive-distrib/1.0/" summary_licence: "Elamur Cosmic License" canonical: "https://research.elamur.ai/free/en/papers/goodfellow-2014-explaining-harnessing-adversarial-examples/" --- [Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/goodfellow-2014-explaining-harnessing-adversarial-examples/) [home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2014](https://md.research.elamur.ai/free/en/papers/2014/) / Explaining and Harnessing Adversarial Examples # Explaining and Harnessing Adversarial Examples **Authors:** Ian J. Goodfellow, [Jonathon Shlens](https://md.research.elamur.ai/free/en/authors/jonathon-shlens/), [Christian Szegedy](https://md.research.elamur.ai/free/en/authors/christian-szegedy/) · **Year:** 2014 · **Venue:** arXiv:1412.6572 · **Licence:** [arXiv — non-exclusive licence to distribute](http://arxiv.org/licenses/nonexclusive-distrib/1.0/) **Links:** [Publisher's page](https://arxiv.org/abs/1412.6572) · [PDF](https://arxiv.org/pdf/1412.6572) · [DOI 10.48550/arxiv.1412.6572](https://doi.org/10.48550/arxiv.1412.6572) · [arXiv 1412.6572](https://arxiv.org/abs/1412.6572) · [OpenAlex](https://openalex.org/W1945616565) **Citations:** 7858 citations (openalex-snapshot · 2026-10-14) · [572](#cited-by) in our library, of the 140673 papers whose bibliographies we read ## Summary Classifiers, including state-of-the-art neural networks, can be pushed into confident errors by tiny input changes chosen to do the most damage. Earlier work blamed this on the strong nonlinearity or overfitting of deep models. Goodfellow, Shlens and Szegedy argue that the main cause is the opposite: linear behaviour in high-dimensional input spaces. Each feature can change by less than the sensor's precision, but across thousands of dimensions those changes add up to a large shift in a unit's activation. Components such as ReLUs, LSTMs and maxout units are built to act almost linearly so they are easier to optimize, and that is why they inherit the weakness. The same reasoning explains why adversarial examples transfer between architectures and training sets. The authors then derive the fast gradient sign method (FGSM), which needs only one backpropagation pass. They test it on MNIST, CIFAR-10 and ImageNet and use it to make adversarial training cheap enough to be practical. Adversarial training of a maxout network lowered its MNIST test error. The paper became a foundation of adversarial-robustness research. ## Key points - **FGSM:** the perturbation is η = ε·sign(∇ₓJ(θ, x, y)). For logistic regression this is the exact worst case. With ε = 0.007, GoogLeNet's label for a panda image changes to "gibbon" at 99.3% confidence. - **Attack strength:** on MNIST with ε = 0.25, a shallow softmax classifier reaches 99.9% error (79.3% average confidence) and a maxout network 89.4% error (97.6% confidence). On CIFAR-10 with ε = 0.1, a convolutional maxout network reaches 87.15% error. - **Adversarial training vs. weight decay:** for logistic regression, adversarial training acts like an L1 penalty that is subtracted from the activation rather than added to the cost. It therefore fades once the model's margins are large, while L1 weight decay stays more pessimistic. Adversarial training adds regularization on top of dropout. Dropout, pretraining and model averaging do little for robustness, whereas RBF networks resist these perturbations. - **Rubbish inputs:** on 10,000 Gaussian-noise samples from N(0, I₇₈₄), a maxout+softmax MNIST model makes 98.35% errors, softmax regression 59.8% and an RBF network 0%. - **Class-targeted fooling images:** on CIFAR-10 the gradient-based method succeeds on 75.3% of steps on average. Airplanes are the hardest class at 24.7%. *Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.* Fields: [Other](https://md.research.elamur.ai/free/en/shelves/other/) ## Cited by Cited by 572 papers of our library cite it (of the 140673 whose bibliographies we read); 42 of them have a page here, 530 not yet. - [Detecting Language Model Attacks with Perplexity](https://md.research.elamur.ai/free/en/papers/alon-2023-detecting-language-model-attacks-perplexity/) - [Generating Natural Language Adversarial Examples](https://md.research.elamur.ai/free/en/papers/alzantot-2018-generating-natural-language-adversarial-examples/) - [Concrete Problems in AI Safety](https://md.research.elamur.ai/free/en/papers/amodei-2016-concrete-problems-ai-safety/) - [Analysis Methods in Neural Language Processing: A Survey](https://md.research.elamur.ai/free/en/papers/belinkov-2019-analysis-methods-neural-language-processing/) - [Don't Take the Premise for Granted: Mitigating Artifacts in Natural Language Inference](https://md.research.elamur.ai/free/en/papers/belinkov-2019-don-t-take-premise-granted/) - [Language ID in the Wild: Unexpected Challenges on the Path to a Thousand-Language Web Text Corpus](https://md.research.elamur.ai/free/en/papers/caswell-2020-language-id-wild-unexpected/) - [Jailbreaking Black Box Large Language Models in Twenty Queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/) - [Dipping PLMs Sauce: Bridging Structure and Text for Effective Knowledge Graph Completion via Conditional Soft Prompting](https://md.research.elamur.ai/free/en/papers/chen-2023-dipping-plms-sauce-bridging-structure/) - [HotFlip: White-Box Adversarial Examples for Text Classification](https://md.research.elamur.ai/free/en/papers/ebrahimi-2018-hotflip-white-box-adversarial-examples/) - [A Closer Look into the Robustness of Neural Dependency Parsers Using Better Adversarial Examples](https://md.research.elamur.ai/free/en/papers/findings-2021-wang-closer-look-into-robustness-neural/) - [Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifiers](https://md.research.elamur.ai/free/en/papers/gao-2018-black-box-generation-adversarial-text/) - [BAE: BERT-based Adversarial Examples for Text Classification](https://md.research.elamur.ai/free/en/papers/garg-2020-bae-bert-based-adversarial-examples/) - [Aligning AI With Shared Human Values](https://md.research.elamur.ai/free/en/papers/hendrycks-2020-aligning-ai-shared-human-values/) - [Adversarial Example Generation with Syntactically Controlled Paraphrase Networks](https://md.research.elamur.ai/free/en/papers/iyyer-2018-adversarial-example-generation-syntactically-controlled/) - [Baseline Defenses for Adversarial Attacks Against Aligned Language Models](https://md.research.elamur.ai/free/en/papers/jain-2023-baseline-defenses-adversarial-attacks-against/) - [Adversarial Examples for Evaluating Reading Comprehension Systems](https://md.research.elamur.ai/free/en/papers/jia-2017-adversarial-examples-evaluating-reading-comprehension/) - [Certified Robustness to Adversarial Word Substitutions](https://md.research.elamur.ai/free/en/papers/jia-2019-certified-robustness-adversarial-word-substitutions/) - [Understanding Black-box Predictions via Influence Functions](https://md.research.elamur.ai/free/en/papers/koh-2017-understanding-black-box-predictions-influence/) - [TextBugger: Generating Adversarial Text Against Real-world Applications](https://md.research.elamur.ai/free/en/papers/li-2018-textbugger-generating-adversarial-text-against/) - [BERT-ATTACK: Adversarial Attack Against BERT Using BERT](https://md.research.elamur.ai/free/en/papers/li-2020-bert-attack-adversarial-attack-against/) - [Towards Deep Learning Models Resistant to Adversarial Attacks](https://md.research.elamur.ai/free/en/papers/madry-2017-towards-deep-learning-models-resistant/) - [A Holistic Approach to Undesired Content Detection in the Real World](https://md.research.elamur.ai/free/en/papers/markov-2022-holistic-approach-undesired-content-detection/) - [Tree of Attacks: Jailbreaking Black-Box LLMs Automatically](https://md.research.elamur.ai/free/en/papers/mehrotra-2023-tree-attacks-jailbreaking-black-box/) - [Adversarial Training Methods for Semi-Supervised Text Classification](https://md.research.elamur.ai/free/en/papers/miyato-2016-adversarial-training-methods-semi-supervised/) - [Domain Robustness in Neural Machine Translation](https://md.research.elamur.ai/free/en/papers/muller-2020-domain-robustness-neural-machine-translation/) - [Red Teaming Language Models with Language Models](https://md.research.elamur.ai/free/en/papers/perez-2022-red-teaming-language-models-language/) - [Combating Adversarial Misspellings with Robust Word Recognition](https://md.research.elamur.ai/free/en/papers/pruthi-2019-combating-adversarial-misspellings-robust-word/) - [Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer](https://md.research.elamur.ai/free/en/papers/qi-2021-mind-style-text-adversarial-backdoor/) - [Learning Transferable Visual Models From Natural Language Supervision](https://md.research.elamur.ai/free/en/papers/radford-2021-learning-transferable-visual-models-natural/) - [Generating Natural Language Adversarial Examples through Probability Weighted Word Saliency](https://md.research.elamur.ai/free/en/papers/ren-2019-generating-natural-language-adversarial-examples/) - [SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks](https://md.research.elamur.ai/free/en/papers/robey-2023-smoothllm-defending-large-language-models/) - [Can AI-Generated Text be Reliably Detected?](https://md.research.elamur.ai/free/en/papers/sadasivan-2023-ai-generated-text-reliably-detected/) - [Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localization](https://md.research.elamur.ai/free/en/papers/selvaraju-2016-grad-cam-visual-explanations-deep/) - [The Rise and Potential of Large Language Model Based Agents: A Survey](https://md.research.elamur.ai/free/en/papers/xi-2023-rise-potential-large-language/) - [ConSERT: A Contrastive Framework for Self-Supervised Sentence Representation Transfer](https://md.research.elamur.ai/free/en/papers/yan-2021-consert-contrastive-framework-self-supervised/) - [Word-level Textual Adversarial Attacking as Combinatorial Optimization](https://md.research.elamur.ai/free/en/papers/zang-2020-word-level-textual-adversarial-attacking/) - [mixup: Beyond Empirical Risk Minimization](https://md.research.elamur.ai/free/en/papers/zhang-2017-mixup-empirical-risk-minimization/) - [中文对抗攻击下的ChatGPT鲁棒性评估](https://md.research.elamur.ai/free/en/papers/zhang-2025-robustness-evaluation-chatgpt/) - [Evaluating and Enhancing the Robustness of Neural Network-based Dependency Parsing Models with Adversarial Examples](https://md.research.elamur.ai/free/en/papers/zheng-2020-evaluating-enhancing-robustness-neural-network/) - [FreeLB: Enhanced Adversarial Training for Natural Language Understanding](https://md.research.elamur.ai/free/en/papers/zhu-2019-freelb-enhanced-adversarial-training-natural/) - [PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Prompts](https://md.research.elamur.ai/free/en/papers/zhu-2023-promptrobust-towards-evaluating-robustness-large/) - [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/) ## Cite The paper itself, not this page. BibTeX from the library's record of the work. ```bibtex @misc{goodfellow2014explaining, title = {{Explaining and Harnessing Adversarial Examples}}, author = {Goodfellow, Ian J. and Shlens, Jonathon and Szegedy, Christian}, year = {2014}, doi = {10.48550/arxiv.1412.6572}, eprint = {1412.6572}, archivePrefix = {arXiv}, url = {https://doi.org/10.48550/arxiv.1412.6572} } ``` - [← previous Evaluating Lemmatization Models for Machine-Assisted Corpus-Dictionary Linkage](https://md.research.elamur.ai/free/en/papers/lingbulk-2014-black-evaluating-lemmatization-models-machine-assisted/) - [next → Exploring Compositional Architectures and Word Vector Representations for Prepositional Phrase Attachment](https://md.research.elamur.ai/free/en/papers/tacl-2014-belinkov-exploring-compositional-architectures-word-vector/) - [↑ back to papers of 2014](https://md.research.elamur.ai/free/en/papers/2014/) ## References 19 references, 1 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet. 1. Bastien, Frédéric, Lamblin, Pascal, Pascanu, Razvan, Bergstra, James, Goodfellow, Ian J., Bergeron, Arnaud, Bouchard, Nicolas, and Bengio, Yoshua. Theano: new features and speed improvements. Deep Learning and Unsupervised Feature Learning NIPS 2012 Workshop, 2012. [find](https://scholar.google.com/scholar?q=Bastien%2C+Fre%CC%81de%CC%81ric%2C+Lamblin%2C+Pascal%2C+Pascanu%2C+Razvan%2C+Bergstra%2C+James%2C+Goodfellow%2C+Ian+J%2E%2C+Bergeron%2C+Arnaud%2C+Bouchard%2C+Nicolas%2C+and+Bengio%2C+Yoshua%2E+Theano%3A+new+features+and+speed+improvements%2E+Deep+L) 2. Bergstra, James, Breuleux, Olivier, Bastien, Frédéric, Lamblin, Pascal, Pascanu, Razvan, Desjardins, Guillaume, Turian, Joseph, Warde-Farley, David, and Bengio, Yoshua. Theano: a CPU and GPU math expression compiler. In Proceedings of the Python for Scientific Computing Conference (SciPy), June 20… [find](https://scholar.google.com/scholar?q=Bergstra%2C+James%2C+Breuleux%2C+Olivier%2C+Bastien%2C+Fre%CC%81de%CC%81ric%2C+Lamblin%2C+Pascal%2C+Pascanu%2C+Razvan%2C+Desjardins%2C+Guillaume%2C+Turian%2C+Joseph%2C+Warde%2DFarley%2C+David%2C+and+Bengio%2C+Yoshua%2E+Theano%3A+a+CPU+and+GPU+math+ex) 3. Chalupka, K., Perona, P., and Eberhardt, F. Visual Causal Feature Learning. ArXiv e-prints, December 2014. [find](https://scholar.google.com/scholar?q=Chalupka%2C+K%2E%2C+Perona%2C+P%2E%2C+and+Eberhardt%2C+F%2E+Visual+Causal+Feature+Learning%2E+ArXiv+e%2Dprints%2C+December+2014%2E) 4. Dean, Jeffrey, Corrado, Greg S., Monga, Rajat, Chen, Kai, Devin, Matthieu, Le, Quoc V., Mao, Mark Z., Ranzato, MarcAurelio, Senior, Andrew, Tucker, Paul, Yang, Ke, and Ng, Andrew Y. Large scale distributed deep networks. In NIPS, 2012. [find](https://scholar.google.com/scholar?q=Dean%2C+Jeffrey%2C+Corrado%2C+Greg+S%2E%2C+Monga%2C+Rajat%2C+Chen%2C+Kai%2C+Devin%2C+Matthieu%2C+Le%2C+Quoc+V%2E%2C+Mao%2C+Mark+Z%2E%2C+Ranzato%2C+MarcAurelio%2C+Senior%2C+Andrew%2C+Tucker%2C+Paul%2C+Yang%2C+Ke%2C+and+Ng%2C+Andrew+Y%2E+Large+scale+distri) 5. Deng, Jia, Dong, Wei, Socher, Richard, jia Li, Li, Li, Kai, and Fei-fei, Li. Imagenet: A large-scale hierarchical image database. In In CVPR, 2009. [find](https://scholar.google.com/scholar?q=Deng%2C+Jia%2C+Dong%2C+Wei%2C+Socher%2C+Richard%2C+jia+Li%2C+Li%2C+Li%2C+Kai%2C+and+Fei%2Dfei%2C+Li%2E+Imagenet%3A+A+large%2Dscale+hierarchical+image+database%2E+In+In+CVPR%2C+2009%2E) 6. Glorot, Xavier, Bordes, Antoine, and Bengio, Yoshua. Deep sparse rectifier neural networks. In JMLR W&CP: Proceedings of the Fourteenth International Conference on Artificial Intelligence and Statistics (AISTATS 2011), April 2011. [find](https://scholar.google.com/scholar?q=Glorot%2C+Xavier%2C+Bordes%2C+Antoine%2C+and+Bengio%2C+Yoshua%2E+Deep+sparse+rectifier+neural+networks%2E+In+JMLR+W%26CP%3A+Proceedings+of+the+Fourteenth+International+Conference+on+Artificial+Intelligence+and+Statisti) 7. Goodfellow, Ian J., Mirza, Mehdi, Courville, Aaron, and Bengio, Yoshua. Multi-prediction deep Boltzmann machines. In Neural Information Processing Systems, December 2013a. [find](https://scholar.google.com/scholar?q=Goodfellow%2C+Ian+J%2E%2C+Mirza%2C+Mehdi%2C+Courville%2C+Aaron%2C+and+Bengio%2C+Yoshua%2E+Multi%2Dprediction+deep+Boltzmann+machines%2E+In+Neural+Information+Processing+Systems%2C+December+2013a%2E) 8. Goodfellow, Ian J., Warde-Farley, David, Lamblin, Pascal, Dumoulin, Vincent, Mirza, Mehdi, Pascanu, Razvan, Bergstra, James, Bastien, Frédéric, and Bengio, Yoshua. Pylearn2: a machine learning research library. arXiv preprint arXiv:1308.4214, 2013b. — [arXiv:1308.4214](https://arxiv.org/abs/1308.4214) [find](https://scholar.google.com/scholar?q=Goodfellow%2C+Ian+J%2E%2C+Warde%2DFarley%2C+David%2C+Lamblin%2C+Pascal%2C+Dumoulin%2C+Vincent%2C+Mirza%2C+Mehdi%2C+Pascanu%2C+Razvan%2C+Bergstra%2C+James%2C+Bastien%2C+Fre%CC%81de%CC%81ric%2C+and+Bengio%2C+Yoshua%2E+Pylearn2%3A+a+machine+learning+resea) 9. Goodfellow, Ian J., Warde-Farley, David, Mirza, Mehdi, Courville, Aaron, and Bengio, Yoshua. Maxout networks. In Dasgupta, Sanjoy and McAllester, David (eds.), International Conference on Machine Learning, pp. 1319–1327, 2013c. [find](https://scholar.google.com/scholar?q=Goodfellow%2C+Ian+J%2E%2C+Warde%2DFarley%2C+David%2C+Mirza%2C+Mehdi%2C+Courville%2C+Aaron%2C+and+Bengio%2C+Yoshua%2E+Maxout+networks%2E+In+Dasgupta%2C+Sanjoy+and+McAllester%2C+David+%28eds%2E%29%2C+International+Conference+on+Machine+Lear) 10. Gu, Shixiang and Rigazio, Luca. Towards deep neural network architectures robust to adversarial examples. In NIPS Workshop on Deep Learning and Representation Learning, 2014. [find](https://scholar.google.com/scholar?q=Gu%2C+Shixiang+and+Rigazio%2C+Luca%2E+Towards+deep+neural+network+architectures+robust+to+adversarial+examples%2E+In+NIPS+Workshop+on+Deep+Learning+and+Representation+Learning%2C+2014%2E) 11. Hochreiter, S. and Schmidhuber, J. Long short-term memory. Neural Computation, 9(8):1735–1780, 1997. [find](https://scholar.google.com/scholar?q=Hochreiter%2C+S%2E+and+Schmidhuber%2C+J%2E+Long+short%2Dterm+memory%2E+Neural+Computation%2C+9%288%29%3A1735%E2%80%931780%2C+1997%2E) 12. Hornik, Kurt, Stinchcombe, Maxwell, and White, Halbert. Multilayer feedforward networks are universal approximators. Neural Networks, 2:359–366, 1989. [find](https://scholar.google.com/scholar?q=Hornik%2C+Kurt%2C+Stinchcombe%2C+Maxwell%2C+and+White%2C+Halbert%2E+Multilayer+feedforward+networks+are+universal+approximators%2E+Neural+Networks%2C+2%3A359%E2%80%93366%2C+1989%2E) 13. Jarrett, Kevin, Kavukcuoglu, Koray, Ranzato, Marc’Aurelio, and LeCun, Yann. What is the best multi-stage architecture for object recognition? In Proc. International Conference on Computer Vision (ICCV’09), pp. 2146–2153. IEEE, 2009. [find](https://scholar.google.com/scholar?q=Jarrett%2C+Kevin%2C+Kavukcuoglu%2C+Koray%2C+Ranzato%2C+Marc%E2%80%99Aurelio%2C+and+LeCun%2C+Yann%2E+What+is+the+best+multi%2Dstage+architecture+for+object+recognition%3F+In+Proc%2E+International+Conference+on+Computer+Vision+%28ICCV) 14. Krizhevsky, Alex and Hinton, Geoffrey. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009. [find](https://scholar.google.com/scholar?q=Krizhevsky%2C+Alex+and+Hinton%2C+Geoffrey%2E+Learning+multiple+layers+of+features+from+tiny+images%2E+Technical+report%2C+University+of+Toronto%2C+2009%2E) 15. Nguyen, A., Yosinski, J., and Clune, J. Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Images. ArXiv e-prints, December 2014. [find](https://scholar.google.com/scholar?q=Nguyen%2C+A%2E%2C+Yosinski%2C+J%2E%2C+and+Clune%2C+J%2E+Deep+Neural+Networks+are+Easily+Fooled%3A+High+Confidence+Predictions+for+Unrecognizable+Images%2E+ArXiv+e%2Dprints%2C+December+2014%2E) 16. Rust, Nicole, Schwartz, Odelia, Movshon, J. Anthony, and Simoncelli, Eero. Spatiotemporal elements of macaque V1 receptive fields. Neuron, 46(6):945–956, 2005. [find](https://scholar.google.com/scholar?q=Rust%2C+Nicole%2C+Schwartz%2C+Odelia%2C+Movshon%2C+J%2E+Anthony%2C+and+Simoncelli%2C+Eero%2E+Spatiotemporal+elements+of+macaque+V1+receptive+fields%2E+Neuron%2C+46%286%29%3A945%E2%80%93956%2C+2005%2E) 17. Srivastava, Nitish, Hinton, Geoffrey, Krizhevsky, Alex, Sutskever, Ilya, and Salakhutdinov, Ruslan. Dropout: A simple way to prevent neural networks from overfitting. The Journal of Machine Learning Research, 15 (1):1929–1958, 2014. [find](https://scholar.google.com/scholar?q=Srivastava%2C+Nitish%2C+Hinton%2C+Geoffrey%2C+Krizhevsky%2C+Alex%2C+Sutskever%2C+Ilya%2C+and+Salakhutdinov%2C+Ruslan%2E+Dropout%3A+A+simple+way+to+prevent+neural+networks+from+overfitting%2E+The+Journal+of+Machine+Learning+R) 18. Szegedy, Christian, Liu, Wei, Jia, Yangqing, Sermanet, Pierre, Reed, Scott, Anguelov, Dragomir, Erhan, Dumitru, Vanhoucke, Vincent, and Rabinovich, Andrew. Going deeper with convolutions. Technical report, arXiv preprint arXiv:1409.4842, 2014a. — [arXiv:1409.4842](https://arxiv.org/abs/1409.4842) [find](https://scholar.google.com/scholar?q=Szegedy%2C+Christian%2C+Liu%2C+Wei%2C+Jia%2C+Yangqing%2C+Sermanet%2C+Pierre%2C+Reed%2C+Scott%2C+Anguelov%2C+Dragomir%2C+Erhan%2C+Dumitru%2C+Vanhoucke%2C+Vincent%2C+and+Rabinovich%2C+Andrew%2E+Going+deeper+with+convolutions%2E+Technical+re) 19. Szegedy, Christian, Zaremba, Wojciech, Sutskever, Ilya, Bruna, Joan, Erhan, Dumitru, Goodfellow, Ian J., and Fergus, Rob. Intriguing properties of neural networks. ICLR, abs/1312.6199, 2014b. URL http://arxiv.org/abs/1312.6199. [↗](http://arxiv.org/abs/1312.6199) [our card](https://md.research.elamur.ai/free/en/papers/szegedy-2013-intriguing-properties-neural-networks/)