DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks
Open accessAbstract
State-of-the-art deep neural networks have achieved impressive results on many image classification tasks. However, these same architectures have been shown to be unstable to small, well sought, perturbations of the images. Despite the importance of this phenomenon, no effective methods have been proposed to accurately compute the robustness of state-of-the-art deep classifiers to such perturbations on large-scale datasets. In this paper, we fill this gap and propose the DeepFool algorithm to efficiently compute perturbations that fool deep networks, and thus reliably quantify the robustness of these classifiers. Extensive experimental results show that our approach outperforms recent methods in the task of computing adversarial perturbations and making classifiers more robust.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Encrypted traffic, such as HTTPS, cannot be interpreted by an Intrusion Detection System (IDS), making it difficult for the detector to compare it to the signatures stored in its database.
“Encrypted traffic, such as HTTPS, cannot be interpreted by an Intrusion Detection System (IDS) (Metke & Ekl, 2010) [165], making it difficult for the detector to compare it to the signatures stored in its database.”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [165]
Cites
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155 · see citing works
Going deeper with convolutions
Szegedy, C., Liu, W., Jia, Y., Sermanet, P., Reed, S., Anguelov, D., Erhan, D., Vanhoucke, V., & Rabinovich, A. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298594 · Cited by 48,562 · see citing works
Caffe: Convolutional Architecture for Fast Feature Embedding
Jia, Y., Shelhamer, E., Donahue, J., Karayev, S., Long, J., Girshick, R., Guadarrama, S., & Darrell, T. (2014) · Proceedings of the 22nd ACM international conference on Multimedia · doi:10.1145/2647868.2654889 · Cited by 11,077 · see citing works
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381 · see citing works
Hinton, G., Deng, L., Yu, D., Dahl, G., Mohamed, A.-R., Jaitly, N., Senior, A., Vanhoucke, V., Nguyen, P., Sainath, T., et al. (2012) · IEEE Signal Processing Magazine · doi:10.1109/msp.2012.2205597 · Cited by 10,260 · see citing works
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143 · see citing works
Deep neural networks are easily fooled: High confidence predictions for unrecognizable images
Nguyen, A., Yosinski, J., & Clune, J. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298640 · Cited by 3,258 · see citing works
MatConvNet: Convolutional Neural Networks for MATLAB
Vedaldi, A., & Lenc, K. (2015) · Proceedings of the 23rd ACM international conference on Multimedia · doi:10.1145/2733373.2807412 · Cited by 2,444 · see citing works
Convolutional networks and applications in vision
LeCun, Y., Kavukcuoglu, K., & Farabet, C. (2010) · Proceedings of 2010 IEEE International Symposium on Circuits and Systems · doi:10.1109/iscas.2010.5537907 · Cited by 2,213 · see citing works
Object Recognition with Gradient-Based Learning
LeCun, Y., Haffner, P., Bottou, L., & Bengio, Y. (1999) · Lecture Notes in Computer Science · doi:10.1007/3-540-46805-6_19 · Cited by 947 · see citing works
Ruszczyński, A. (2006) · Princeton University Press eBooks · doi:10.1515/9781400841059 · Cited by 703 · see citing works
Towards Deep Neural Network Architectures Robust to Adversarial ExamplesPreprint
Gu, S., & Rigazio, L. (2014) · arXiv (Cornell University) · doi:10.48550/arxiv.1412.5068 · Cited by 658 · see citing works
Strategies for training large scale neural network language models
Mikolov, T., Deoras, A., Povey, D., Burget, L., & Černocký, J. (2011) · IEEE Workshop on Automatic Speech Recognition and Understanding (ASRU) · doi:10.1109/asru.2011.6163930 · Cited by 516 · see citing works
A Deep Learning Network Approach to ab initio Protein Secondary Structure Prediction
Spencer, M., Eickholt, J., & Cheng, J. J. (2014) · IEEE Transactions on Computational Biology and Bioinformatics · doi:10.1109/tcbb.2014.2343960 · Cited by 297 · see citing works
Analysis of classifiers’ robustness to adversarial perturbations
Fawzi, A., Fawzi, O., & Pascal Frossard, B. (2017) · Machine Learning · doi:10.1007/s10994-017-5663-3 · Cited by 289 · see citing works
Self-citationDeep autoencoder neural networks for gene ontology annotation predictions
Chicco, D., Sadowski, P., & Baldi, P. (2014) · ACM International Conference on Bioinformatics, Computational Biology, and Health Informatics (ACM-BCB) · doi:10.1145/2649387.2649442 · Cited by 185 · see citing works
Manitest: Are classifiers really invariant?
Fawzi, A., & Pascal Frossard, B. (2015) · British Machine Vision Conference (BMVC) · doi:10.5244/c.29.106 · Cited by 89 · see citing works
Self-citationLeast-Change Secant Update Methods for Underdetermined Systems
Walker, H. F., & Watson, L. T. (1990) · SIAM Journal on Numerical Analysis · doi:10.1137/0727071 · Cited by 58 · see citing works
What Is Holding Back Convnets for Detection?
Pepik, B., Benenson, R., Ritschel, T., & Schiele, B. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-24947-6_43 · Cited by 45 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602 · see citing works
Explainable AI: a review of machine learning interpretability methods
Linardatos, P., Papastefanopoulos, V., & Kotsiantis, S. (2020) · Entropy · doi:10.3390/e23010018 · Cited by 2,922 · see citing works
Universal Adversarial Perturbations
Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., & Frossard, P. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.17 · Cited by 2,680 · see citing works
Self-citationAdversarial Examples: Attacks and Defenses for Deep Learning
Yuan, X., He, P., Zhu, Q., & Li, X. (2019) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2018.2886017 · Cited by 1,733 · see citing works
Explaining nonlinear classification decisions with deep taylor decomposition
Montavon, G., Lapuschkin, S., Binder, A., Samek, W., & Müller, K.-R. (2017) · Pattern Recognition · doi:10.1016/j.patcog.2016.11.008 · Cited by 1,357 · see citing works
Machine Learning Testing: Survey, Landscapes and Horizons
Zhang, J. M., Harman, M., Ma, L., & Liu, Y. (2022) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2019.2962027 · Cited by 897 · see citing works
Interpretation of Neural Networks Is Fragile
Ghorbani, A., Abid, A., & Zou, J. (2019) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v33i01.33013681 · Cited by 765 · see citing works
HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
Chen, J., Jordan, M. I., & Wainwright, M. J. (2020) · 2020 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40000.2020.00045 · Cited by 718 · see citing works
Ganju, K., Wang, Q., Yang, W., Gunter, C. A., & Borisov, N. (2018) · Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3243734.3243834 · Cited by 475 · see citing works
Attack of the tails: Yes, you really can backdoor federated learning
Wang, H., Sreenivasan, K., Rajput, S., Vishwakarma, H., Agarwal, S., Sohn, J.-Y., Lee, K., & Papailiopoulos, D. (2020) · arXiv · doi:10.48550/arxiv.2007.05084 · Cited by 406 · see citing works
Generative Adversarial Networks: A Survey Toward Private and Secure Applications
Cai, Z., Xiong, Z., Xu, H., Wang, P., Li, W., & Pan, Y. (2022) · ACM Computing Surveys · doi:10.1145/3459992 · Cited by 376 · see citing works
Bai, X., Wang, X., Liu, X., Liu, Q., Song, J., Sebe, N., & Kim, B. (2021) · Pattern Recognition · doi:10.1016/j.patcog.2021.108102 · Cited by 313 · see citing works
Self-Supervised Learning for Time Series Analysis: Taxonomy, Progress, and Prospects
Zhang, K., Wen, Q., Zhang, C., Cai, R., Jin, M., Liu, Y., Zhang, J. Y., Liang, Y., Pang, G., Song, D., et al. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3387317 · Cited by 295 · see citing works
Adversarial Machine Learning Attacks and Defense Methods in the Cyber Security Domain
Rosenberg, I., Shabtai, A., Elovici, Y., & Rokach, L. (2022) · ACM Computing Surveys · doi:10.1145/3453158 · Cited by 295 · see citing works
Federated learning in a medical context: A systematic literature review
Pfitzner, B., Steckhan, N., & Arnrich, B. (2021) · ACM Transactions on Internet Technology · doi:10.1145/3412357 · Cited by 288 · see citing works
Azam, Z., Islam, M. M., & Huda, M. N. (2023) · IEEE Access · doi:10.1109/access.2023.3296444 · Cited by 265 · see citing works
The neuroconnectionist research programme
Doerig, A., Sommers, R. P., Seeliger, K., Richards, B., Ismael, J., Lindsay, G. W., Kording, K. P., Konkle, T., van Gerven, M. A. J., Kriegeskorte, N., et al. (2023) · Nature Reviews Neuroscience · doi:10.1038/s41583-023-00705-w · Cited by 233 · see citing works
Causal interpretability for machine learning-problems, methods and evaluation
Moraffah, R., Karami, M., Guo, R., Raglin, A., & Liu, H. (2020) · ACM SIGKDD Explorations Newsletter · doi:10.1145/3400051.3400058 · Cited by 238 · see citing works
Disentangling Adversarial Robustness and Generalization
Stutz, D., Hein, M., & Schiele, B. (2019) · 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2019.00714 · Cited by 223 · see citing works
Vision Transformers Are Robust Learners
Paul, S., & Chen, P.-Y. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i2.20103 · Cited by 213 · see citing works
“Following [55], we conduct the following experiment on 1000 randomly sampled images from the ImageNet-1k validation set with ResNet-50, BiT-m r50x3 , and ViT B-16 8 : • Generate small adversarial perturbations ( δ ) with DeepFool [51] with a step size of 50 9 .”
MethodAdversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning
Chen, T., Liu, S., Chang, S., Cheng, Y., Amini, L., & Wang, Z. (2020) · 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr42600.2020.00078 · Cited by 205 · see citing works
Rasool, R. U., Ahmad, H. F., Rafique, W., Qayyum, A., & Qadir, J. (2022) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2022.103332 · Cited by 177 · see citing works
Adversarially Robust Policy Learning: Active construction of physically-plausible perturbations
Mandlekar, A., Zhu, Y., Garg, A., Fei-Fei, L., & Savarese, S. (2017) · 2017 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS) · doi:10.1109/iros.2017.8206245 · Cited by 116 · see citing works
Bradshaw, J., Matthews, A. G. D. G., & Ghahramani, Z. (2017) · arXiv · doi:10.48550/arxiv.1707.02476 · Cited by 109 · see citing works
Free lunch for testing: fuzzing deep-learning libraries from open source
Wei, A., Deng, Y., Yang, C., & Zhang, L. (2022) · Proceedings of the 44th International Conference on Software Engineering · doi:10.1145/3510003.3510041 · Cited by 106 · see citing works
Adversarial attacks on an oblivious recommender
Christakopoulou, K., & Banerjee, A. (2019) · Proceedings of the 13th ACM Conference on Recommender Systems · doi:10.1145/3298689.3347031 · Cited by 105 · see citing works
Privacy and Security of Big Data in AI Systems: A Research and Standards Perspective
Dilmaghani, S., Brust, M. R., Danoy, G., Cassagnes, N., Pecero, J., & Bouvry, P. (2019) · 2019 IEEE International Conference on Big Data (Big Data) · doi:10.1109/bigdata47090.2019.9006283 · Cited by 111 · see citing works
Universal Adversarial Perturbation via Prior Driven Uncertainty Approximation
Liu, H., Ji, R., Li, J., Zhang, B., Gao, Y., Wu, Y., & Huang, F. (2019) · 2019 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00303 · Cited by 95 · see citing works
Fuzzing deep-learning libraries via automated relational API inference
Deng, Y., Yang, C., Wei, A., & Zhang, L. (2022) · Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering · doi:10.1145/3540250.3549085 · Cited by 86 · see citing works
A Survey of Deep Learning Applications to Autonomous Vehicle Control
Kuutti, S., Bowden, R., Jin, Y., Barber, P., & Fallah, S. (2021) · IEEE Transactions on Intelligent Transportation Systems · doi:10.1109/tits.2019.2962338 · Cited by 96 · see citing works
Boosting Fast Adversarial Training With Learnable Adversarial Initialization
Jia, X., Zhang, Y., Wu, B., Wang, J., & Cao, X. (2022) · IEEE Transactions on Image Processing · doi:10.1109/tip.2022.3184255 · Cited by 69 · see citing works
Grey-box Adversarial Attack And Defence For Sentiment Classification
Xu, Y., Zhong, X., Jimeno Yepes, A., & Lau, J. H. (2021) · Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies · doi:10.18653/v1/2021.naacl-main.321 · Cited by 54 · see citing works
On failures of RGB cameras and their effects in autonomous driving applications
Secci, F., & Ceccarelli, A. (2020) · 2020 IEEE 31st International Symposium on Software Reliability Engineering (ISSRE) · doi:10.1109/issre5003.2020.00011 · Cited by 42 · see citing works
Text Backdoor Detection Using an Interpretable RNN Abstract Model
Fan, M., Si, Z., Xie, X., Liu, Y., & Liu, T. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3103064 · Cited by 38 · see citing works
Extendable and explainable deep learning for pan-cancer radiogenomics research
Liu, Q., & Hu, P. (2022) · Current Opinion in Chemical Biology · doi:10.1016/j.cbpa.2021.102111 · Cited by 27 · see citing works
Dispersed Pixel Perturbation-Based Imperceptible Backdoor Trigger for Image Classifier Models
Wang, Y., Zhao, M., Li, S., Yuan, X., & Ni, W. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3202687 · Cited by 26 · see citing works
Ma, L., & Liang, L. (2022) · Computers in Biology and Medicine · doi:10.1016/j.compbiomed.2022.105345 · Cited by 26 · see citing works
Robust Vision-Based Cheat Detection in Competitive Gaming
Jonnalagadda, A., Frosio, I., Schneider, S., McGuire, M., & Kim, J. (2021) · Proceedings of the ACM on Computer Graphics and Interactive Techniques · doi:10.1145/3451259 · Cited by 23 · see citing works
Is Multi-Modal Necessarily Better? Robustness Evaluation of Multi-Modal Fake News Detection
Chen, J., Jia, C., Zheng, H., Chen, R., & Fu, C. (2023) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2023.3249290 · Cited by 17 · see citing works
Human in the AI Loop via xAI and Active Learning for Visual Inspection
Rožanec, J. M., Montini, E., Cutrona, V., Papamartzivanos, D., Klemenčič, T., Fortuna, B., Mladenić, D., Veliou, E., Giannetsos, T., & Emmanouilidis, C. (2024) · Artificial Intelligence in Manufacturing · doi:10.1007/978-3-031-46452-2_22 · Cited by 17 · see citing works
Estimating Labeling Quality with Deep Object Detectors
Haase-Schütz, C., Hertlein, H., & Wiesbeck, W. (2019) · 2019 IEEE Intelligent Vehicles Symposium (IV) · doi:10.1109/ivs.2019.8814144 · Cited by 8 · see citing works
Detecting Scene-Plausible Perceptible Backdoors in Trained DNNs Without Access to the Training Set
Xiang, Z., Miller, D. J., Wang, H., & Kesidis, G. (2021) · Neural Computation · doi:10.1162/neco_a_01376 · Cited by 8 · see citing works
UnsafeBench: Benchmarking Image Safety Classifiers on Real-World and AI-Generated Images
Qu, Y., Shen, X., Wu, Y., Backes, M., Zannettou, S., & Zhang, Y. (2025) · Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3719027.3765088 · Cited by 6 · see citing works
“With these perturbed images, we measure the MSE and RA (metrics are introduced in Section 3.4) of seven open-source classifiers.”
Influential
- Authors
- Moosavi-Dezfooli, S.-M., Fawzi, A., & Frossard, P.
- Affiliations
- École Polytechnique Fédérale de Lausanne (CH)
- ORCID
- Fawzi, Alhussein
- Venue
- 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR)
- Publisher
- IEEE
- Published
- 2016-06
- Pages
- 2574-2582
- ISSN
- 1063-6919 (ISSN-L)
- OpenAlex
- W2243397390
- Semantic Scholar
- 52693bcf4627bdbc31734e7f3dbcf5ea7eef4d35
- Cited by
- 5,317
- References
- 19
- Citations by year
- 2026: 220 · 2025: 518 · 2024: 626 · 2023: 734 · 2022: 717 · 2021: 868 · 2020: 769 · 2019: 527 · 2018: 261 · 2017: 65 · 2016: 8 · 2014: 1 · 2012: 2
- FWCI
- 154.65
- Type
- conference paper
- Language
- en
- Open access
- green
- infoscience.epfl.ch
- Licence
- cc-by-nc-nd
- Locations
- IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings (publishedVersion)
- Infoscience (Ecole Polytechnique Fédérale de Lausanne) (submittedVersion, cc-by-nc-nd)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
- Keywords
- adversarial perturbations, adversarial attacks, DeepFool, image classification, deep neural network, adversarial training
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review