Cited by 5,317Adversarial Robustness in Machine LearningDigital Media Forensic DetectionSoftware Testing and Debugging Techniques

DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks

Open access
Moosavi-Dezfooli, Seyed-Mohsen, Fawzi, Alhussein, Frossard, Pascal·2016·2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

Abstract

State-of-the-art deep neural networks have achieved impressive results on many image classification tasks. However, these same architectures have been shown to be unstable to small, well sought, perturbations of the images. Despite the importance of this phenomenon, no effective methods have been proposed to accurately compute the robustness of state-of-the-art deep classifiers to such perturbations on large-scale datasets. In this paper, we fill this gap and propose the DeepFool algorithm to efficiently compute perturbations that fool deep networks, and thus reliably quantify the robustness of these classifiers. Extensive experimental results show that our approach outperforms recent methods in the task of computing adversarial perturbations and making classifiers more robust.

Integrity signals

Registry

Crossref · 10.1109/cvpr.2016.282

Cites

19 of 19 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Authors
Moosavi-Dezfooli, S.-M., Fawzi, A., & Frossard, P.
Affiliations
École Polytechnique Fédérale de Lausanne (CH)
Venue
2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR)
Publisher
IEEE
Published
2016-06
Pages
2574-2582
ISSN
1063-6919 (ISSN-L)
OpenAlex
W2243397390
Cited by
5,317
References
19
Citations by year
2026: 220 · 2025: 518 · 2024: 626 · 2023: 734 · 2022: 717 · 2021: 868 · 2020: 769 · 2019: 527 · 2018: 261 · 2017: 65 · 2016: 8 · 2014: 1 · 2012: 2
FWCI
154.65
Type
conference paper
Language
en
Open access
Licence
cc-by-nc-nd
Locations
  • IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings (publishedVersion)
  • Infoscience (Ecole Polytechnique Fédérale de Lausanne) (submittedVersion, cc-by-nc-nd)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
  • Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
Keywords
adversarial perturbations, adversarial attacks, DeepFool, image classification, deep neural network, adversarial training

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review