Fig. 3From: Smooth adversarial examplesOriginal image xo (left), adversarial image xa=xo+r (above) and scaled perturbation r (below; distortion D=∥r∥ and MAD scores) against InceptionV3 on ImageNet. Scaling maps each perturbation and each color channel independently to [0,1]. The perturbation r is indeed smooth like xo for sC&W. a Despite the higher distortion compared to C&W, the perturbation of sC&W is totally invisible, even when magnified (cf Fig. 1). b One of the failing examples of [6] that look unnatural to human vision. c One of the examples with the strongest distortion over ImageNet for sC&W: xo is flat along stripes, reducing the dimensionality of the “smooth like xo” manifoldBack to article page