Fig. 1.

Examples of adversarial images that “fool” Convolutional Neural Nets trained to classify familiar objects, with labels indicating the machine’s classifications. a Indirectly encoded “fooling” images (from ref. ¹⁴). b Directly encoded “fooling” images (from ref. ¹⁴). c Perturbed adversarial images that cause the machine to classify one kind of digit as another (from ref. ¹⁵). d The LaVAN attack¹³ can cause a machine to misclassify a natural image even when the noise is localized to a corner of the image. e “Robust” adversarial images¹² are renders of 3D objects that are misclassified from multiple viewpoints (and can even be physically produced in the real world)