Skip to main content
. Author manuscript; available in PMC: 2021 Feb 28.
Published in final edited form as: Neurocomputing (Amst). 2019 Oct 31;379:370–378. doi: 10.1016/j.neucom.2019.10.085

Figure 7:

Figure 7:

Attacking multiple images using the same adversarial perturbation for the context-aware model. The attack maximizes predicted age. We set the modification distance to 0.002. Group size corresponds to the number of images that we target with a single adversarial perturbation.