Fig. 1

Given a single input image, our adversarial magnification (cf Appendix 1) reveals the effect of a potential adversarial perturbation. We show a the original image followed by b its own magnified version as well as c–h magnified versions of adversarial examples generated by different attacks. Our smooth adversarial example (d) is invisible even when magnified