Fig. 3

Original image x_o (left), adversarial image x_a=x_o+r (above) and scaled perturbation r (below; distortion D=∥r∥ and MAD scores) against InceptionV3 on ImageNet. Scaling maps each perturbation and each color channel independently to [0,1]. The perturbation r is indeed smooth like x_o for sC&W. a Despite the higher distortion compared to C&W, the perturbation of sC&W is totally invisible, even when magnified (cf Fig. 1). b One of the failing examples of [6] that look unnatural to human vision. c One of the examples with the strongest distortion over ImageNet for sC&W: x_o is flat along stripes, reducing the dimensionality of the “smooth like x_o” manifold