Detection Mechanisms of One-Pixel Attack

<table class="table-group" id="tab4"><tr><td><table class="table"><tr><td class="thead-hr" colspan="3"><hr/></td></tr><tr class="thead"><td class="align_left">Model</td><td class="align_center">Accuracy on test set</td><td class="align_center">Claimed accuracy on test set</td></tr><tr><td class="thead-hr" colspan="3"><hr/></td></tr><tr><td class="align_left">VGG-16</td><td class="align_center"><span style="width: 76.8305ptpx;"><svg height="8.85534pt" id="M163" style="vertical-align:-0.4673595pt" version="1.1" viewbox="-0.0498162 -8.38798 76.8305 8.85534" width="76.8305pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M244 635C114 635 38 519 38 422C38 317 111 240 217 240C236 240 255 244 277 256L345 292C311 140 203 39 59 15L64 -15C89 -15 150 -5 204 17C339 72 440 202 440 386C440 521 368 635 244 635ZM228 602C326 602 352 479 352 390C352 370 351 347 348 324C327 308 293 296 258 296C174 296 124 369 124 458C124 517 152 602 228 602Z"></path></g><g transform="matrix(.013,0,0,-0.013,6.241,0)"><path d="M285 378C315 398 338 416 353 432C373 451 384 474 384 503C384 579 325 635 236 635H235C182 635 136 610 108 579L65 516L85 496C110 533 150 575 205 575C258 575 300 543 300 481C300 407 232 369 141 339L147 310C163 315 188 321 211 321C268 321 338 284 338 192C338 94 288 40 217 40C160 40 119 68 93 91C85 98 77 97 69 91C60 84 47 71 46 58C44 46 48 35 62 22C75 10 116 -12 162 -12C234 -12 424 62 424 224C424 297 373 359 285 376V378Z"></path></g><g transform="matrix(.013,0,0,-0.013,12.482,0)"><path d="M113 -12C146 -12 170 11 170 46C170 78 146 103 114 103S58 78 58 46C58 11 82 -12 113 -12Z"></path></g><g transform="matrix(.013,0,0,-0.013,15.446,0)"><path d="M456 178V225H360V632H320C217 496 115 347 20 206V178H280V106C280 40 276 34 189 27V0H445V27C364 34 360 39 360 106V178H456ZM280 225H82C149 335 214 431 278 520H280V225Z"></path></g><g transform="matrix(.013,0,0,-0.013,21.686,0)"><path d="M594 629L561 652L159 -9L190 -32L594 629ZM194 635C92 635 49 534 49 453C49 374 92 272 193 272C295 272 338 374 338 454S295 635 194 635ZM193 605C257 605 265 504 265 453C265 405 257 302 194 302C133 302 122 403 122 454S133 605 193 605ZM567 351C465 351 421 250 421 169C421 90 465 -12 566 -12S710 90 710 170S667 351 567 351ZM566 322C628 322 637 221 637 169C637 121 628 18 567 18S494 119 494 170C494 223 506 322 566 322Z"></path></g><g transform="matrix(.013,0,0,-0.013,34.419,0)"><path d="M535 290V340H323V533H265V340H52V290H265V84H323V290H535ZM535 -22V28H52V-22H535Z"></path></g><g transform="matrix(.013,0,0,-0.013,44.956,0)"><path d="M384 0V27C293 34 287 42 287 114V635C232 613 172 594 109 583V559L157 557C201 555 205 550 205 499V114C205 42 199 34 109 27V0H384Z"></path></g><g transform="matrix(.013,0,0,-0.013,51.196,0)"><path d="M113 -12C146 -12 170 11 170 46C170 78 146 103 114 103S58 78 58 46C58 11 82 -12 113 -12Z"></path></g><g transform="matrix(.013,0,0,-0.013,54.16,0)"><path d="M137 343C167 482 260 545 321 574C357 591 397 603 429 609L423 641C382 634 335 622 295 608C189 570 37 457 37 238C37 84 125 -12 242 -12C362 -12 447 89 447 209C447 311 374 393 267 393C247 393 226 386 204 376L137 343ZM227 337C318 337 361 256 361 173C361 105 336 22 258 22C176 22 126 120 126 240C126 266 127 291 132 310C155 323 189 337 227 337Z"></path></g><g transform="matrix(.013,0,0,-0.013,60.4,0)"><path d="M153 550H386L412 615L406 623H120L82 318C104 327 142 338 184 338C294 338 347 275 347 187C347 112 305 39 221 39C160 39 119 71 97 89C88 97 80 96 71 90C59 80 50 67 49 57C48 45 52 36 66 23C80 9 123 -12 169 -12C221 -11 288 15 342 59C403 109 431 165 431 225C431 308 366 395 238 395C212 395 165 379 127 364L153 550Z"></path></g><g transform="matrix(.013,0,0,-0.013,66.64,0)"><path d="M594 629L561 652L159 -9L190 -32L594 629ZM194 635C92 635 49 534 49 453C49 374 92 272 193 272C295 272 338 374 338 454S295 635 194 635ZM193 605C257 605 265 504 265 453C265 405 257 302 194 302C133 302 122 403 122 454S133 605 193 605ZM567 351C465 351 421 250 421 169C421 90 465 -12 566 -12S710 90 710 170S667 351 567 351ZM566 322C628 322 637 221 637 169C637 121 628 18 567 18S494 119 494 170C494 223 506 322 566 322Z"></path></g></svg></span></td><td class="align_center"><span style="width: 76.8305ptpx;"><svg height="8.85534pt" id="M164" style="vertical-align:-0.4673595pt" version="1.1" viewbox="-0.0498162 -8.38798 76.8305 8.85534" width="76.8305pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M384 0V27C293 34 287 42 287 114V635C232 613 172 594 109 583V559L157 557C201 555 205 550 205 499V114C205 42 199 34 109 27V0H384Z"></path></g><g transform="matrix(.013,0,0,-0.013,6.24,0)"><path d="M447 623H65C61 580 56 530 47 475H76C100 541 106 550 172 550H388C308 376 196 170 91 -1L98 -12L172 -2C268 204 360 408 455 611L447 623Z"></path></g><g transform="matrix(.013,0,0,-0.013,12.482,0)"><path d="M113 -12C146 -12 170 11 170 46C170 78 146 103 114 103S58 78 58 46C58 11 82 -12 113 -12Z"></path></g><g transform="matrix(.013,0,0,-0.013,15.446,0)"><path d="M285 378C315 398 338 416 353 432C373 451 384 474 384 503C384 579 325 635 236 635H235C182 635 136 610 108 579L65 516L85 496C110 533 150 575 205 575C258 575 300 543 300 481C300 407 232 369 141 339L147 310C163 315 188 321 211 321C268 321 338 284 338 192C338 94 288 40 217 40C160 40 119 68 93 91C85 98 77 97 69 91C60 84 47 71 46 58C44 46 48 35 62 22C75 10 116 -12 162 -12C234 -12 424 62 424 224C424 297 373 359 285 376V378Z"></path></g><g transform="matrix(.013,0,0,-0.013,21.686,0)"><path d="M594 629L561 652L159 -9L190 -32L594 629ZM194 635C92 635 49 534 49 453C49 374 92 272 193 272C295 272 338 374 338 454S295 635 194 635ZM193 605C257 605 265 504 265 453C265 405 257 302 194 302C133 302 122 403 122 454S133 605 193 605ZM567 351C465 351 421 250 421 169C421 90 465 -12 566 -12S710 90 710 170S667 351 567 351ZM566 322C628 322 637 221 637 169C637 121 628 18 567 18S494 119 494 170C494 223 506 322 566 322Z"></path></g><g transform="matrix(.013,0,0,-0.013,34.42,0)"><path d="M535 290V340H323V533H265V340H52V290H265V84H323V290H535ZM535 -22V28H52V-22H535Z"></path></g><g transform="matrix(.013,0,0,-0.013,44.956,0)"><path d="M285 378C315 398 338 416 353 432C373 451 384 474 384 503C384 579 325 635 236 635H235C182 635 136 610 108 579L65 516L85 496C110 533 150 575 205 575C258 575 300 543 300 481C300 407 232 369 141 339L147 310C163 315 188 321 211 321C268 321 338 284 338 192C338 94 288 40 217 40C160 40 119 68 93 91C85 98 77 97 69 91C60 84 47 71 46 58C44 46 48 35 62 22C75 10 116 -12 162 -12C234 -12 424 62 424 224C424 297 373 359 285 376V378Z"></path></g><g transform="matrix(.013,0,0,-0.013,51.197,0)"><path d="M113 -12C146 -12 170 11 170 46C170 78 146 103 114 103S58 78 58 46C58 11 82 -12 113 -12Z"></path></g><g transform="matrix(.013,0,0,-0.013,54.161,0)"><path d="M137 343C167 482 260 545 321 574C357 591 397 603 429 609L423 641C382 634 335 622 295 608C189 570 37 457 37 238C37 84 125 -12 242 -12C362 -12 447 89 447 209C447 311 374 393 267 393C247 393 226 386 204 376L137 343ZM227 337C318 337 361 256 361 173C361 105 336 22 258 22C176 22 126 120 126 240C126 266 127 291 132 310C155 323 189 337 227 337Z"></path></g><g transform="matrix(.013,0,0,-0.013,60.401,0)"><path d="M384 0V27C293 34 287 42 287 114V635C232 613 172 594 109 583V559L157 557C201 555 205 550 205 499V114C205 42 199 34 109 27V0H384Z"></path></g><g transform="matrix(.013,0,0,-0.013,66.641,0)"><path d="M594 629L561 652L159 -9L190 -32L594 629ZM194 635C92 635 49 534 49 453C49 374 92 272 193 272C295 272 338 374 338 454S295 635 194 635ZM193 605C257 605 265 504 265 453C265 405 257 302 194 302C133 302 122 403 122 454S133 605 193 605ZM567 351C465 351 421 250 421 169C421 90 465 -12 566 -12S710 90 710 170S667 351 567 351ZM566 322C628 322 637 221 637 169C637 121 628 18 567 18S494 119 494 170C494 223 506 322 566 322Z"></path></g></svg></span></td></tr><tr class="table-tr"><td colspan="3"><hr class="tbody-hr"/></td></tr></table></td></tr></table>

<div>Success rate of one-pixel attack.</div>

Wireless Communications and Mobile Computing

tab4

Table 4

Table 4: Detection Mechanisms of One-Pixel Attack 