A general framework for adversarial examples with objectives

Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, Michael K. Reiter

Research output: Contribution to journalArticlepeer-review

75 Scopus citations


Images perturbed subtly to be misclassified by neural networks, called adversarial examples, have emerged as a technically deep challenge and an important concern for several application domains. Most research on adversarial examples takes as its only constraint that the perturbed images are similar to the originals. However, real-world application of these ideas often requires the examples to satisfy additional objectives, which are typically enforced through custom modifications of the perturbation process. In this article, we propose adversarial generative nets (AGNs), a general methodology to train a generator neural network to emit adversarial examples satisfying desired objectives. We demonstrate the ability of AGNs to accommodate a wide range of objectives, including imprecise ones difficult to model, in two application domains. In particular, we demonstrate physical adversarial examples—eyeglass frames designed to fool face recognition—with better robustness, inconspicuousness, and scalability than previous approaches, as well as a new attack to fool a handwritten-digit classifier.

Original languageEnglish (US)
Article number16
JournalACM Transactions on Privacy and Security
Issue number3
StatePublished - Jun 10 2019
Externally publishedYes


  • Adversarial examples
  • Face recognition
  • Machine learning
  • Neural networks

ASJC Scopus subject areas

  • Computer Science(all)
  • Safety, Risk, Reliability and Quality


Dive into the research topics of 'A general framework for adversarial examples with objectives'. Together they form a unique fingerprint.

Cite this