# AESOP: Adjustable Exhaustive Search for One-Pixel Attacks in Deep Neural Networks
## 4 Exhaustive Search for One-Pixel Attacks
### Experimental Results of Exhaustive Search  
We implemented a tool for the exhaustive search algorithm described in Section 4.1 and experimented on the MNIST data set [9] using three well-trained CNNs [10; 11]. All the experiments were performed on a PC using a 3.70 GHz 10 core processor, 128 GB memory, and a 328 Tensor core GPU. To analyze the patterns of one-pixel attacks and the performance of our exhaustive search algorithm, we used 10,000 images (size: \(28\times 28\)) from the MNIST testing set. Table 1 presents the architectures, accuracies, and OPA (One-Pixel Attack) error rates of the three networks where the OPA error rate indicates the one-pixel attack rate. For example, a neural network \(f_{1}\) consists of 10 convolutional layers and a fully connected layer. Its error rate was 0.22%, and the OPA error rate was 2.16%. Note that all the three networks (\(f_{1},f_{2}\), and \(f_{3}\)) exhibit OPA error rates that are 3-10 times higher than the error rates. This result implies that even very well-trained networks can be significantly vulnerable to one-pixel attacks; thus, it is essential to identify them to prevent errors in neural networks. Figure 2 illustrates an example of a one-pixel attack for each digit in MNIST. For each digit, the left figure is the original input, the middle figure presents pixels that can be attacked, and the right figure represents pixel values that cause a one-pixel attack, where blue indicates that the corresponding pixel is modified to light in the one-pixel \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Network** & \(f_{1}\) & \(f_{2}\) & \(f_{3}\) \\ \hline \multirow{3}{*}{Arch} & \(10\times\text{Conv}(3\times 3)\) & \(5\times\text{Conv}(5\times 5)\) & \(4\times\text{Conv}(7\times 7)\) \\  & FC\((11,264\times 10)\) & FC\((10,240\times 10)\) & FC\((3072\times 10)\) \\ \hline Accuracy & 99.78\% & 99.73\% & 99.67\% \\ Error rate & 0.22\% & 0.27\% & 0.33\% \\ \hline OPA & 2.16\% & 1.02\% & 0.96\% \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Architectures and accuracies of networks. attack, and red indicates that the corresponding pixel is modified to dark, respectively. The attacks shown in Figure 2 reveal that one-pixel attacks generally emerge consecutively rather than individually. The right columns of Figure 2 show the pixel values that cause a one-pixel attack. The plots assert that a one-pixel attack occurs at a long interval of pixel values rather than at a particular pixel value. One of the reasons why one-pixel attacks occur consecutively with respect to location is that most deep neural networks employ convolutional layers to improve their accuracy. These consider the correlation with neighboring pixels rather than extracting the features of a single pixel. In addition, we consider the reason for consecutiveness of pixel values is because one-pixel attacks succeed as long as the pixel value exceeds a certain threshold. Tables 2 and 3 present the consecutiveness of one-pixel attacks in further detail. Table 2 describes the consecutiveness of the vulnerable pixels. The leftmost column indicates the number of pixels attacked consecutively, either horizontally or vertically. For instance, 2 indicates the case in which two consecutive pixels are vulnerable with a frequency of 605 and rate of 15.32%. In this case, even when we inspect only one pixel among two consecutive pixels, we can detect the corresponding attack. The rightmost column 'Accumulated rate' indicates the rate of accumulation of consecutive pixels higher than or equal to that of the corresponding consecutive pixels. That is, in the second row, the accumulated rate of 94.53% indicates that even when we examine only the alternating pixels horizontally and vertically (i.e., 2 \(\times\) 2 lattice), which saves 75% of the search space, we can identify 94.53% of the one-pixel attacks.