# AESOP: Adjustable Exhaustive Search for One-Pixel Attacks in Deep Neural Networks
## 6 Conclusions  
In this study, we have presented experimental results for one-pixel attacks with well-trained CNNs. This provides valuable insights for improving the robustness of deep neural networks. Moreover, based on the pattern of attacks observed in the experiment, we have proposed an adjustable exhaustive search algorithm to save the search space dramatically and still identify most attacks. Finally, we have implemented an efficient tool for the algorithm, and our experiment has yielded promising results.  
There are several noteworthy issues for future study. First, although our technique have been applied to MNIST hand written digits, various data sets need to be investigated  
Figure 4: Experiment for parameters of AESOP algorithm.  
\begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline  & \multicolumn{3}{c}{**ES**} & \multicolumn{5}{c}{**AESOP**} \\ \cline{2-10}  & **OPA** & **Time** & \(a_{h}\) & \(a_{v}\) & \(a_{val}\) & \(e\) & **OPA** & **\%** & **Time** \\ \hline \multirow{4}{*}{\(f_{1}\)} & & & 1 & 1 & 5 & 1 & 216 & 100.0\% & 3.74 \\  & & & 1 & 1 & 5 & 2 & 216 & 100.0\% & 3.25 \\  & & & **1** & **1** & **10** & **2** & **214** & **99.1\%** & **1.69** \\  & & & **1** & **2** & **10** & **2** & **193** & **89.4\%** & **0.85** \\  & & & 2 & 2 & 10 & 2 & 167 & 77.3\% & 0.49 \\  & & & 2 & 2 & 15 & 2 & 167 & 77.3\% & 0.32 \\ \hline \multirow{4}{*}{\(f_{2}\)} & & & 1 & 1 & 5 & 1 & 102 & 100.0\% & 3.27 \\  & & & 1 & 1 & 5 & 2 & 102 & 100.0\% & 2.79 \\  & & & **1** & **1** & **10** & **2** & **100** & **98.0\%** & **1.42** \\  & & & **1** & **2** & **10** & **2** & **88** & **86.3\%** & **0.73** \\  & & & 2 & 2 & 10 & 2 & 79 & 77.5\% & 0.39 \\  & & & 2 & 2 & 15 & 2 & 79 & 77.5\% & 0.28 \\ \hline \multirow{4}{*}{\(f_{3}\)} & & & 1 & 1 & 5 & 1 & 96 & 100.0\% & 3.18 \\  & & & 1 & 1 & 5 & 2 & 96 & 100.0\% & 2.74 \\  & & & **1** & **1** & **10** & **2** & **93** & **96.9\%** & **1.41** \\  & & & **1** & **2** & **10** & **2** & **83** & **86.5\%** & **0.73** \\  & & & 2 & 2 & 10 & 2 & 78 & 81.3\% & 0.39 \\  & & & 2 & 2 & 15 & 2 & 78 & 81.3\% & 0.28 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Performance comparison.  
for one-pixel attacks, such as the tumor data set [23] and CIFAR image date set [24]. Second, we wish to study an efficient method to adapt our technique to more state-of-the-art models like transformer models and contrastive learning. Finally, we plan to conduct ample experiment to improve the accuracy and gain of the proposed technique.  
Conceptualization, W.N. and H.K.; methodology, W.N. and H.K.; software, W.N.; validation, W.N. and H.K.; formal analysis, W.N. and H.K.; investigation, W.N. and H.K.; resources, H.K.; data curation, W.N. and H.K.; writing--original draft preparation, W.N. and H.K.; writing--review and editing, W.N. and H.K.; visualization, W.N.; supervision, W.N. and H.K.; project administration, W.N. and H.K.; funding acquisition, W.N. All authors have read and agreed to the published version of the manuscript.  
This work was supported by a National Research Foundation of Korea (NRF) grant through the Korean Government (MSIT) under grant 2021R1F1A105038911.  
Not applicable.  
The authors declare no conflict of interest.