%PDF-1.3 1 0 obj << /Kids [ 3 0 R 4 0 R 5 0 R 6 0 R 7 0 R 8 0 R 9 0 R 10 0 R 11 0 R 12 0 R ] /Type /Pages /Count 10 >> endobj 2 0 obj << /Title (NAG\072 Network for Adversary Generation) /Producer (PyPDF2) /Author (Konda Reddy Mopuri\054 Utkarsh Ojha\054 Utsav Garg\054 R\056 Venkatesh Babu) /Subject (2018 IEEE Conference on Computer Vision and Pattern Recognition) >> endobj 3 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 14 0 R /Resources << /XObject << /x8 15 0 R /x6 18 0 R /x12 21 0 R /x10 24 0 R >> /ExtGState << /s9 27 0 R /s11 30 0 R /R38 33 0 R /a0 << /CA 1 /ca 1 >> /s5 34 0 R /s7 37 0 R >> /Font << /R47 40 0 R /R45 44 0 R /R43 48 0 R /R41 52 0 R /F2 56 0 R /F1 57 0 R /R39 58 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R 75 0 R 76 0 R 77 0 R 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R ] >> endobj 4 0 obj << /Parent 1 0 R /Rotate 0 /Contents 89 0 R /Resources << /XObject << /R127 90 0 R /R126 91 0 R /R125 92 0 R /R124 93 0 R /R123 94 0 R /R122 95 0 R /R121 96 0 R /R120 97 0 R /R83 98 0 R /R129 101 0 R /R128 102 0 R /R109 103 0 R /R108 104 0 R /R101 105 0 R /R100 106 0 R /R103 107 0 R /R102 108 0 R /R105 109 0 R /R104 110 0 R /R107 111 0 R /R106 112 0 R /R85 113 0 R /R84 114 0 R /R130 115 0 R /R131 116 0 R /R132 117 0 R /R133 118 0 R /R134 119 0 R /R135 120 0 R /R90 126 0 R /R91 127 0 R /R92 128 0 R /R93 129 0 R /R94 130 0 R /R95 131 0 R /R96 132 0 R /R98 124 0 R /R118 133 0 R /R119 134 0 R /R99 125 0 R /R112 135 0 R /R113 137 0 R /R110 138 0 R /R111 136 0 R /R116 139 0 R /R117 141 0 R /R114 140 0 R /R115 142 0 R >> /ExtGState << /R82 99 0 R /R76 121 0 R /R38 33 0 R /R74 122 0 R /R75 123 0 R >> /Font << /R144 158 0 R /R78 143 0 R /R140 163 0 R /R142 166 0 R /R45 44 0 R /R43 48 0 R /R41 52 0 R /F2 169 0 R /F1 170 0 R /R136 171 0 R /R39 58 0 R /R138 175 0 R /R87 150 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /Group 157 0 R /MediaBox [ 0 0 612 792 ] /Annots [ 179 0 R 180 0 R 181 0 R 182 0 R 183 0 R 184 0 R 185 0 R 186 0 R 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R 193 0 R 194 0 R ] /Type /Page >> endobj 5 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 195 0 R /Resources << /ExtGState << /R38 33 0 R >> /Font << /R144 158 0 R /R166 196 0 R /R164 201 0 R /R47 40 0 R /R170 205 0 R /R45 44 0 R /R168 208 0 R /R43 48 0 R /R41 52 0 R /F2 212 0 R /F1 213 0 R /R172 214 0 R /R39 58 0 R /R162 219 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 222 0 R 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R 231 0 R 232 0 R ] >> endobj 6 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 233 0 R /Resources << /ExtGState << /R38 33 0 R >> /Font << /R144 158 0 R /R166 196 0 R /R162 219 0 R /R47 40 0 R /R170 205 0 R /R45 44 0 R /R168 208 0 R /R43 48 0 R /R41 52 0 R /F2 234 0 R /F1 235 0 R /R39 58 0 R /R198 236 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R 257 0 R 258 0 R ] >> endobj 7 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 259 0 R /Resources << /ExtGState << /R38 33 0 R >> /Font << /R144 158 0 R /R142 166 0 R /R47 40 0 R /R218 260 0 R /R45 44 0 R /R216 264 0 R /R43 48 0 R /R41 52 0 R /F2 267 0 R /F1 268 0 R /R136 171 0 R /R39 58 0 R /R198 236 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 269 0 R 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R ] >> endobj 8 0 obj << /Parent 1 0 R /Rotate 0 /Contents 279 0 R /Resources << /XObject << /R239 280 0 R /R238 281 0 R /R237 282 0 R /R236 283 0 R /R248 284 0 R /R249 285 0 R /R246 286 0 R /R247 287 0 R /R244 288 0 R /R245 289 0 R /R242 290 0 R /R243 291 0 R /R240 292 0 R /R241 293 0 R >> /ExtGState << /R38 33 0 R >> /Font << /R47 40 0 R /R45 44 0 R /R170 205 0 R /R41 52 0 R /F2 294 0 R /F1 295 0 R /R39 58 0 R >> /ProcSet [ /Text /ImageC /ImageB /PDF /ImageI ] >> /Group 296 0 R /MediaBox [ 0 0 612 792 ] /Annots [ 297 0 R 298 0 R 299 0 R 300 0 R 301 0 R 302 0 R 303 0 R 304 0 R 305 0 R 306 0 R 307 0 R ] /Type /Page >> endobj 9 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 308 0 R /Resources << /XObject << /R282 309 0 R /R283 310 0 R /R280 311 0 R /R281 312 0 R /R269 313 0 R /R279 314 0 R /R278 315 0 R /R273 316 0 R /R272 317 0 R /R271 318 0 R /R270 319 0 R /R277 320 0 R /R276 321 0 R /R275 322 0 R /R274 323 0 R >> /ExtGState << /R38 33 0 R >> /Font << /R144 158 0 R /R142 166 0 R /R47 40 0 R /R170 205 0 R /R45 44 0 R /R43 48 0 R /R284 324 0 R /F2 327 0 R /F1 328 0 R /R41 52 0 R /R136 171 0 R >> /ProcSet [ /Text /ImageC /ImageB /PDF /ImageI ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 329 0 R 330 0 R 331 0 R 332 0 R 333 0 R 334 0 R 335 0 R 336 0 R 337 0 R 338 0 R 339 0 R 340 0 R 341 0 R 342 0 R ] >> endobj 10 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 343 0 R /Resources << /ExtGState << /R38 33 0 R >> /Font << /R162 219 0 R /R140 163 0 R /R142 166 0 R /R47 40 0 R /R170 205 0 R /R45 44 0 R /R43 48 0 R /R41 52 0 R /F2 344 0 R /F1 345 0 R /R136 171 0 R /R39 58 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 346 0 R 347 0 R 348 0 R 349 0 R 350 0 R 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R ] >> endobj 11 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 364 0 R /Resources << /ExtGState << /R38 33 0 R >> /Font << /F2 365 0 R /F1 366 0 R /R43 48 0 R /R41 52 0 R /R39 58 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ ] >> endobj 12 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 367 0 R /Resources << /ExtGState << /R38 33 0 R >> /Font << /F2 368 0 R /F1 369 0 R /R43 48 0 R /R41 52 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ ] >> endobj 13 0 obj << /Type /Catalog /Pages 1 0 R >> endobj 14 0 obj << /Length 21566 >> stream q q q 0.1 0 0 0.1 0 0 cm /R38 gs 0 g q 10 0 0 10 0 0 cm BT /R39 14.3462 Tf 1 0 0 1 170.183 675.067 Tm [ (N) 19.9959 (A) 55.0117 (G\072) -249.988 (Netw) 9.99455 (ork) -250 (f) 24.9923 (or) -249.995 (Adv) 10.0014 (ersary) -250.007 (Generation) ] TJ /R41 11.9552 Tf -53.1406 -37.8582 Td [ (K) 34.9949 (onda) -249.998 (Reddy) -250.007 (Mopuri\052\054) -249.991 (Utkarsh) -250.008 (Ojha\052\054) -250 (Utsa) 20.0149 (v) -250.002 (Gar) 18.0157 (g) -250.002 (and) -249.987 (R\056) -249.987 (V) 110.994 (enkatesh) -249.989 (Bab) 20 (u) ] TJ 47.2828 -13.9469 Td [ (V) 59.9906 (ideo) -250.011 (Analytics) -249.983 (Lab\054) -250.004 (Computational) -250.004 (and) -249.987 (Data) -249.995 (Sciences) ] TJ 27.568 -13.948 Td [ (Indian) -250.004 (Institute) -250.016 (of) -250.014 (Science\054) -249.993 (Bang) 4.99301 (alore\054) -250.01 (India) ] TJ /R39 11.9552 Tf -45.898 -41.0461 Td (Abstract) Tj /R43 9.9626 Tf -83.9277 -24.827 Td [ (Adver) 10.0045 (sarial) -309.99 (perturbations) -310 (can) -311 (pose) -310.014 (a) -309.983 (serious) -309.995 (thr) 36.9914 (eat) -311 (for) ] TJ -11.9551 -11.9551 Td [ (deploying) -393.002 (mac) 14.9816 (hine) -393.02 (learning) -392.997 (systems\056) -740.011 (Recent) -392.991 (works) -393.005 (have) ] TJ 11.9559 TL T* [ (shown) -359.004 (e) 19.9924 (xistence) -358.99 (of) -358.987 (ima) 10.013 (g) 10.0032 (e\055a) 9.99588 (gnostic) -359.007 (perturbations) -359.011 (that) -359.014 (can) ] TJ 11.9551 TL T* [ (fool) -260.991 <636c61737369026572> 9.99343 (s) -261.009 (o) 10.0032 (ver) -261.018 (most) -260.014 (natur) 15.0061 (al) -261.003 (ima) 10.013 (g) 10.0032 (es\056) -342.997 (Existing) -261.018 (methods) ] TJ T* [ (pr) 36.9852 (esent) -219.012 (optimization) -220.011 (appr) 44.9937 (oac) 14.984 (hes) -219.015 (that) -218.998 (solve) -219.993 (for) -219.005 (a) -219.017 (fooling) -220 (ob\055) ] TJ T* [ (jective) -315.002 (with) -315.993 (an) -314.996 (imper) 36.9914 (ceptibility) -315.985 (constr) 15.0024 (aint) -314.982 (to) -316.013 (cr) 15.0196 (aft) -314.987 (the) -316.018 (per) 20.004 (\055) ] TJ T* [ (turbations\056) -661.985 (Howe) 14.995 (ver) 110.999 (\054) -396.99 (for) -367.018 (a) -366.993 (given) -368.008 <636c61737369026572> 110.996 (\054) -396.01 (the) 30.0023 (y) -367.983 (g) 10.0032 (ener) 15.0196 (ate) ] TJ T* [ (one) -285.986 (perturbation) -286.011 (at) -285 (a) -285.987 (time) 10.0106 (\054) -295.007 (whic) 14.9987 (h) -285.987 (is) -284.998 (a) -285.987 (single) -286.004 (instance) -286.004 (fr) 44.9851 (om) ] TJ 11.9563 TL T* [ (the) -364.99 (manifold) -364.013 (of) -364.986 (adver) 10.0057 (sarial) -365 (perturbations\056) -654.018 (Also\054) -393.008 (in) -364.986 (or) 36.9865 (der) ] TJ 11.9547 TL T* [ (to) -330.991 (b) 20.0016 (uild) -331.018 (r) 45.0182 (ob) 20.0065 (ust) -330.005 (models\054) -351.015 (it) -330.989 (is) -330.99 (essential) -329.988 (to) -330.991 (e) 19.9918 (xplor) 36.9938 (e) -331.008 (the) -330.996 (mani\055) ] TJ T* [ (fold) -248.013 (of) -247.986 (adver) 10.0057 (sarial) -248 (perturbations\056) -309.018 (In) -247.997 (this) -248.013 (paper) 111.018 (\054) -249.015 (we) -247.988 (pr) 44.9851 (opose) ] TJ T* [ (for) -338.004 (the) -338.014 <0272> 10.0094 (st) -338.009 (time) 10.0106 (\054) -360.996 (a) -338.017 (g) 10.0032 (ener) 15.0196 (ative) -338.011 (appr) 44.9937 (oac) 14.9828 (h) -338.017 (to) -338.01 (model) -338.988 (the) -338.015 (dis\055) ] TJ T* [ (trib) 19.9832 (ution) -315.016 (of) -314.994 (adver) 10.0057 (sarial) -315.989 (perturbations\056) -504.986 (The) -316.011 (ar) 38.0059 (c) 15.0122 (hitectur) 37.0036 (e) -315.991 (of) ] TJ T* [ (the) -372.989 (pr) 44.9839 (oposed) -373.014 (model) -372.981 (is) -372.003 (inspir) 37.011 (ed) -372.995 (fr) 44.9864 (om) -372.989 (that) -373.011 (of) -372.984 (GANs) -373.009 (and) -372.982 (is) ] TJ 11.9563 TL T* [ (tr) 14.9914 (ained) -290.012 (using) -290.002 (fooling) -289.988 (and) -290.015 (diver) 10.0081 (sity) -290.014 (objectives\056) -431.004 (Our) -290.015 (tr) 14.9901 (ained) ] TJ 11.9551 TL T* [ (g) 10.0032 (ener) 15.0196 (ator) -391.009 (network) -391.985 (attempts) -390.997 (to) -392 (captur) 36.9987 (e) -390.998 (the) -390.986 (distrib) 20.0016 (ution) -391.984 (of) ] TJ T* [ (adver) 10.0057 (sarial) -275.015 (perturbations) -276.007 (for) -274.995 (a) -275.988 (given) -275.004 <636c61737369026572> -275.018 (and) -276.018 (r) 37.0183 (eadily) ] TJ T* [ (g) 10.0032 (ener) 15.0196 (ates) -271 (a) -271.009 (wide) -270.993 (variety) -269.982 (of) -271.001 (suc) 14.9852 (h) -271.009 (perturbations\056) -373.006 (Our) -270.999 (e) 19.9918 (xper) 20 (\055) ] TJ T* [ (imental) -274.003 (e) 15.0128 (valuation) -273.991 (demonstr) 15.011 (ates) -274.019 (that) -274.008 (perturbations) -274.006 (cr) 15.0196 (afted) ] TJ T* [ (by) -325.004 (our) -326.008 (model) -324.989 (\050i\051) -325.984 (ac) 15.0183 (hie) 14.9852 (ve) -325.013 (state\055of\055the\055art) -326.014 (fooling) -325.002 (r) 14.9828 (ates\054) -344.984 (\050ii\051) ] TJ 11.9559 TL T* [ (e) 19.9924 (xhibit) -315.999 (wide) -314.985 (variety) -316.013 (and) -314.992 (\050iii\051) -316.011 (deliver) -316.013 (e) 19.9918 (xcellent) -314.996 (cr) 45.0145 (oss) -316.009 (model) ] TJ 11.9551 TL T* [ (g) 10.0032 (ener) 15.0196 (alizability) 54.9921 (\056) -406.008 (Our) -280.998 (work) -282.012 (can) -281.986 (be) -281.991 (deemed) -281.992 (as) -281.98 (an) -281.982 (important) ] TJ T* [ (step) -221.988 (in) -223.009 (the) -221.994 (pr) 44.9839 (ocess) -223.013 (of) -221.99 (inferring) -221.997 (about) -222.995 (the) -221.995 (comple) 20.0089 (x) -222.987 (manifolds) ] TJ T* [ (of) -249.985 (adver) 10.0057 (sarial) -250 (perturbations\056) ] TJ /R39 11.9552 Tf 38.6152 TL T* [ (1\056) -249.99 (Intr) 18.0146 (oduction) ] TJ /R41 9.9626 Tf 11.9551 -19.8457 Td [ (Machine) -425.012 (learning) -475.002 (systems) -424.989 (are) -425 (sho) 24.9922 (wn) -425.02 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 224.039 210.011 Tm (5) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 229.021 210.011 Tm (\054) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 235.745 210.011 Tm (4) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 240.727 210.011 Tm (\054) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 247.461 210.011 Tm (11) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 257.424 210.011 Tm [ (\135) -424.99 (to) -425.015 (be) ] TJ -207.312 -11.9551 Td [ (vulnerable) -391.014 (to) -390.981 (adv) 14.984 (ersarial) -392.012 (noise\072) -591.993 (small) -391.003 (b) 20.0016 (ut) -390.981 (structured) -391.993 (per) 19.9942 (\055) ] TJ 11.9551 TL T* [ (turbation) -391 (added) -390.987 (to) -390.981 (the) -390.986 (input) -391.003 (that) -391.018 (af) 25.0081 (fects) -392.011 (the) -390.986 (model\047) 54.9933 (s) -390.989 (pre\055) ] TJ T* [ (diction) -480.005 (drastically) 64.9977 (\056) -999.988 (Recently) 64.9941 (\054) -537.986 (the) -479.991 (most) -480.008 (successful) -480.018 (Deep) ] TJ 11.9559 TL T* [ (Neural) -269.011 (Netw) 10.0069 (ork) -269.007 (based) -269.987 (object) -268.998 <636c6173736902657273> -268.982 (ha) 19.9967 (v) 14.9828 (e) -269.019 (also) -269 (been) -269.992 (ob\055) ] TJ 11.9551 TL T* [ (serv) 14.9816 (ed) -235.019 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 81.6242 150.235 Tm (29) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 91.5867 150.235 Tm (\054) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 96.4086 150.235 Tm (9) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 101.39 150.235 Tm (\054) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 106.222 150.235 Tm (19) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 116.184 150.235 Tm (\054) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 121.016 150.235 Tm (16) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 130.979 150.235 Tm (\054) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 135.811 150.235 Tm (22) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 145.773 150.235 Tm [ (\135) -234.004 (to) -235.007 (be) -235.018 (susceptible) -234.003 (to) -235.007 (adv) 14.9828 (ersarial) -235.02 (at\055) ] TJ -95.6613 -11.9551 Td [ (tacks) -257.006 (with) -256.014 (almost) -256.983 (imperceptible) -256.98 (perturbations\056) -329.984 (Researchers) ] TJ 11.9551 TL T* [ (ha) 19.9973 (v) 14.9828 (e) -248.982 (attempted) -248.987 (to) -249.005 (e) 15.0122 (xplain) -248.993 (this) -248.992 (intriguing) -249.985 (as) 0.98268 (pect) -249.995 (via) -249.01 (h) 4.98446 (ypoth\055) ] TJ T* [ (esizing) -316.004 (linear) -316.999 (beha) 19.9979 (viour) -316.007 (of) -315.985 (the) -316.999 (models) -315.994 (\050) ] TJ /R43 9.9626 Tf 162.032 0 Td [ (e) 15.0122 (\056g) ] TJ /R41 9.9626 Tf 11.7457 0 Td [ (\056) -315.984 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 232.846 114.37 Tm (9) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 237.827 114.37 Tm (\054) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 243.476 114.37 Tm (19) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 253.439 114.37 Tm [ (\135\051\054) -333.008 <026e697465> ] TJ -203.327 -11.9563 Td [ (training) -252.008 (data) -253.013 (\050) ] TJ /R43 9.9626 Tf 55.9367 0 Td [ (e) 15.0122 (\056g) ] TJ /R41 9.9626 Tf 11.7461 0 Td [ (\056) -251.995 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 126.114 102.414 Tm (3) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 131.095 102.414 Tm [ (\135\051\054) -252.981 (etc\056) -317.005 (More) -253.008 (importantly) 64.9843 (\054) -253.014 (the) -251.99 (adv) 14.9828 (ersar) 19.9869 (\055) ] TJ ET Q 3.98 w 0 G 501.121 904.148 m 1446.11 904.148 l S q 10 0 0 10 0 0 cm BT /R41 7.9701 Tf 1 0 0 1 64.4578 81 Tm [ (\052) -250.02 (Equal) -249.994 (contrib) 19.9966 (ution\056) ] TJ /R41 9.9626 Tf 244.404 487.268 Td [ (ial) -289.981 (perturbations) -289.993 (e) 15.0122 (xhibit) -289.993 (cross) -289.981 (model) -290.006 (generalizability) 65.0088 (\056) -430.002 (That) ] TJ 11.9551 TL T* [ (is\054) -272.018 (the) -267.987 (perturbations) -267.017 (learned) -267.995 (on) -267.004 (one) -267.99 (model) -268.009 (can) -267.019 (fool) -267.98 (another) ] TJ 11.9559 TL T* [ (model) -260.011 (e) 25.0105 (v) 14.9828 (en) -259.996 (if) -259.991 (the) -259.988 (second) -259.984 (model) -260.011 (has) -261.01 (a) -260 (dif) 24.986 (ferent) -260 (architecture) ] TJ 11.9551 TL T* [ (or) -249.995 (has) -249.99 (been) -249.995 (trained) -249.985 (with) -250.015 (dif) 24.986 (ferent) -250.002 (dataset) -249.983 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 477.1 532.402 Tm (29) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 487.063 532.402 Tm (\054) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 492.044 532.402 Tm (9) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 497.025 532.402 Tm (\135\056) Tj -176.208 -16.4848 Td [ (Recent) -215.011 (startling) -216.006 <026e64696e6773> -215.013 (by) -215.993 (Moosa) 20.0212 (vi\055Dezfooli) ] TJ /R43 9.9626 Tf 185.971 0 Td [ (et) -214.979 (al\056) ] TJ /R41 9.9626 Tf 21.7262 0 Td (\133) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 531.832 515.917 Tm (18) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 541.794 515.917 Tm (\135) Tj -232.932 -11.9563 Td [ (and) -281.987 (Mopuri) ] TJ /R43 9.9626 Tf 49.8961 0 Td [ (et) -281.99 (al\056) ] TJ /R41 9.9626 Tf 23.0559 0 Td (\133) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 385.132 503.961 Tm (21) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 395.094 503.961 Tm (\054) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 400.394 503.961 Tm (20) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 410.357 503.961 Tm [ (\135) -281.997 (ha) 19.9967 (v) 14.9828 (e) -281.997 (sho) 24.9909 (wn) -283.002 (that) -282.017 (it) -282.017 (is) -282.017 (possible) -281.992 (to) ] TJ -101.495 -11.9551 Td [ (mislead) -256.006 (multiple) -255.989 (state\055of\055the\055art) -255.987 (deep) -255.996 (neural) -257.011 (netw) 10.0081 (orks) -255.982 (o) 14.9828 (v) 14.9828 (er) ] TJ 11.9547 TL T* [ (most) -236.99 (of) -237.017 (the) -237.012 (images) -236.997 (by) -237.009 (a) 1.01454 (d) -1.01454 (di) 0.99003 (ng) -237.009 (a) -236.985 (single) -236.995 (perturbation\056) -305.993 (That) -237.009 (is\054) ] TJ T* [ (these) -308.997 (perturbations) -309.01 (are) -309.02 (image\055agnostic) -309.007 (and) -309.002 (can) -309.012 (fool) -308.993 (multi\055) ] TJ T* [ (ple) -303 (di) 24.9885 (v) 14.9828 (erse) -303.013 (netw) 10.0081 (orks) -302.016 (trained) -302.994 (on) -302.998 (a) -303.013 (tar) 17.997 (get) -302.998 (dataset) 0.99493 (\056) -469.015 (Such) -302.989 (per) 19.9918 (\055) ] TJ 11.9559 TL T* [ (turbations) -222.002 (are) -220.995 (named) -221.987 (\223Uni) 24.986 (v) 14.9828 (ersal) -220.983 (Adv) 14.9926 (ersarial) -222.002 (Perturbations\224) ] TJ 11.9551 TL T* [ (\050U) 39.9933 (AP\051\054) -336.005 (because) -337.005 (a) -335.988 (single) -337.015 (adv) 14.9828 (ersarial) -335.983 (noise) -336.983 (can) -335.988 (perturb) -336.993 (im\055) ] TJ T* [ (ages) -392.011 (from) -390.984 (multiple) -392.006 (classes\056) -734.02 (On) -392.003 (one) -390.989 (side\054) -427.012 (the) -392.003 (adv) 14.9828 (ersarial) ] TJ T* [ (noise) -290.991 (poses) -290.013 (a) -291.015 (se) 25.0179 (v) 14.9828 (ere) -290.003 (threat) -291 (for) -291.01 (deplo) 10.0179 (ying) -290.006 (machine) -290.996 (learning) ] TJ T* [ (based) -372.989 (systems) -372.997 (in) -374.004 (the) -372.989 (real) -373.001 (w) 10.0032 (orld\056) -679.989 (P) 14.9926 (articularly) 64.9892 (\054) -404.006 (for) -372.997 (the) -374.006 (ap\055) ] TJ T* [ (plications) -247.015 (that) -247.983 (in) 40.0056 (v) 20.0016 (olv) 14.995 (e) -246.983 (safety) -247.993 (and) -247.013 (pri) 24.986 (v) 24.9811 (ac) 15.0073 (y) -247.993 (\050) ] TJ /R43 9.9626 Tf 168.345 0 Td [ (e) 15.0122 (\056g) ] TJ /R41 9.9626 Tf 11.7461 0 Td [ (\056\054) -247.993 (autonomous) ] TJ -180.091 -11.9559 Td [ (dri) 24.986 (ving) -353.017 (and) -352.015 (access) -353.005 (granting\051\054) -377.991 (it) -352.005 (is) -352.985 (essential) -353.015 (to) -352.01 (de) 25.0154 (v) 14.9828 (elop) -352.985 (ro\055) ] TJ T* [ (b) 20.0016 (ust) -302.991 (models) -303.016 (ag) 5.01877 (ainst) -302.986 (adv) 14.9828 (ersarial) -303.008 (attacks\056) -469.005 (On) -303.979 (the) -302.998 (other) -302.998 (side\054) ] TJ T* [ (it) -227.006 (also) -227.986 (poses) -227.004 (a) -226.987 (challenge) -227.009 (to) -227.991 (our) -227.016 (understanding) -227.016 (of) -227.021 (these) -227.991 (mod\055) ] TJ T* [ (els) -261.986 (and) -261.01 (the) -261.988 (current) -261.993 (learning) -260.996 (practices\056) -344.996 (Thus\054) -264.99 (the) -261.986 (adv) 14.9828 (ersarial) ] TJ T* [ (beha) 20 (viour) -328.984 (of) -329.001 (the) -328.997 (deep) -327.982 (learning) -328.984 (models) -329.014 (to) -328.994 (small) -329.014 (and) -329 (struc\055) ] TJ T* [ (tured) -300.019 (noise) -300.009 (demands) -300.004 (a) -299.014 (rigorous) -300.004 (study) -299.999 (no) 24.986 (w) -299.984 (more) -300.019 (than) -300.014 (e) 25.0105 (v) 14.9828 (er) 55 (\056) ] TJ 11.9551 -28.441 Td [ (All) -276.995 (the) -277.985 (e) 15.0122 (xisting) -277.01 (methods\054) -283.992 (weather) -277.993 (image) -276.998 <73706563690263> -276.993 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 522.42 284.238 Tm (29) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 532.382 284.238 Tm (\054) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 537.643 284.238 Tm (9) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 542.624 284.238 Tm (\054) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 308.862 272.283 Tm (19) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 318.825 272.283 Tm (\054) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 325.32 272.283 Tm (6) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 330.302 272.283 Tm (\054) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 336.787 272.283 Tm (17) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 346.75 272.283 Tm [ (\135) -402.014 (or) -400.989 (agnostic) -401.984 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 406.894 272.283 Tm (18) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 416.856 272.283 Tm (\054) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 423.342 272.283 Tm (21) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 433.304 272.283 Tm (\054) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 439.8 272.283 Tm (20) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 449.763 272.283 Tm [ (\135\054) -438.986 (can) -402.016 (craft) -402.021 (only) -401.007 (a) -402.016 (sin\055) ] TJ -140.9 -11.9559 Td [ (gle) -261.008 (perturbation) -260.983 (that) -261.981 (mak) 10.013 (es) -261.015 (the) -261.005 (tar) 17.997 (get) -261.986 (class) 0.99003 <69026572> -261.981 (susceptible\056) ] TJ 11.9551 TL T* [ <53706563690263616c6c79> 65.0137 (\054) -350.018 (these) -330.014 (methods) -329.989 (typically) -329.989 (learn) -329.984 (a) -329.989 (single) -329.999 (pertur) 20.0016 (\055) ] TJ (bation) ' /R45 9.9626 Tf 28.0551 0 Td [ (\050) -0.90181 ] TJ /R47 9.9626 Tf 3.875 0 Td [ <0e> -0.39944 ] TJ /R45 9.9626 Tf 4.80391 0 Td [ (\051) -0.90181 ] TJ /R41 9.9626 Tf 7.02383 0 Td [ (from) -316.016 (a) -315.991 (possibly) -316.021 (bigger) -316.011 (set) -316.016 (of) -315.986 (perturbations) ] TJ /R45 9.9626 Tf 176.441 0 Td [ (\050) -0.90181 <01> -0.29897 (\051) -0.90181 ] TJ /R41 9.9626 Tf -220.199 -11.9551 Td [ (that) -342.007 (can) -341.004 (fool) -342.007 (the) -340.995 (tar) 17.997 (get) -342.014 <636c61737369026572> 54.9957 (\056) -584.996 (It) -340.997 (is) -342.007 (observ) 14.9926 (ed) -341.982 (t) 0.98513 (h) -1.01454 (a) 1.01454 (t) -342.016 (for) -341.982 (a) ] TJ T* [ (gi) 24.9885 (v) 14.9828 (en) -358.999 (technique) -359.016 (\050) ] TJ /R43 9.9626 Tf 70.9391 0 Td [ (e) 15.0122 (\056g) ] TJ /R41 9.9626 Tf 11.7457 0 Td [ (\056\054) -386.009 (U) 39.9958 (AP) -358.979 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 426.795 212.507 Tm (18) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 436.757 212.507 Tm [ (\135\054) -386.014 (FFF) -358.014 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 469.913 212.507 Tm (21) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 479.875 212.507 Tm [ (\135\051\054) -386.019 (the) -358.989 (perturba\055) ] TJ -171.013 -11.9547 Td [ (tions) -268.004 (learned) -267.995 (across) -267.99 (multiple) -267.99 (runs) -267.98 (are) -268.004 (not) -268.014 (v) 14.9828 (ery) -268 (dif) 24.986 (ferent\056) -364.998 (In) ] TJ 11.9563 TL T* [ (spite) -274.011 (of) -273.011 (op) -1.00964 (t) 0.98758 (imizing) -273.993 (with) -274.011 (a) -273.998 (dif) 24.986 (ferent) -273.018 (data) -273.989 (ordering) -274.018 (or) -273.993 (initial\055) ] TJ 11.9547 TL T* [ (ization\054) -349.015 (their) -330.011 (objecti) 24.9983 (v) 14.9828 (es) -329.001 (end) -329 (up) -330.014 (learning) -328.984 (v) 14.9828 (ery) -329.009 (close) -330.014 (pertur) 20.0016 (\055) ] TJ T* [ (bations) -331.011 (in) -330.991 (the) -332.016 (space) -331.006 (\050refer) -330.984 (sec\056) ] TJ ET Q 1 0 0 rg q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 436.822 164.686 Tm (3\0563) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R41 9.9626 Tf 1 0 0 1 449.275 164.686 Tm [ (\051\056) -553.986 (In) -331.004 (essence\054) -352.02 (t) 0.98513 (hese) -331.984 (ap\055) ] TJ -140.413 -11.9551 Td [ (proaches) -192.982 (can) -192.99 (only) -193.005 (pro) 14.9852 (v) 14.9828 (e) -192.992 (that) -191.992 (the) -193.017 (U) 39.9982 (APs) -193.002 (e) 15.0122 (xist) -193.002 (for) -192.987 (a) -192.992 (gi) 24.986 (v) 14.9828 (en) -192.987 (clas\055) ] TJ 11.9551 TL T* [ <7369026572> -195.987 (by) -195.997 (crafting) -195.997 (one) -194.982 (such) -195.997 (perturbation) ] TJ /R45 9.9626 Tf 153.923 0 Td [ (\050) -0.90181 ] TJ /R47 9.9626 Tf 3.875 0 Td [ <0e> -0.40189 ] TJ /R45 9.9626 Tf 4.80391 0 Td [ (\051) -0.90181 ] TJ /R41 9.9626 Tf 3.875 0 Td [ (\056) -291.986 (This) -195.982 (is) -195.992 (v) 14.9828 (ery) -196.011 (lim) 1.00473 (\055) ] TJ -166.477 -11.9551 Td [ (ited) -350.986 (information) -350.995 (about) -350.983 (the) -350.99 (underlying) -351 (distrib) 19.9918 (ution) -351.01 (of) -351 (such) ] TJ 11.9559 TL T* [ (perturbations) -386.997 (and) -386.989 (in) -386.982 (turn) -387.019 (about) -387.014 (the) -386.984 (tar) 17.997 (get) -386.984 <636c61737369026572> -387.009 (itself\056) ] TJ 11.9551 TL T* [ (Therefore\054) -268.002 (a) -264 (more) -263.985 (rele) 25.0105 (v) 24.9811 (ant) -263.985 (task) -263.98 (at) -263.99 (hand) -263.985 (is) -263.98 (to) -263.985 (model) -264.01 (the) -263.985 (dis\055) ] TJ T* [ (trib) 20.0138 (ution) -260.986 (of) -261.013 (adv) 14.9828 (ersarial) -261.015 (perturbations\056) -341.982 (Doing) -260.991 (so) -261.005 (can) -261.02 (help) -261 (us) ] TJ T* [ (better) -346.994 (analyze) -347 (the) -348.013 (susceptibility) -347.011 (of) -347 (the) -346.991 (models) -347.011 (ag) 5.01877 (ainst) -348 (ad\055) ] TJ ET Q Q Q q q 1 1 1 rg /a0 gs 48.406 786.422 515.188 -52.699 re f q /s5 gs /x6 Do Q q /s7 gs /x8 Do Q q /s9 gs /x10 Do Q q /s11 gs /x12 Do Q Q Q Q q 1 0 0 1 0 0 cm BT /F1 12 Tf 14.4 TL ET 1 1 1 rg n 270 32 72 14 re f* 0.5 0.5 0.5 rg BT /F2 9 Tf 10.8 TL ET BT 1 0 0 1 299.25 35 Tm (742) Tj T* ET Q endstream endobj 15 0 obj << /Filter /FlateDecode /Resources << /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x18 16 0 R >> >> /Length 28 /Group << /Type /Group /S /Transparency /CS /DeviceRGB /I true >> /BBox [ 78 746 96 765 ] /Type /XObject /Subtype /Form >> stream x+O4PH/VЯ0Pp 0 endstream endobj 16 0 obj << /Filter /FlateDecode /Resources 17 0 R /Length 107 /Type /XObject /BBox [ 78 746 96 765 ] /Subtype /Form >> stream xe AC̬wʠ =p,?]%+H-
Jc "82w8VSnGW;"
endstream
endobj
17 0 obj
<<
/ExtGState <<
/a0 <<
/CA 1
/ca 1
>>
>>
>>
endobj
18 0 obj
<<
/Filter /FlateDecode
/Resources <<
/ExtGState <<
/a0 <<
/CA 1
/ca 1
>>
>>
/XObject <<
/x15 19 0 R
>>
>>
/Length 28
/Group <<
/Type /Group
/S /Transparency
/CS /DeviceRGB
/I true
>>
/BBox [ 67 752 84 775 ]
/Type /XObject
/Subtype /Form
>>
stream
x+O4PH/VЯ04Up
0
endstream
endobj
19 0 obj
<<
/Filter /FlateDecode
/Resources 20 0 R
/Length 228
/Type /XObject
/BBox [ 67 752 84 775 ]
/Subtype /Form
>>
stream
xeQKn!s ?FPav6R٪TS.
b];15YyR
{7QL.\:Rv/x9l+L7h%1!}i/AI(kz"U&,YO![R hg{3}4/GyYF:!w}Gn+'xJcO9i뽼_-:`
endstream
endobj
20 0 obj
<<
/ExtGState <<
/a0 <<
/CA 1
/ca 1
>>
>>
>>
endobj
21 0 obj
<<
/Filter /FlateDecode
/Resources <<
/ExtGState <<
/a0 <<
/CA 1
/ca 1
>>
>>
/XObject <<
/x24 22 0 R
>>
>>
/Length 28
/Group <<
/Type /Group
/S /Transparency
/CS /DeviceRGB
/I true
>>
/BBox [ 132 751 480 772 ]
/Type /XObject
/Subtype /Form
>>
stream
x+O4PH/VЯ02Qp
0
endstream
endobj
22 0 obj
<<
/Filter /FlateDecode
/Resources 23 0 R
/Length 53223
/Type /XObject
/BBox [ 132 751 480 772 ]
/Subtype /Form
>>
stream
xtI:6%Q㨈?7rA= u%6 ?Y(WbWo{B>9
x`Znϳ|8{3?0x*z ǃ|,@:w>`c|*ϻⳅKO3`g
:_|}}><.6`Z{{3]#<_o"~:ͺgk7/Ұ@|K yp ]03ʷCmş8˽Y?>(3!Bwqs.Z8,~~=rMT̩y+/*w: uBZ_`ߵp`%M?ɝ1ɳw=vDۉy&xb4Q>d@ sg~lA