%PDF-1.3 1 0 obj << /Kids [ 3 0 R 4 0 R 5 0 R 6 0 R 7 0 R 8 0 R 9 0 R 10 0 R 11 0 R ] /Type /Pages /Count 9 >> endobj 2 0 obj << /Title (DeepFool\072 A Simple and Accurate Method to Fool Deep Neural Networks) /Producer (PyPDF2) /Author (Seyed\055Mohsen Moosavi\055Dezfooli\054 Alhussein Fawzi\054 Pascal Frossard) /Subject (2016 IEEE Conference on Computer Vision and Pattern Recognition) >> endobj 3 0 obj << /Parent 1 0 R /Rotate 0 /Contents 13 0 R /Resources << /XObject << /x8 14 0 R /R46 17 0 R /R45 18 0 R /x12 19 0 R /x6 22 0 R /x10 25 0 R >> /ExtGState << /s9 28 0 R /s11 31 0 R /a0 << /CA 1 /ca 1 >> /R21 34 0 R /s5 35 0 R /s7 38 0 R >> /Font << /R42 41 0 R /R40 45 0 R /F2 50 0 R /R28 51 0 R /F1 54 0 R /R38 55 0 R /R36 58 0 R /R34 63 0 R /R22 67 0 R /R32 71 0 R /R24 75 0 R /R30 79 0 R /R26 83 0 R >> /ProcSet [ /Text /ImageC /ImageB /PDF /ImageI ] >> /Group 87 0 R /MediaBox [ 0 0 612 792 ] /Annots [ 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R 98 0 R ] /Type /Page >> endobj 4 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 99 0 R /Resources << /ExtGState << /R21 34 0 R >> /Font << /F1 100 0 R /R68 101 0 R /R70 105 0 R /R42 41 0 R /R40 45 0 R /F2 109 0 R /R64 110 0 R /R66 114 0 R /R38 55 0 R /R36 58 0 R /R34 63 0 R /R22 67 0 R /R32 71 0 R /R24 75 0 R /R30 79 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R ] >> endobj 5 0 obj << /Parent 1 0 R /Rotate 0 /Contents 128 0 R /Resources << /XObject << /R127 129 0 R /R125 132 0 R /R124 133 0 R /R121 135 0 R /R120 149 0 R /R129 150 0 R /R128 151 0 R /R145 152 0 R /R144 153 0 R /R147 168 0 R /R141 154 0 R /R140 156 0 R /R143 157 0 R /R142 158 0 R /R149 169 0 R /R107 146 0 R /R109 136 0 R /R108 137 0 R /R130 159 0 R /R131 160 0 R /R132 161 0 R /R133 162 0 R /R134 163 0 R /R136 164 0 R /R137 165 0 R /R138 166 0 R /R139 167 0 R /R156 170 0 R /R118 138 0 R /R119 139 0 R /R153 178 0 R /R112 140 0 R /R113 141 0 R /R110 142 0 R /R111 143 0 R /R116 144 0 R /R117 145 0 R /R114 148 0 R /R115 147 0 R /R155 177 0 R >> /ExtGState << /R154 171 0 R /R146 172 0 R /R150 173 0 R /R148 174 0 R /R106 130 0 R /R126 175 0 R /R123 176 0 R /R135 155 0 R /R95 193 0 R /R84 194 0 R >> /Font << /R42 41 0 R /R40 45 0 R /R98 183 0 R /R89 195 0 R /F1 199 0 R /R91 188 0 R /R93 200 0 R /R87 205 0 R /R85 210 0 R /R157 214 0 R /R151 179 0 R /R100 217 0 R /R102 220 0 R /R104 224 0 R /R24 75 0 R /F2 228 0 R /R64 110 0 R /R66 114 0 R /R96 229 0 R /R38 55 0 R /R36 58 0 R /R34 63 0 R /R22 67 0 R /R32 71 0 R /R68 101 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /Group 192 0 R /MediaBox [ 0 0 612 792 ] /Annots [ 232 0 R 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R ] /Type /Page >> endobj 6 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 238 0 R /Resources << /ExtGState << /R21 34 0 R /R175 239 0 R >> /Font << /R42 41 0 R /R40 45 0 R /F2 240 0 R /F1 241 0 R /R91 188 0 R /R93 200 0 R /R157 214 0 R /R102 220 0 R /R104 224 0 R /R68 101 0 R /R66 114 0 R /R38 55 0 R /R36 58 0 R /R34 63 0 R /R22 67 0 R /R32 71 0 R /R24 75 0 R /R30 79 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R ] >> endobj 7 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 251 0 R /Resources << /ExtGState << /R21 34 0 R >> /Font << /R202 252 0 R /R200 255 0 R /R198 258 0 R /R42 41 0 R /R40 45 0 R /R98 183 0 R /F1 263 0 R /R91 188 0 R /R93 200 0 R /R96 229 0 R /F2 264 0 R /R102 220 0 R /R104 224 0 R /R68 101 0 R /R66 114 0 R /R38 55 0 R /R36 58 0 R /R34 63 0 R /R22 67 0 R /R32 71 0 R /R24 75 0 R /R30 79 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 265 0 R 266 0 R 267 0 R 268 0 R 269 0 R 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R 279 0 R 280 0 R 281 0 R ] >> endobj 8 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 282 0 R /Resources << /ExtGState << /R21 34 0 R >> /Font << /R202 252 0 R /R104 224 0 R /R93 200 0 R /R198 258 0 R /R42 41 0 R /R40 45 0 R /F2 283 0 R /F1 284 0 R /R38 55 0 R /R36 58 0 R /R34 63 0 R /R22 67 0 R /R32 71 0 R /R24 75 0 R /R30 79 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R 291 0 R 292 0 R 293 0 R 294 0 R 295 0 R 296 0 R ] >> endobj 9 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 297 0 R /Resources << /ExtGState << /R229 298 0 R /R238 299 0 R >> /Font << /R239 300 0 R /R236 303 0 R /R234 306 0 R /R232 310 0 R /R230 314 0 R /F2 317 0 R /R24 75 0 R /F1 318 0 R /R36 58 0 R /R34 63 0 R /R245 319 0 R /R243 323 0 R /R30 79 0 R /R241 326 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 329 0 R 330 0 R 331 0 R 332 0 R ] >> endobj 10 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 333 0 R /Resources << /XObject << /R264 334 0 R /R256 336 0 R /R260 338 0 R /R258 340 0 R /R262 342 0 R >> /ExtGState << /R21 34 0 R /R238 299 0 R >> /Font << /R265 344 0 R /R267 348 0 R /R269 352 0 R /R98 183 0 R /F1 355 0 R /F2 356 0 R /R36 58 0 R /R91 188 0 R /R34 63 0 R /R22 67 0 R /R24 75 0 R /R30 79 0 R >> /ProcSet [ /Text /ImageC /ImageB /PDF /ImageI ] /ColorSpace << /R255 337 0 R /R257 341 0 R /R259 339 0 R /R261 343 0 R /R263 335 0 R >> >> /MediaBox [ 0 0 612 792 ] /Annots [ 357 0 R 358 0 R 359 0 R 360 0 R ] >> endobj 11 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 361 0 R /Resources << /ExtGState << /R21 34 0 R >> /Font << /F2 362 0 R /R28 51 0 R /F1 363 0 R /R24 75 0 R /R30 79 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 364 0 R 365 0 R ] >> endobj 12 0 obj << /Type /Catalog /Pages 1 0 R >> endobj 13 0 obj << /Length 13856 >> stream q q q 0.10000 0 0 0.10000 0 0 cm /R21 gs 0 g q 10 0 0 10 0 0 cm BT /R22 14.34620 Tf 1 0 0 1 83.63280 675.06700 Tm [ (DeepF) 24.99230 (ool\072) -309.99500 (a) -250.00800 (simple) -249.99600 (and) -249.99100 (accurate) -249.99000 (method) -250.01000 (to) -250.01200 (f) 24.99230 (ool) -250.00700 (deep) -249.99600 (neural) -249.99500 (netw) 10.00650 (orks) ] TJ /R24 11.95520 Tf 49.93200 -37.85820 Td [ (Se) 15.00760 (yed\055Mohsen) -249.99100 (Moosa) 19.98630 (vi\055Dezfooli\054) -249.99500 (Alhussein) -250.01400 (F) 15.01580 (a) 14.98920 (wzi\054) -250.01000 (P) 15.01580 (ascal) -249.98900 (Frossard) ] TJ 62.78830 -12.33710 Td (\264) Tj -1.66211 -2.60664 Td [ (Ecole) -250.01200 (Polytechnique) -250.00200 (F) ] TJ 108.91600 0.05977 Td (\264) Tj -0.66289 -0.05977 Td (ed) Tj 11.94880 0.05977 Td (\264) Tj -0.66289 -0.05977 Td [ (erale) -249.98500 (de) -250.00800 (Lausanne) ] TJ /R26 8.96640 Tf -171.86100 -13.94730 Td [ (f) -0.89990 ] TJ /R28 8.96640 Tf 4.60781 0 Td (seyed\056moosavi\054alhussein\056fawzi\054pascal\056frossard) Tj /R26 8.96640 Tf 242.09200 0 Td [ (g) -0.90126 ] TJ /R28 8.96640 Tf 9.98672 0 Td [ (at) -599.99400 (epfl\056ch) ] TJ /R22 11.95520 Tf -253.06100 -41.04610 Td (Abstract) Tj /R30 9.96260 Tf -83.92770 -24.42700 Td [ (State\055of\055the\055art) -251.00700 (deep) -251.99600 (neur) 14.99010 (al) -251.00500 (networks) -250.98300 (have) -251.01400 (ac) 15.01710 (hie) 14.98520 (ved) -252 (im\055) ] TJ -11.95510 -11.95510 Td [ (pr) 36.98520 (essive) -326.99800 (r) 37.01960 (esults) -327.01700 (on) -326.99400 (many) -326.99600 (ima) 10.01300 (g) 10.00320 (e) -327.00900 <636c6173736902636174696f6e> -326.98700 (tasks\056) -542.00500 (How\055) ] TJ 11.95470 TL T* [ (e) 15.01280 (ver) 110.99900 (\054) -376.01300 (these) -350.99000 (same) -350.99000 (ar) 36.98520 (c) 15.01220 (hitectur) 37.00360 (es) -351 (have) -351 (been) -350.99800 (shown) -351.00500 (to) -350.98800 (be) -351 (un\055) ] TJ T* [ (stable) -371.99000 (to) -372.00400 (small\054) -403 (well) -371.99300 (sought\054) -402.01500 (perturbations) -373.00900 (of) -372.00400 (the) -372.00900 (ima) 10.01300 (g) 10.00320 (es\056) ] TJ T* [ (Despite) -419.98900 (the) -420.98100 (importance) -420.01300 (of) -419.99600 (this) -421.00200 (phenomenon\054) -462.00900 (no) -421.01800 (ef) 18 (fective) ] TJ 11.95590 TL T* [ (methods) -270.00600 (have) -269.01300 (been) -269.99300 (pr) 44.98390 (oposed) -268.99200 (to) -269.98200 (accur) 14.98520 (ately) -269.98400 (compute) -268.99700 (the) -269.98700 (r) 45.01700 (o\055) ] TJ 11.95510 TL T* [ (b) 20.00160 (ustness) -317.99400 (of) -318.01300 (state\055of\055the\055art) -316.99500 (deep) -317.98500 <636c61737369026572> 9.99343 (s) -318.02000 (to) -318.01300 (suc) 14.98520 (h) -317.98100 (pertur) 19.98200 (\055) ] TJ T* [ (bations) -349 (on) -350.01000 (lar) 36.99260 (g) 10.00320 (e\055scal) 0.98635 (e) -349.98600 (datasets\056) -608.01600 (In) -349 (this) -349.01500 (paper) 111.01800 (\054) -374.01400 (we) -348.99100 <026c6c> -350 (this) ] TJ T* [ (gap) -229.00500 (and) -227.98600 (pr) 44.98390 (opose) -229.00300 (the) -227.99400 (DeepF) 105.00600 (ool) -229.00300 (algorithm) -229.00800 (to) -227.98900 (ef) 18 <026369656e746c79> -229.00100 (com\055) ] TJ T* [ (pute) -350.98700 (perturbations) -351.01400 (that) -351.01500 (fool) -351.01500 (deep) -351 (networks\054) -376.99800 (and) -350.98600 (thus) -351.01700 (r) 37.01830 (eli\055) ] TJ T* [ (ably) -312.99400 (quantify) -311.99000 (the) -313 (r) 45.01820 (ob) 20.00650 (ustness) -313.01500 (of) -312.01400 (these) -312.99700 <636c61737369026572> 9.99343 (s\056) -497.98600 (Extensive) ] TJ 11.95630 TL T* [ (e) 19.99240 (xperimental) -369.98400 (r) 37.01960 (esults) -369.99000 (show) -369.98700 (that) -369.99200 (our) -370 (appr) 44.99490 (oac) 14.98280 (h) -370.01200 (outperforms) ] TJ 11.95470 TL T* [ (r) 37.01960 (ecent) -236.98100 (methods) -236.01200 (in) -237.00700 (the) -237.01200 (task) -237.00600 (of) -235.98800 (computing) -236.98300 (adver) 10.00570 (sarial) -236.98300 (pertur) 19.98200 (\055) ] TJ T* [ (bations) -249.99600 (and) -249.98200 (making) -250.01600 <636c61737369026572> 9.99343 (s) -249.99100 (mor) 36.98770 (e) -250.00200 (r) 45.01820 (ob) 20.00650 (ust\056) ] TJ /R24 6.97380 Tf 173.22900 3.61484 Td (1) Tj /R22 11.95520 Tf -173.22900 -41.02770 Td [ (1\056) -249.99000 (Intr) 18.01460 (oduction) ] TJ /R24 9.96260 Tf 11.95510 -19.44530 Td [ (Deep) -253.99700 (neural) -253.99200 (netw) 10.00940 (orks) -253.00400 (are) -254.00900 (po) 24.98600 (werful) -253.99300 (learning) -254.01900 (models) -254.00400 (that) ] TJ -11.95510 -11.95470 Td [ (achie) 25.01480 (v) 14.98280 (e) -319.01000 (state\055of\055the\055art) -318.99500 (pattern) -318.99300 (recognition) -319.01000 (performance) -319.00600 (in) ] TJ T* [ (man) 14.99080 (y) -279.00700 (research) -278.00500 (areas) -278.98300 (such) -277.98100 (as) -279.01100 (bioinformatics) -278.02000 (\1331\054) -279.00700 (16\135\054) -285.98200 (speech) ] TJ T* [ (\13312\054) -415.02000 (6\135\054) -455.01800 (and) -414.98400 (computer) -415.00700 (visi) 1.00596 (on) -415.01900 (\13310\054) -415.01900 (8\135\056) -803.00300 (Though) -415 (deep) -414.98700 (net\055) ] TJ 11.95590 TL T* [ (w) 10.00140 (orks) -304.01500 (ha) 19.99730 (v) 14.98280 (e) -303.99300 (e) 15.01220 (xhibited) -303.99100 (v) 14.98280 (ery) -303.99100 (good) -304.00800 (performance) -303.98800 (in) -304.01500 <636c617373690263612d> ] TJ 11.95510 TL T* [ (tion) -258.01100 (tasks\054) -258.99300 (the) 14.98520 (y) -257.99100 (ha) 19.99790 (v) 14.98280 (e) -258.00100 (rec) 1.00718 (ently) -258.01600 (been) -257.99500 (sho) 24.99220 (wn) -257.00900 (to) -257.98400 (be) -257.99600 (particularly) ] TJ T* [ (unstable) -369.00900 (to) ] TJ /R30 9.96260 Tf 48.31600 0 Td [ (adver) 10.00570 (sarial) ] TJ /R24 9.96260 Tf 49.52700 0 Td [ (perturbations) -368.99800 (of) -370.01400 (the) -368.99000 (data) -370.01400 (\13318\135\056) -668.00100 (In) ] TJ -97.84300 -11.95510 Td [ (f) 9.99527 (act\054) -220.98200 (v) 14.98280 (ery) -212.98700 (small) -214.01500 (and) -213.99700 (often) -213.01300 (imperceptible) -214.00800 (perturbations) -212.98700 (of) -214.00100 (the) ] TJ T* [ (data) -233.01600 (samples) -234.01200 (a) 1.01454 (re) -234.00800 (suf) 24.98360 <026369656e74> -232.99500 (to) -233.00800 (fool) -233.98700 (state\055of\055the\055a) 0.98758 (rt) -233.99500 <636c6173736902657273> ] TJ 11.95630 TL T* [ (and) -307.98200 (result) -308.99000 (in) -308.01500 (incorrect) -309.00200 <636c6173736902636174696f6e2e> -485.00600 (\050e\056g\056\054) -323 (Figure) -308.00300 (1\051\056) -485.99200 (F) 14.99260 (or) 20 (\055) ] TJ 11.95510 TL T* [ (mally) 64.99650 (\054) -372.01400 (for) -347.98200 (a) -347.00500 (gi) 24.98850 (v) 14.98280 (en) -347.98000 <636c61737369026572> 40.01780 (\054) -372.01400 (we) -347.98200 <6465026e65> -346.98600 (an) -347.98100 (adv) 14.98280 (ersarial) -348.02000 (per) 19.99420 (\055) ] TJ T* [ (turbation) -297.99500 (as) -297.00700 (the) ] TJ /R30 9.96260 Tf 65.34180 0 Td (minimal) Tj /R24 9.96260 Tf 35.63130 0 Td (perturbation) Tj /R32 9.96260 Tf 51.66170 0 Td [ (r) -0.70086 ] TJ /R24 9.96260 Tf 8.55000 0 Td [ (that) -298.01400 (is) -296.99700 (suf) 24.98360 <026369656e74> -298.00400 (to) ] TJ -161.18500 -11.95510 Td [ (change) -249.99600 (the) -249.99000 (estimated) -250.00500 (label) ] TJ /R34 9.96260 Tf 108.16300 2.62891 Td (\136) Tj /R36 9.96260 Tf -0.25898 -2.62891 Td [ (k) -0.59916 ] TJ /R34 9.96260 Tf 5.50000 0 Td [ (\050) -0.89936 ] TJ /R32 9.96260 Tf 3.87500 0 Td (x) Tj /R34 9.96260 Tf 6.56523 0 Td [ (\051) -0.89936 ] TJ /R24 9.96260 Tf 3.87500 0 Td (\072) Tj /R34 9.96260 Tf -117.28500 -24.02890 Td [ <01> -0.30019 (\050) -0.89936 ] TJ /R32 9.96260 Tf 12.17580 0 Td (x) Tj /R34 9.96260 Tf 6.56602 0 Td [ (\073) -0.80011 ] TJ 4.68711 2.62891 Td (\136) Tj /R36 9.96260 Tf -0.25898 -2.62891 Td [ (k) -0.59978 ] TJ /R34 9.96260 Tf 5.50000 0 Td [ (\051) -278.90800 (\072) -0.80011 (\075) -277.80200 (m) -1.29268 (i) -0.80011 (n) -0.59916 ] TJ /R38 6.97380 Tf 25.99100 -5.97813 Td [ (r) -0.89971 ] TJ /R40 9.96260 Tf 12.19880 5.97813 Td (k) Tj /R32 9.96260 Tf 4.98125 0 Td [ (r) -0.69964 ] TJ /R40 9.96260 Tf 5.58594 0 Td (k) Tj /R42 6.97380 Tf 4.98086 -1.49414 Td [ (2) -0.50062 ] TJ /R24 9.96260 Tf 6.96016 1.49414 Td [ (subject) -250.01500 (to) ] TJ /R34 9.96260 Tf 41.21480 2.62891 Td (\136) Tj /R36 9.96260 Tf -0.25898 -2.62891 Td [ (k) -0.59916 ] TJ /R34 9.96260 Tf 5.50000 0 Td [ (\050) -0.89936 ] TJ /R32 9.96260 Tf 3.87500 0 Td (x) Tj /R34 9.96260 Tf 8.77930 0 Td [ (\053) -0.79889 ] TJ /R32 9.96260 Tf 9.96289 0 Td [ (r) -0.70086 ] TJ /R34 9.96260 Tf 5.58477 0 Td [ (\051) -0.90181 ] TJ /R40 9.96260 Tf 6.64219 0 Td (6) Tj /R34 9.96260 Tf 0 0 Td [ (\075) -0.79889 ] TJ 10.77500 2.62891 Td (\136) Tj /R36 9.96260 Tf -0.25898 -2.62891 Td [ (k) -0.60039 ] TJ /R34 9.96260 Tf 5.50000 0 Td [ (\050) -0.90181 ] TJ /R32 9.96260 Tf 3.87500 0 Td (x) Tj /R34 9.96260 Tf 6.56484 0 Td [ (\051) -0.90181 ] TJ /R36 9.96260 Tf 3.87500 0 Td [ (\073) -0.79889 ] TJ /R24 9.96260 Tf 13.20120 0 Td (\0501\051) Tj -224.63400 -28.51210 Td (where) Tj /R32 9.96260 Tf 27.66410 0 Td (x) Tj /R24 9.96260 Tf 9.89180 0 Td [ (is) -334.00900 (an) -333.98200 (image) -332.98700 (and) ] TJ /R34 9.96260 Tf 68.34690 2.62891 Td (\136) Tj /R36 9.96260 Tf -0.25898 -2.62891 Td [ (k) -0.59916 ] TJ /R34 9.96260 Tf 5.50000 0 Td [ (\050) -0.89936 ] TJ /R32 9.96260 Tf 3.87422 0 Td (x) Tj /R34 9.96260 Tf 6.56602 0 Td [ (\051) -0.89936 ] TJ /R24 9.96260 Tf 7.20000 0 Td [ (is) -334.00900 (the) -334.01500 (estimated) -333.01100 (label\056) -562.01200 (W) 79.98660 (e) ] TJ -128.78400 -13.03400 Td (call) Tj /R34 9.96260 Tf 17.03400 0 Td [ <01> -0.30019 (\050) -0.89936 ] TJ /R32 9.96260 Tf 12.17700 0 Td (x) Tj /R34 9.96260 Tf 6.56484 0 Td [ (\073) -0.80011 ] TJ 4.68828 2.62891 Td (\136) Tj /R36 9.96260 Tf -0.26016 -2.62891 Td [ (k) -0.59978 ] TJ /R34 9.96260 Tf 5.50000 0 Td [ (\051) -0.89997 ] TJ /R24 9.96260 Tf 6.52305 0 Td [ (the) -265.98700 (rob) 20.00400 (ustness) -266.00300 (of) ] TJ /R34 9.96260 Tf 70.53980 2.62891 Td (\136) Tj /R36 9.96260 Tf -0.25898 -2.62891 Td [ (k) -0.59916 ] TJ /R24 9.96260 Tf 8.14922 0 Td [ (at) -265.99200 (point) ] TJ /R32 9.96260 Tf 32.97190 0 Td (x) Tj /R24 9.96260 Tf 6.56602 0 Td [ (\056) -356.99700 (The) -265.99000 (rob) 20.00400 (ustness) ] TJ -170.19500 -13.03520 Td [ (of) -249.99600 <636c61737369026572> ] TJ /R34 9.96260 Tf 48.95590 2.62891 Td (\136) Tj /R36 9.96260 Tf -0.25898 -2.62891 Td [ (k) -0.59916 ] TJ /R24 9.96260 Tf 7.98984 0 Td [ (is) -249.98400 (then) -249.98500 <6465026e6564> -250.01600 (as) ] TJ ET Q 3.98000 w 0 G 501.12100 1001.43000 m 1446.11000 1001.43000 l S q 10 0 0 10 0 0 cm BT /R24 5.97760 Tf 1 0 0 1 60.97110 93.27700 Tm (1) Tj /R24 7.97010 Tf 3.48672 -2.81211 Td [ (T) 80.01170 (o) -370 (encourage) -369.99700 (reproducible) -371.01300 (research\054) -399.99200 (the) -369.98500 (code) -369.99900 (of) -371.01300 (DeepF) 14.97910 (ool) -370.00500 (is) -369.98000 (made) ] TJ -14.34570 -9.46484 Td [ (a) 20.00350 (v) 24.98270 (ailable) -249.97700 (at) ] TJ /R28 7.97010 Tf 38.15200 0 Td (http\072\057\057github\056com\057lts4\057deepfool) Tj ET Q q 2328 0 0 3544 3105.87000 2228.34000 cm /R46 Do Q q 10 0 0 10 0 0 cm BT /R24 9.96260 Tf 1 0 0 1 308.86200 204.50200 Tm [ (Figure) -740.98900 (1\072) -1292.01000 (An) -741.00600 (e) 15.01220 (xample) -742.01300 (of) -741.01400 (adv) 14.98280 (ersarial) -741.01400 (perturbations\056) ] TJ 11.95510 TL T* [ (First) -609.98400 (ro) 25.01790 (w\072) -1030.99000 (the) -610.00800 (original) -611.00600 (image) ] TJ /R32 9.96260 Tf 138.39300 0 Td (x) Tj /R24 9.96260 Tf 12.64610 0 Td [ (that) -610.00100 (is) -610.98100 <636c61737369026564> -609.98200 (as) ] TJ /R34 9.96260 Tf -150.78000 -9.32578 Td (\136) Tj /R36 9.96260 Tf -0.25898 -2.62891 Td [ (k) -0.60039 ] TJ /R34 9.96260 Tf 5.50000 0 Td [ (\050) -0.90181 ] TJ /R32 9.96260 Tf 3.87500 0 Td (x) Tj /R34 9.96260 Tf 6.56484 0 Td [ (\051) -0.90181 ] TJ /R24 9.96260 Tf 3.87500 0 Td [ (\075\223whale\224\056) -719.98300 (Second) -387.01400 (ro) 25.01540 (w\072) -582.99100 (the) -386.98400 (image) ] TJ /R32 9.96260 Tf 149.15600 0 Td (x) Tj /R34 9.96260 Tf 9.78867 0 Td [ (\053) -0.80379 ] TJ /R32 9.96260 Tf 10.97110 0 Td [ (r) -0.70086 ] TJ /R24 9.96260 Tf 9.43906 0 Td <636c61737369026564> Tj -199.17000 -13.03400 Td (as) Tj /R34 9.96260 Tf 11.32890 2.62891 Td (\136) Tj /R36 9.96260 Tf -0.26016 -2.62891 Td [ (k) -0.60039 ] TJ /R34 9.96260 Tf 5.50117 0 Td [ (\050) -0.90181 ] TJ /R32 9.96260 Tf 3.87383 0 Td (x) Tj /R34 9.96260 Tf 8.98711 0 Td [ (\053) -0.79889 ] TJ /R32 9.96260 Tf 10.16990 0 Td [ (r) -0.70086 ] TJ /R34 9.96260 Tf 5.58633 0 Td [ (\051) -0.90181 ] TJ /R24 9.96260 Tf 3.87383 0 Td [ (\075\223turtle\224) -278.00500 (and) -277.98800 (the) -277.98300 (corresponding) -277.99800 (perturbation) ] TJ /R32 9.96260 Tf 181.60300 0 Td [ (r) -0.70086 ] TJ /R24 9.96260 Tf -230.66400 -11.95510 Td [ (computed) -379.98300 (by) -380.98500 (DeepF) 14.99260 (ool\056) -699.98100 (Third) -381.01500 (ro) 25.01540 (w\072) -570.01300 (the) -380.00500 (image) -381.02000 <636c61737369026564> ] TJ 11.95630 TL T* [ (as) -444.00200 (\223turtle\224) -443.99500 (and) -443.01900 (the) -443.99700 (corresponding) -444.00900 (perturbation) -444.01400 (computed) ] TJ 11.95470 TL T* [ (by) -328.01400 (the) -326.99700 (f) 9.99588 (ast) -328.01400 (gradient) -328.00700 (sign) -326.98200 (method) -327.99400 (\1334\135\056) -543.00700 (DeepF) 14.99260 (ool) -326.98500 (leads) -328.01400 (to) -328.01400 (a) ] TJ T* [ (smaller) -250.01700 (perturbation\056) ] TJ ET Q Q Q q q 1 1 1 rg /a0 gs 48.40600 786.42200 515.18800 -52.69900 re f q /s5 gs /x6 Do Q q /s7 gs /x8 Do Q q /s9 gs /x10 Do Q q /s11 gs /x12 Do Q Q Q Q q 1 0 0 1 0 0 cm BT /F1 12 Tf 14.40000 TL ET 1 1 1 rg n 270 32 72 14 re f* 0.50000 0.50000 0.50000 rg BT /F2 9 Tf 10.80000 TL ET BT 1 0 0 1 297 35 Tm (2574) Tj T* ET Q endstream endobj 14 0 obj << /Filter /FlateDecode /Resources << /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x18 15 0 R >> >> /Length 28 /Group << /Type /Group /S /Transparency /CS /DeviceRGB /I true >> /BBox [ 78 746 96 765 ] /Type /XObject /Subtype /Form >> stream x+O4PH/VЯ0Pp 0 endstream endobj 15 0 obj << /Filter /FlateDecode /Resources 16 0 R /Length 107 /Type /XObject /BBox [ 78 746 96 765 ] /Subtype /Form >> stream xe AC̬wʠ =p,?]%+H-
Jc "82w8VSnGW;" endstream endobj 16 0 obj << /ExtGState << /a0 << /CA 1 /ca 1 >> >> >> endobj 17 0 obj << /SMask 18 0 R /Filter /DCTDecode /BitsPerComponent 8 /Height 443 /Length 26796 /ColorSpace /DeviceRGB /Width 291 /Subtype /Image >> stream Adobe d C $, !$4.763.22:ASF:=N>22HbINVX]^]8EfmeZlS[]Y C**Y;2;YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY #" } !1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w !1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ? ( ( ( ( ~!0Wr3/]q_J+i8 dEO<#:ѿx%aEj&V% ΣufWEQλ( 1)Sӷ0:T\G0=kCP#i3;y vGv0Nfc# gALڃ \;Xn j~I1ڧIU=ڐc#}ȡWݻ*Z[_TfXa_?7=5ʃRA GX4ko+,s zM?#-z(((((((((oYzK Ws\O6Um7B%UGr'Lj0SyR?J?݅BҬD2]d&@ Ւ838P;!\ѷc g:f0$S=_$ԴR!*ޣ"OQA&C!?ZL(eęJص(3fG%U8yI>¬}e\2 uڬ1m{P2H%(NG1cºm"H#dxFD 1DAbi9wb3^͡ N h ^AHd'ۃ ƅ[G Lږ(( ( ( ( ( ( ( ( +&