%PDF-1.3 1 0 obj << /Kids [ 3 0 R 4 0 R 5 0 R 6 0 R 7 0 R 8 0 R 9 0 R 10 0 R 11 0 R ] /Type /Pages /Count 9 >> endobj 2 0 obj << /Title (On the Suitability of Lp\055Norms for Creating and Preventing Adversarial Examples) /Producer (PyPDF2) /Author (Mahmood Sharif\054 Lujo Bauer\054 Michael K\056 Reiter) /Subject (2018 IEEE Conference on Computer Vision and Pattern Recognition Workshops) >> endobj 3 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 13 0 R /Resources << /XObject << /x8 14 0 R /x6 17 0 R /x12 20 0 R /x10 23 0 R >> /ExtGState << /s9 26 0 R /s11 29 0 R /a0 << /CA 1 /ca 1 >> /R21 32 0 R /s5 33 0 R /s7 36 0 R >> /Font << /R42 39 0 R /R40 43 0 R /F2 46 0 R /R28 47 0 R /F1 51 0 R /R38 52 0 R /R36 55 0 R /R34 59 0 R /R22 62 0 R /R32 66 0 R /R24 70 0 R /R30 73 0 R /R26 77 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R ] >> endobj 4 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 94 0 R /Resources << /ExtGState << /R21 32 0 R >> /Font << /R79 95 0 R /R22 62 0 R /F1 99 0 R /R42 39 0 R /R40 43 0 R /F2 100 0 R /R28 47 0 R /R36 55 0 R /R38 52 0 R /R83 101 0 R /R81 104 0 R /R75 107 0 R /R77 111 0 R /R26 77 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R 128 0 R 129 0 R 130 0 R 131 0 R 132 0 R 133 0 R 134 0 R 135 0 R 136 0 R 137 0 R 138 0 R ] >> endobj 5 0 obj << /Parent 1 0 R /Rotate 0 /Contents 139 0 R /Resources << /XObject << /R131 140 0 R /R132 141 0 R /R133 142 0 R /R134 143 0 R /R135 144 0 R >> /ExtGState << /R21 32 0 R >> /Font << /R42 39 0 R /R77 111 0 R /F2 145 0 R /R28 47 0 R /F1 146 0 R /R38 52 0 R /R36 55 0 R /R75 107 0 R /R22 62 0 R /R26 77 0 R >> /ProcSet [ /Text /ImageC /ImageB /PDF /ImageI ] >> /Group 147 0 R /MediaBox [ 0 0 612 792 ] /Annots [ 148 0 R 149 0 R 150 0 R 151 0 R 152 0 R 153 0 R 154 0 R 155 0 R 156 0 R 157 0 R 158 0 R 159 0 R 160 0 R 161 0 R 162 0 R 163 0 R 164 0 R 165 0 R 166 0 R 167 0 R 168 0 R 169 0 R 170 0 R 171 0 R 172 0 R 173 0 R 174 0 R 175 0 R 176 0 R 177 0 R 178 0 R 179 0 R 180 0 R 181 0 R 182 0 R 183 0 R 184 0 R 185 0 R 186 0 R 187 0 R ] /Type /Page >> endobj 6 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 188 0 R /Resources << /ExtGState << /R21 32 0 R >> /Font << /R146 189 0 R /R22 62 0 R /R42 39 0 R /R40 43 0 R /F2 192 0 R /R28 47 0 R /F1 193 0 R /R38 52 0 R /R36 55 0 R /R75 107 0 R /R77 111 0 R /R26 77 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 194 0 R 195 0 R 196 0 R 197 0 R 198 0 R ] >> endobj 7 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 199 0 R /Resources << /ExtGState << /R21 32 0 R >> /Font << /R146 189 0 R /R167 200 0 R /R22 62 0 R /R165 203 0 R /R40 43 0 R /R169 206 0 R /R42 39 0 R /R77 111 0 R /F2 210 0 R /R28 47 0 R /F1 211 0 R /R38 52 0 R /R83 101 0 R /R34 59 0 R /R75 107 0 R /R26 77 0 R >> /ProcSet [ /Text /ImageC /ImageB /PDF /ImageI ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R 221 0 R 222 0 R 223 0 R ] >> endobj 8 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 224 0 R /Resources << /ExtGState << /R21 32 0 R >> /Font << /R183 225 0 R /R146 189 0 R /R167 200 0 R /R22 62 0 R /R165 203 0 R /R40 43 0 R /R169 206 0 R /R42 39 0 R /R77 111 0 R /F2 228 0 R /R28 47 0 R /F1 229 0 R /R38 52 0 R /R75 107 0 R /R26 77 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 230 0 R 231 0 R 232 0 R 233 0 R 234 0 R 235 0 R 236 0 R ] >> endobj 9 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 237 0 R /Resources << /ExtGState << /R21 32 0 R >> /Font << /R146 189 0 R /R22 62 0 R /R42 39 0 R /R40 43 0 R /F2 238 0 R /R28 47 0 R /F1 239 0 R /R38 52 0 R /R75 107 0 R /R26 77 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R ] >> endobj 10 0 obj << /Parent 1 0 R /Rotate 0 /Contents 255 0 R /Resources << /XObject << /R215 256 0 R /R214 257 0 R /R217 258 0 R /R216 259 0 R /R220 260 0 R /R221 261 0 R /R219 262 0 R /R218 263 0 R >> /ExtGState << /R21 32 0 R >> /Font << /F2 264 0 R /R28 47 0 R /F1 265 0 R /R38 52 0 R /R36 55 0 R /R34 59 0 R /R22 62 0 R /R26 77 0 R >> /ProcSet [ /Text /ImageC /ImageB /PDF /ImageI ] >> /Group 147 0 R /MediaBox [ 0 0 612 792 ] /Annots [ 266 0 R 267 0 R 268 0 R 269 0 R 270 0 R 271 0 R ] /Type /Page >> endobj 11 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 272 0 R /Resources << /ExtGState << /R21 32 0 R >> /Font << /R36 55 0 R /R28 47 0 R /R34 59 0 R /F1 273 0 R /F2 274 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 275 0 R 276 0 R ] >> endobj 12 0 obj << /Type /Catalog /Pages 1 0 R >> endobj 13 0 obj << /Length 20074 >> stream q q q 0.1 0 0 0.1 0 0 cm /R21 gs 0 g q 10 0 0 10 0 0 cm BT /R22 14.3462 Tf 1 0 0 1 193.221 675.067 Tm [ (On) -249.988 (the) -250.008 (Suitability) -250.012 (of) ] TJ /R24 14.3462 Tf 128.339 0 Td [ (L) -0.20081 ] TJ /R26 9.9626 Tf 9.55781 -2.15195 Td [ (p) -0.10047 ] TJ /R22 14.3462 Tf 5.51016 2.15195 Td [ (\055norms) -249.991 (f) 24.9923 (or) ] TJ -183.954 -17.9332 Td [ (Cr) 17.9938 (eating) -250.003 (and) -249.991 (Pr) 18.0048 (e) 14.9876 (v) 9.99625 (enting) -250.012 (Adv) 10.0014 (ersarial) -250.012 (Examples) ] TJ /R28 11.9552 Tf 16.8527 -37.8578 Td [ (Mahmood) -250.008 (Sharif) ] TJ /R30 7.9701 Tf 81.3539 4.33867 Td [ (y) -0.19911 ] TJ /R28 11.9552 Tf 15.2211 -4.33867 Td [ (Lujo) -250.008 (Bauer) ] TJ /R30 7.9701 Tf 54.1199 4.33867 Td [ (y) -0.19911 ] TJ /R28 11.9552 Tf 15.2211 -4.33867 Td [ (Michael) -250.002 (K\056) -250.01 (Reiter) ] TJ /R30 7.9701 Tf 85.9922 4.33867 Td [ (z) -0.20217 ] TJ -192.699 -14.0578 Td [ (y) -0.19911 ] TJ /R28 11.9552 Tf 4.26211 -4.33789 Td [ (Carne) 15.0137 (gie) -250 (Mellon) -249.997 (Uni) 24.9957 (v) 14.9851 (ersity) ] TJ /R30 7.9701 Tf -41.5441 -9.71914 Td [ (z) -0.19911 ] TJ /R28 11.9552 Tf 4.26211 -4.33906 Td [ (Uni) 24.9957 (v) 14.9851 (ersity) -249.989 (of) -250.014 (North) -250.016 (Carolina) -250 (at) -249.987 (Chapel) -249.993 (Hill) ] TJ /R32 8.9664 Tf -15.6879 -13.9469 Td [ (f) -0.8999 ] TJ /R34 8.9664 Tf 4.60781 0 Td (mahmoods\054lbauer) Tj /R32 8.9664 Tf 80.6973 0 Td [ (g) -0.90126 ] TJ /R34 8.9664 Tf 4.60781 0 Td [ (\100cmu\056edu\054) -600.005 (reiter\100cs\056unc\056edu) ] TJ /R22 11.9552 Tf -123.946 -41.0469 Td (Abstract) Tj /R36 9.9626 Tf -83.9277 -25.0801 Td [ (Muc) 15.0196 (h) -227.016 (r) 37.0196 (esear) 36.9828 (c) 15.0122 (h) -227.016 (ha) -1.00964 (s) -227.015 (been) -227.02 (de) 15.0183 (voted) -227.012 (to) -227.009 (better) -227.984 (under) 10.0155 (standing) ] TJ -11.9551 -11.9563 Td [ (adver) 10.0057 (sarial) -269.997 (e) 19.9918 (xamples\054) -274.993 (whic) 14.9987 (h) -269.989 (ar) 36.9852 (e) -270 (specially) -270.009 (cr) 15.0196 (afted) -270.994 (inputs) -270 (to) ] TJ 11.9547 TL T* [ (mac) 14.9816 (hine\055learning) -392.987 (models) -393.991 (that) -393.008 (ar) 36.9852 (e) -392.998 (per) 36.9816 (ceptually) -393.008 (similar) -394.01 (to) ] TJ T* [ (benign) -306.985 (inputs\054) -319.987 (b) 20.0016 (ut) -306.995 (ar) 36.9852 (e) -307.012 <636c61737369026564> -305.994 (dif) 18.0166 (fer) 36.9828 (ently) -306.998 (\050i\056e) 15.0196 (\056\054) -321 (misclassi\055) ] TJ T* [ <026564292e> -301.004 (Both) -223.981 (algorithms) -223.985 (that) -222.997 (cr) 37.0147 (eate) -223.998 (adver) 10.0057 (sarial) -224.004 (e) 19.9918 (xamples) -223.985 (and) ] TJ T* [ (str) 14.9975 (ate) 40.0013 (gies) -328.99 (for) -330.005 (defending) -329.013 (a) 10.0032 (gainst) -329.988 (adver) 10.0057 (sarial) -329.006 (e) 19.9918 (xamples) -330.006 (typ\055) ] TJ T* [ (ically) -393.995 (use) ] TJ /R26 9.9626 Tf 43.2668 0 Td [ (L) -0.60039 ] TJ /R38 6.9738 Tf 6.78008 -1.49531 Td [ (p) -0.89971 ] TJ /R36 9.9626 Tf 4.60586 1.49531 Td [ (\055norms) -393.991 (to) -394 (measur) 36.9951 (e) -394.018 (the) -394.005 (per) 36.9816 (ceptual) -393.993 (similarity) ] TJ -54.6527 -11.9563 Td [ (between) -237.982 (an) -237.99 (adver) 10.0057 (sarial) -238.002 (input) -238.009 (and) -237.985 (its) -238.998 (benign) -238.017 (original\056) -306.018 (Prior) ] TJ T* [ (work) -221.982 (has) -221.986 (alr) 36.9926 (eady) -222 (shown\054) -226.984 (howe) 14.9963 (ver) 110.999 (\054) -227.999 (that) -222.017 (two) -222.017 (ima) 10.013 (g) 10.0032 (es) -222 (need) -222 (not) ] TJ T* [ (be) -360.018 (close) -360.009 (to) -360.006 (eac) 15.0134 (h) -360.013 (other) -360 (as) -360.007 (measur) 36.9951 (ed) -360.017 (by) -360.018 (an) ] TJ /R26 9.9626 Tf 176.188 0 Td [ (L) -0.60039 ] TJ /R38 6.9738 Tf 6.78008 -1.49414 Td [ (p) -0.89971 ] TJ /R36 9.9626 Tf 4.60508 1.49414 Td [ (\055norm) -360.004 (to) -360.006 (be) ] TJ -187.573 -11.9551 Td [ (per) 36.981 (ceptually) -339.018 (similar) 111.004 (\056) -577 (In) -339.001 (this) -339.016 (work\054) -361.996 (we) -338.992 (show) -339.012 (that) -339.017 (nearness) ] TJ T* [ (accor) 36.9816 (ding) -353.997 (to) -354.007 (an) ] TJ /R26 9.9626 Tf 68.3199 0 Td [ (L) -0.59916 ] TJ /R38 6.9738 Tf 6.78008 -1.49492 Td [ (p) -0.89971 ] TJ /R36 9.9626 Tf 4.60508 1.49492 Td [ (\055norm) -354.003 (is) -354.006 (not) -354.002 (just) -353.994 (unnecessary) -353.017 (for) -354.002 (per) 20.004 (\055) ] TJ -79.7051 -11.9551 Td [ (ceptual) -334.002 (similarity) 54.9835 (\054) -356.017 (b) 20.0016 (ut) -334.01 (is) -334.989 (also) -334 (insuf) 17.9884 <026369656e742e> -562.987 <53706563690263616c6c79> 54.9957 (\054) -356.017 (fo\055) ] TJ 11.9559 TL T* [ (cusing) -294.986 (on) -295 (datasets) -295.012 (\050CIF) 115.011 (AR10) -294.991 (and) -294.995 (MNIST\051\054) ] TJ /R26 9.9626 Tf 176.156 0 Td [ (L) -0.60039 ] TJ /R38 6.9738 Tf 6.78008 -1.49414 Td [ (p) -0.89971 ] TJ /R36 9.9626 Tf 4.60508 1.49414 Td [ (\055norms\054) -306.003 (and) ] TJ -187.541 -11.9551 Td [ (thr) 36.9926 (esholds) -238.989 (used) -239.987 (in) -239.007 (prior) -238.99 (work\054) -242.016 (we) -239.01 (show) -238.99 (thr) 44.99 (ough) -239 (online) -240.014 (user) ] TJ 11.9547 TL T* [ (studies) -250.004 (that) -250.992 (\223adver) 9.98118 (sarial) -250 (e) 19.9918 (xamples\224) -250.005 (that) -250.992 (ar) 36.9865 (e) -250.002 (closer) -249.983 (to) -251.005 (their) ] TJ T* [ (benign) -339.019 (counterparts) -338.012 (than) -339.019 (r) 37.0196 (equir) 36.9926 (ed) -337.982 (by) -339.001 (commonly) -338.002 (used) ] TJ /R26 9.9626 Tf 221.547 0 Td [ (L) -0.60039 ] TJ /R38 6.9738 Tf 6.78008 -1.49492 Td [ (p) -0.89971 ] TJ /R36 9.9626 Tf 4.60508 1.49492 Td (\055) Tj -232.932 -11.9551 Td [ (norm) -209.985 (thr) 36.9926 (esholds) -210.013 (can) -211.017 (ne) 15.0183 (vertheless) -209.983 (be) -210.003 (per) 36.9816 (ceptually) -209.98 (distinct) -210.982 (to) ] TJ 11.9559 TL T* [ (humans) -282.003 (fr) 44.9864 (om) -281.984 (the) -283.004 (corr) 36.9865 (esponding) -281.992 (benign) -282.009 (e) 19.9918 (xamples\056) -407.01 (Namely) 54.9908 (\054) ] TJ 11.9551 TL T* [ (the) -197.998 (per) 36.981 (ceptual) -199.005 (distance) -198.018 (between) -197.989 (two) -199 (ima) 10.013 (g) 10.0032 (es) -198.004 (that) -197.982 (ar) 36.9865 (e) -198.991 (\223near\224) ] TJ T* [ (eac) 15.0134 (h) -360.013 (other) -359.019 (accor) 36.9816 (ding) -359.996 (to) -360.006 (an) ] TJ /R26 9.9626 Tf 115.35 0 Td [ (L) -0.59916 ] TJ /R38 6.9738 Tf 6.78008 -1.49375 Td [ (p) -0.89971 ] TJ /R36 9.9626 Tf 4.60469 1.49375 Td [ (\055norm) -360.002 (can) -358.994 (be) -360.018 (high) -359.996 (enough) ] TJ -126.735 -11.9551 Td [ (that) -288.006 (participants) -288.989 (fr) 36.9877 (equently) -288.014 (classify) -288.98 (the) -287.984 (two) -288.986 (ima) 10.013 (g) 10.0032 (es) -287.989 (as) -288.998 (r) 37.0183 (ep\055) ] TJ T* [ (r) 37.0196 (esenting) -339.014 (dif) 18.0166 (fer) 36.9828 (ent) -338.995 (objects) -338.98 (or) -338.011 (digits\056) -577 (Combined) -339.002 (with) -339.01 (prior) ] TJ T* [ (work\054) -288.008 (we) -281.003 (thus) -280.989 (demonstr) 15.011 (ate) -281.005 (that) -280.987 (nearness) -280.007 (of) -281 (inputs) -281.017 (as) -281 (mea\055) ] TJ 11.9563 TL T* [ (sur) 36.9914 (ed) -376.995 (by) ] TJ /R26 9.9626 Tf 38.6867 0 Td [ (L) -0.60039 ] TJ /R38 6.9738 Tf 6.78008 -1.49375 Td [ (p) -0.90059 ] TJ /R36 9.9626 Tf 4.60508 1.49375 Td [ (\055norms) -377.013 (is) -376.982 (neither) -377.013 (necessary) -376.986 (nor) -377.998 (suf) 18.0142 <026369656e74> -377.02 (for) ] TJ -50.0719 -11.9547 Td [ (per) 36.981 (ceptual) -314.985 (similarity) 54.9835 (\054) -329.982 (whic) 14.9987 (h) -315.001 (has) -314.99 (implications) -314.004 (for) -314.989 (both) -314.984 (cr) 37.0159 (e\055) ] TJ 11.9551 TL T* [ (ating) -256.006 (and) -255.981 (defending) -256.005 (a) 10.0032 (gainst) -256 (adver) 10.0057 (sarial) -255.999 (e) 19.9918 (xamples\056) -328.984 (W) 91.9871 (e) -256.001 (pr) 44.9851 (o\055) ] TJ T* [ (pose) -277 (and) -276.017 (discuss) -276.982 (alternative) -275.996 (similarity) -277 (metrics) -276.013 (to) -277 (stimulate) ] TJ T* [ (futur) 37.0049 (e) -250.002 (r) 37.0196 (esear) 36.9828 (c) 15.0122 (h) -249.993 (in) -249.985 (the) -249.99 (ar) 36.9852 (ea\056) ] TJ /R22 11.9552 Tf 39.377 TL T* [ (1\056) -249.99 (Intr) 18.0146 (oduction) ] TJ /R28 9.9626 Tf 11.9551 -20.1 Td [ (Machine) -366.002 (learning) -367.02 (is) -366.004 (quickly) -367.006 (becoming) -365.986 (a) -367.002 (k) 10.0032 (e) 15.0122 (y) -366.012 (aspect) -366.993 (of) ] TJ -11.9551 -11.9551 Td [ (man) 14.9908 (y) -406.986 (technologies) -406.991 (that) -407.015 (impact) -407.007 (us) -407.019 (on) -406.981 (a) -406.996 (daily) -407.01 (basis\054) -447.001 (from) ] TJ 11.9551 TL T* [ (automoti) 24.9811 (v) 14.9828 (e) -303.993 (dri) 24.9848 (ving) -304.006 (aids) -304.014 (to) -304.015 (city) -302.994 (planning\054) -317.989 (from) -304.018 (smartphone) ] TJ T* [ (cameras) -363 (to) -362.986 (cancer) -363.994 (diagnosis\056) -648.984 (As) -364.009 (such\054) -391.018 (the) -362.991 (research) -363.991 (com\055) ] TJ 258.75 455.167 Td [ (munity) -287.989 (has) -287.984 (in) 40.0056 (v) 14.9828 (ested) -289 (substantial) -287.981 (ef) 25.0056 (fort) -287.986 (in) -288.021 (understanding) ] TJ /R36 9.9626 Tf 222.97 0 Td (ad\055) Tj -222.97 -11.9551 Td [ (ver) 9.99588 (sarial) -374.018 (e) 19.9918 (xamples) ] TJ /R28 9.9626 Tf 76.4738 0 Td [ (\054) -404.989 (which) -374.001 (are) -373.987 (inputs) -373.982 (to) -374.986 (machine\055learning) ] TJ -76.4738 -11.9547 Td [ (systems) -329.004 (that) -328.989 (are) -329.016 (perceptually) -328.984 (similar) -329.009 (to) -328.994 (benign) -328.979 (inputs\054) -349 (b) 20.0016 (ut) ] TJ T* [ (that) -245.003 (are) -246.01 <6d6973636c617373690265642c> -246.015 (i\056e\056\054) -245.988 <636c61737369026564> -246.003 (dif) 24.986 (ferently) -245.008 (than) -245.003 (the) -245.988 (be\055) ] TJ T* [ (nign) -284.009 (inputs) -283.997 (from) -283.982 (which) -284.016 (the) 14.9877 (y) -283.987 (are) -284.002 (deri) 24.9811 (v) 14.9828 (ed) -283.992 (\050e\056g\056\054) -283.987 (\133) ] TJ ET Q 1 0 0 0 k q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 499.447 488.347 Tm (1) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 504.428 488.347 Tm (\054) Tj ET Q 1 0 0 0 k q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 509.748 488.347 Tm (29) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 519.711 488.347 Tm [ (\135\051\056) -412.015 (An) ] TJ -210.848 -11.9559 Td [ (attack) 10.0057 (er) -351.988 (who) -352.988 (creates) -351.988 (an) -352.02 (adv) 14.9828 (ersarial) -353 (e) 15.0122 (xample) -352 (can) -351.985 (cause) -353 (an) ] TJ 11.9551 TL T* [ (object\055recognition) -332.016 (algorithm) -333.003 (to) -332.013 (incorrectly) -332.989 (identify) -331.994 (an) -333.003 (ob\055) ] TJ T* [ (ject) -203.02 (\050e\056g\056\054) -211.999 (as) -202.983 (a) -202.991 (w) 10 (orm) -203.01 (instead) -201.986 (of) -202.986 (as) -202.986 (an) -202.986 (panda\051) -202.981 (\133) ] TJ ET Q 1 0 0 0 k q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 484.263 452.481 Tm (7) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 489.244 452.481 Tm [ (\135\054) -212.004 (a) -202.991 (street\055sign) ] TJ -180.382 -11.9551 Td [ (recognition) -248.003 (algorithm) -247.015 (to) -247.986 (f) 9.99343 (ail) -247.008 (to) -247.988 (recognize) -247.998 (a) -246.983 (stop) -248.013 (sign) -248.013 (\133) ] TJ ET Q 1 0 0 0 k q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 523.556 440.526 Tm (5) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 528.538 440.526 Tm [ (\135\054) -247.998 (or) ] TJ -219.675 -11.9547 Td [ (a) -325.99 (f) 9.99588 (ace\055recognition) -326.007 (system) -325.99 (to) -324.995 (f) 9.99343 (ail) -326.014 (to) -326.014 (identify) -325.995 (a) -325.99 (person) -326.009 (\133) ] TJ ET Q 1 0 0 0 k q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 529.345 428.571 Tm (27) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 539.307 428.571 Tm (\135\056) Tj -230.445 -11.9563 Td [ (Because) -263.008 (of) -261.993 (the) -263.008 (potential) -262 (impact) -262.99 (on) -263.005 (safety) -261.991 (and) -263.01 (security) 64.9892 (\054) -265.99 (bet\055) ] TJ 11.9551 TL T* [ (ter) -257.996 (understanding) -259.011 (the) -257.989 (susceptibility) -258.986 (of) -257.996 (machine\055learning) -258.986 (al\055) ] TJ T* [ (gorithms) -408.986 (to) -409.018 (adv) 14.9828 (ersarial) -408.991 (e) 15.0122 (xamples\054) -448.994 (and) -410.005 (de) 25.0154 (vising) -408.995 (defenses\054) ] TJ T* [ (has) -249.99 (been) -249.995 (a) -250.002 (high) -250.015 (priority) 64.999 (\056) ] TJ 11.9551 -12.391 Td [ (A) -247.015 (k) 10.0032 (e) 15.0122 (y) -245.993 (property) -247 (of) -245.996 (adv) 14.9828 (ersarial) -247.018 (e) 15.0122 (xamples) -246.993 (that) -245.983 (mak) 10.013 (es) -247.018 (them) ] TJ -11.9551 -11.9551 Td [ (dangerous) -342.002 (is) -340.99 (that) -342.007 (human) -341.019 (observ) 14.9926 (ers) -341.982 (do) -342.012 (not) -340.982 (recognize) -341.982 (them) ] TJ T* [ (as) -293.007 (adv) 14.9828 (ersarial\056) -440.003 (If) -293.017 (a) -293.015 (human) -294.005 (recognizes) -293 (an) -293.01 (input) -292.981 (\050e\056g\056\054) -303.984 (a) -293.995 (per) 19.9918 (\055) ] TJ T* [ (son) -209.987 (wearing) -211.016 (a) -210.009 (disguise) -210.007 (at) -210.002 (an) -210.984 (airport\051) -209.994 (as) -210.004 (adv) 14.9828 (ersarial\054) -217.998 (then) -211.009 (an) 15.0171 (y) ] TJ T* [ (potential) -261.02 (harm) -261.986 (may) -261.003 (often) -261.005 (be) -261.995 (pre) 25.0105 (v) 14.9828 (ented) -261.005 (by) -261.005 (traditional) -261.995 (meth\055) ] TJ 11.9559 TL T* [ (ods) -350.003 (\050e\056g\056\054) -374.991 (ph) 4.98936 (ysically) -349.991 (detaining) -349.986 (the) -350.01 (attack) 10.0032 (er\051\056) -611.006 (Hence\054) -375.001 (most) ] TJ 11.9551 TL T* [ (research) -302.001 (on) -302.998 (creating) -301.981 (adv) 14.9828 (ersarial) -301.989 (e) 15.0122 (xamples) -302.984 (\050e\056g\056\054) -301.984 (\133) ] TJ ET Q 1 0 0 0 k q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 506.719 296.629 Tm (2) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 511.7 296.629 Tm (\054) Tj ET Q 1 0 0 0 k q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 517.199 296.629 Tm (23) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 527.162 296.629 Tm [ (\135\051) -303.013 (or) ] TJ -218.3 -11.9551 Td [ (defending) -387.014 (ag) 5.01877 (ainst) -385.992 (them) -387.014 (\050e\056g\056\054) -386.009 (\133) ] TJ ET Q 1 0 0 0 k q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 435.716 284.673 Tm (17) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 445.679 284.673 Tm (\054) Tj ET Q 1 0 0 0 k q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 452.025 284.673 Tm (12) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 461.987 284.673 Tm [ (\135\051) -387 (focus) 0.99003 (es) -386.994 (on) -386.984 (adv) 14.9828 (er) 19.9869 (\055) ] TJ -153.125 -11.9551 Td [ (sarial) -275.986 (e) 15.0122 (xamples) -276.986 (that) -276.018 (are) ] TJ /R36 9.9626 Tf 97.182 0 Td [ (imper) 36.9889 (ceptible) ] TJ /R28 9.9626 Tf 54.4148 0 Td [ (\054) -283.007 (i\056e\056\054) -283.002 (a) -277.017 (human) -276.008 (w) 10.0032 (ould) ] TJ -151.597 -11.9551 Td [ (consider) -249.98 (them) -250.017 (perceptually) -250.017 (similar) -250.002 (to) -249.988 (benign) -250.012 (images\056) ] TJ 11.9551 -12.3906 Td [ (The) -210 (de) 15.0171 (gree) -208.992 (to) -209.992 (which) -209.009 (an) -210.004 (adv) 14.9828 (ersarial) -210.004 (e) 15.0122 (xample) -209.004 (is) -209.989 (impercep\055) ] TJ -11.9551 -11.9551 Td [ (tible) -242.996 (from) -241.989 (its) -242.999 (benign) -242.016 (original) -242.989 (is) -241.984 (usually) -242.989 (measured) -241.989 (using) ] TJ /R26 9.9626 Tf 221.547 0 Td [ (L) -0.60284 ] TJ /R38 6.9738 Tf 6.78008 -1.49492 Td [ (p) -0.90321 ] TJ /R28 9.9626 Tf 4.60508 1.49492 Td (\055) Tj -232.932 -11.9551 Td [ (norms\054) -216.015 (e\056g\056\054) ] TJ /R26 9.9626 Tf 48.5871 0 Td [ (L) -0.60039 ] TJ /R40 6.9738 Tf 6.77969 -1.49492 Td [ (0) -0.50062 ] TJ /R28 9.9626 Tf 6.54336 1.49492 Td [ (\050e\056g\056\054) -208 (\133) ] TJ ET Q 1 0 0 0 k q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 396.356 224.463 Tm (23) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 406.319 224.463 Tm (\135\051\054) Tj /R26 9.9626 Tf 11.2832 0 Td [ (L) -0.60284 ] TJ /R40 6.9738 Tf 6.78008 -1.49492 Td [ (2) -0.49712 ] TJ /R28 9.9626 Tf 6.54219 1.49492 Td [ (\050e\056g\056\054) -208 (\133) ] TJ ET Q 1 0 0 0 k q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 456.508 224.463 Tm (29) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 466.471 224.463 Tm [ (\135\051\054) -216.988 (or) ] TJ /R26 9.9626 Tf 21.6555 0 Td [ (L) -0.60284 ] TJ /R42 6.9738 Tf 6.78008 -1.49492 Td [ (1) -0.90321 ] TJ /R28 9.9626 Tf 10.5137 1.49492 Td [ (\050e\056g\056\054) -208 (\133) ] TJ ET Q 1 0 0 0 k q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 531.004 224.463 Tm (7) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R28 9.9626 Tf 1 0 0 1 535.985 224.463 Tm (\135\051\056) Tj -227.123 -11.9559 Td [ (Informally) 64.9965 (\054) -461.019 (f) 1.01699 (o) -1.01454 (r) -418.011 (images\054) ] TJ /R26 9.9626 Tf 100.128 0 Td [ (L) -0.60284 ] TJ /R40 6.9738 Tf 6.78086 -1.49414 Td [ (0) -0.49712 ] TJ /R28 9.9626 Tf 8.63789 1.49414 Td [ (measures) -417.994 (the) -418.979 (number) -417.989 (of) -418.989 (pix\055) ] TJ -115.547 -11.9551 Td [ (els) -275.983 (that) -274.998 (are) -276.005 (dif) 24.986 (ferent) -275.015 (between) -275.988 (tw) 10.0081 (o) -275.008 (images\054) ] TJ /R26 9.9626 Tf 170.265 0 Td [ (L) -0.60284 ] TJ /R40 6.9738 Tf 6.78008 -1.49414 Td [ (2) -0.49712 ] TJ /R28 9.9626 Tf 7.21523 1.49414 Td [ (measures) -276.018 (the) ] TJ -184.26 -11.9551 Td [ (Euclidean) -262.015 (distance) -262.998 (between) -261.991 (tw) 10.0081 (o) -263.01 (images\054) -264.99 (and) ] TJ /R26 9.9626 Tf 181.344 0 Td [ (L) -0.60284 ] TJ /R42 6.9738 Tf 6.78086 -1.49414 Td [ (1) -0.90321 ] TJ /R28 9.9626 Tf 11.0551 1.49414 Td (measures) Tj -199.18 -11.9551 Td [ (the) -303 (lar) 17.997 (gest) -302.994 (dif) 24.986 (ference) -302.989 (between) -303.003 (corresponding) -303.013 (pix) 14.9975 (els) -302.998 (in) -302.998 (tw) 10.0081 (o) ] TJ 11.9551 TL T* [ (images\056) -419.004 (These) -285.984 (measures) -286.018 (of) -285.991 (imperceptibility) -286.001 (are) -286.982 (critica) 0.98513 (l) -287.006 (for) ] TJ T* [ (creating) -306.02 (adv) 14.9828 (ersarial) -307.008 (e) 15.0122 (xamples) -306.003 (and) -305.983 (defending) -306.008 (ag) 5.01877 (ainst) -306.988 (them\056) ] TJ 11.9563 TL T* [ (On) -412.002 (the) -410.983 (one) -412.005 (hand\054) -451.991 (algorithms) -410.98 (for) -412.01 (creating) -410.98 (adv) 14.9828 (ersarial) -412.01 (e) 15.0122 (x\055) ] TJ 11.9551 TL T* [ (amples) -387.992 (seek) -388.011 (to) -388.982 (enhance) -388.016 (their) -388.004 (imperceptibility) -387.984 (by) -388.984 (produc\055) ] TJ T* [ (ing) -290.993 (inputs) -289.996 (that) -290.996 (both) -290.988 (cause) -291.01 <6d6973636c6173736902636174696f6e> -289.996 (and) -291.005 (whose) -290.996 (dis\055) ] TJ T* [ (tance) -341.002 (from) -340.012 (their) -340.99 (corresponding) -339.987 (benign) -341.017 (originals) -339.987 (has) -340.997 (small) ] TJ /R26 9.9626 Tf T* [ (L) -0.60039 ] TJ /R38 6.9738 Tf 6.78008 -1.49492 Td [ (p) -0.89971 ] TJ /R28 9.9626 Tf 4.60508 1.49492 Td [ (\055norm\056) -449.986 (On) -297.002 (the) -297.002 (other) -296.019 (hand\054) -308.993 (defense) -295.99 (mechanisms) -297.009 (assume) ] TJ -11.3852 -11.9551 Td [ (that) -249.983 (if) -249.993 (the) -249.99 (dif) 24.986 (ference) -250.017 (between) -249.993 (tw) 10.0081 (o) -249.993 (inputs) -250.002 (is) -251.002 (belo) 24.9909 (w) -249.993 (a) -250.002 <73706563690263> ] TJ -13.741 -29.8879 Td (1) Tj ET Q Q Q q q 1 1 1 rg /a0 gs 48.406 786.422 515.188 -52.699 re f q /s5 gs /x6 Do Q q /s7 gs /x8 Do Q q /s9 gs /x10 Do Q q /s11 gs /x12 Do Q Q Q Q q 1 0 0 1 0 0 cm BT /F1 12 Tf 14.4 TL ET 1 1 1 rg n 270 47 72 14 re f* 0.5 0.5 0.5 rg BT /F2 9 Tf 10.8 TL ET BT 1 0 0 1 297 50 Tm (1718) Tj T* ET Q endstream endobj 14 0 obj << /Filter /FlateDecode /Resources << /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x18 15 0 R >> >> /Length 28 /Group << /Type /Group /S /Transparency /CS /DeviceRGB /I true >> /BBox [ 78 746 96 765 ] /Type /XObject /Subtype /Form >> stream x+O4PH/VЯ0Pp 0 endstream endobj 15 0 obj << /Filter /FlateDecode /Resources 16 0 R /Length 107 /Type /XObject /BBox [ 78 746 96 765 ] /Subtype /Form >> stream xe AC̬wʠ =p,?]%+H-
Jc "82w8VSnGW;"
endstream
endobj
16 0 obj
<<
/ExtGState <<
/a0 <<
/CA 1
/ca 1
>>
>>
>>
endobj
17 0 obj
<<
/Filter /FlateDecode
/Resources <<
/ExtGState <<
/a0 <<
/CA 1
/ca 1
>>
>>
/XObject <<
/x15 18 0 R
>>
>>
/Length 28
/Group <<
/Type /Group
/S /Transparency
/CS /DeviceRGB
/I true
>>
/BBox [ 67 752 84 775 ]
/Type /XObject
/Subtype /Form
>>
stream
x+O4PH/VЯ04Up
0
endstream
endobj
18 0 obj
<<
/Filter /FlateDecode
/Resources 19 0 R
/Length 228
/Type /XObject
/BBox [ 67 752 84 775 ]
/Subtype /Form
>>
stream
xeQKn!s ?FPav6R٪TS.
b];15YyR
{7QL.\:Rv/x9l+L7h%1!}i/AI(kz"U&,YO![R hg{3}4/GyYF:!w}Gn+'xJcO9i뽼_-:`
endstream
endobj
19 0 obj
<<
/ExtGState <<
/a0 <<
/CA 1
/ca 1
>>
>>
>>
endobj
20 0 obj
<<
/Filter /FlateDecode
/Resources <<
/ExtGState <<
/a0 <<
/CA 1
/ca 1
>>
>>
/XObject <<
/x24 21 0 R
>>
>>
/Length 28
/Group <<
/Type /Group
/S /Transparency
/CS /DeviceRGB
/I true
>>
/BBox [ 112 751 500 772 ]
/Type /XObject
/Subtype /Form
>>
stream
x+O4PH/VЯ02Qp
0
endstream
endobj
21 0 obj
<<
/Filter /FlateDecode
/Resources 22 0 R
/Length 56490
/Type /XObject
/BBox [ 112 751 500 772 ]
/Subtype /Form
>>
stream
xtIJ5*|^~x?P9)<<ҥ+kh4}/?>]漿վ]Z Ǭ57W'b~?Kwk6:>rAニxeG1k-/LfߗA̺(egk5>
=KO1{Vux}Ol|_s؟|*>5=k|*a5x}On :97~1s7rX {|>IQQo6|'\#x_ڽC}M7(췀(N
سW#^Ň}|zblnB'\o=r;$s:z-
V3+έ昵 WD/nl ;q"3Pg휅\3C`k7760c9-Cȸ