“Recent studies have shown that modern deep neural network classifiers are easy to fool, assuming that an adversary is able to slightly modify their inputs. Many papers have proposed adversarial attacks, defenses and methods to measure robustness to such adversarial perturbations. However, most commonly considered adversarial examples are based on perturbations in the input space of the neural network that are unlikely to arise naturally. … In this paper, we propose several metrics to measure robustness of classifiers to natural adversarial examples, and methods to evaluate them.”

Find the paper and full list of authors at ArXiv.