I am trying to understand why adversarial attacks work in theory.

I have read, that the image is perturbed by a special perturbation $X_{adv}=X_1+p$, but i can't find any reference on that perturbation being an i.i.d. violation by itself.

If the i.i.d. assumption is not violated, then the only meaningful explanation in my mind would be, that the current date observed is out of distribution. But wouldn't this be an i.i.d. violation also?


1 Answer 1


I believe adversarial samples violate i.i.d. by definition.

They are constructed by an adversary to undermine our model. Thus, they are not independently chosen, and are not randomly distributed.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .