one-pixel-attack-keras

Why we included this project

Most teams find out their image classifier is fragile only after someone exploits it. This repository makes that lesson cheap to learn. It reimplements the one-pixel attack from the 2017 paper, where an attacker who changes the color of a single pixel, armed with nothing but the model's output probabilities, can usually force a misclassification. The code is a readable Keras tutorial plus a command-line attacker, so you can train a few reference CNNs on CIFAR-10 and see how often each one breaks when the attacker has just one pixel to work with, and whether three or five pixels make the job easier. Because it tests several architectures side by side, you also get a sense of which designs resist better: capsule networks, for instance, hold up better than plain convolutions but remain vulnerable. That makes it a handy benchmark for checking whether your own models are unusually easy to fool.