An adversarial example is an input perturbed slightly—often imperceptibly to people—that causes a model to make a confident, incorrect prediction. Such failures expose a gap between strong benchmark performance and robust visual understanding: residual connections and human-level ImageNet results do not guarantee that a CNN will generalize reliably. section 3.6
Synthetic perturbations and real-world brittleness
A subtle input change can fool a network even when people do not notice it. Separately, Google Photos mislabeled images of Black people as “gorillas”—an example of fragile generalization, not an adversarial example. section 3.6




