Recall that we consider a region to be an FRI when the classification changes from correct to incorrect, and also from incorrect to correct. As expected, we found that both of these cases are approximately equally probable under all tested conditions.

In Figure \[fig:PctMinImgVCropSize\], we show the percentage of shrink FRIs in the image for a given region size, $P$; in Figure \[fig:PctMinImgVCropSize\_ext\] we show the same for shift FRIs. All networks are significantly affected by FRIs, with ResNet being the most: almost one out of $50$ regions of a size that covers almost the entire image ($P  = 80\%$) can affect ResNet. When the size of the image region is $P=20\%$, FRIs are even more frequent ($8$ times more), [*i*.*e*. ]{}almost two out of $25$ regions in the image is a loose FRI for ResNet.

Comparing Figure \[fig:PctMinImgVCropSize\]a and Figure \[fig:PctMinImgVCropSize\]b, we see that the proportion of strict FRIs is less than that of loose FRIs because of the more stringent definition. The results show that there are many regions in an image for which the network is very sensitive to slight changes in the region, [*eg*. ]{}one out of $250$ image regions of size $P=20\%$ will be misclassified 