of FRIs, depending if they are based on changes on the location or size of the image region, and on how strict we are when evaluating the changes in the correctness of DNN:

–*Shift or Shrink*: we define two types of “small changes” of the region that affect DNN correctness. “Shift” is a one-pixel translation of the region location; “shrink” is a two-pixel reduction of the region side length within the region’s original boundaries, in a fixed full image size.

–*Strict or Loose*: the visible region can be shifted in various directions, or shrunk in different ways while remaining within its original boundaries. “Loose” FRIs are regions such that there exists a small change that flip network correctness. “Strict” FRIs are regions such that network correctness is flipped for all small changes.

These definitions yield four fragile recognition types: loose shift, loose shrink, strict shift, and strict shrink. Note that strict shrink is the most analogous to human minimal images. The correctness maps are used to detect fragile recognition due to shifts by comparing neighbouring pixels in a correctness map, and due to shrinks by comparing correctness maps at two slightly different region sizes. We use [*fragile recognition image (FRI) 