vision, the more general definition of fragile recognition that we are introducing here is not useful because human minimal images appear only when the visible area of the object is small.

Since FRIs are hardly distinguishable to humans but cause DNNs to fail, there is a connection with so-called *adversarial examples* presented by [@szegedy2013intriguing]. Adversarial examples are images with small synthetic perturbations that are imperceptible to humans, but produce a sharp drop in DNN recognition accuracy. There are several types, [*eg*. ]{}[@Goodfellow_etal_2014_ICML; @liu2016delving], and the strategies to alleviate them are not able to fully protect DNNs [@tramer2017ensemble; @madry2017towards]. Furthermore, humans may suffer from adversarial attacks; human recognition ability is shown to be impaired by perturbations under rapid image presentation [@elsayed2018adversarial]. Unlike these adversarial examples, fragile recognition arise in natural images without introducing synthetic perturbation. This causes new concerns for use of DNNs in computer vision applications.

We evaluate FRIs in ImageNet [@Deng_etal_2009] for state-of-the-art DNNs, specifically VGG-16 [@Simonyan_etal_2015], Inception [@Szegedy_etal_2014], and ResNet [@He_etal_2016]. Results show that FRIs are abundant and can occur for any region size. Furthermore, we investigate whether fragile recognition is related to the lack of invariance to small changes in the object location, which has been recently 