a fixed size is classified correctly by a given DNN. After extracting the region from the image, the region is resized to be of the size required by the network. The region size is parametrized by $P$, which is defined as the proportion of the image occupied by the region, [*i*.*e*. ]{}$P = S/\min(h, w)$ where $h$ and $w$ are the height and width of the input image, and $S$ is the region’s side length. The results are arranged in a map such that a given map pixel contains the binary correctness for the square region centered at the corresponding pixel in the original image. The resulting map is of dimension $(h - S) \times (w - S)$ due to padding loss. The first two panels of Figure \[fig:MapGeneration\] show a visualization of the correctness map generation process.

![*Fragile recognition image (FRI) maps*. White pixels indicate FRIs and black pixels indicate non FRIs. First row: visualizations of all four types of FRI maps with $P = 0.2$. Second row: visualizations of loose shift FRI maps for $P = 0.2, 0.4, 0.6, 0.8$. Maps generated with Inception [@Szegedy_etal_2014].[]{data-label="fig:MinImgMapEx"}](min-img-map-ex-1.jpg){width="12cm"}

[**2. Fragile recognition image (FRI) extraction from correctness maps.**]{} We define different variations 