dataset biases.

In Figure \[fig:confidence\_maps\] we display the DNN’s output confidence in the true class for individual regions in map form. We see that sharp drops in confidence are frequent within an image, providing a basis for minimal images. Finally, in Figure \[fig:activation\_vis\_example\] we show qualitative examples of the activation maps at different layers of the DNN of the correctly classified crop and its shifted version. These examples show what we have observed in all cases: the activation maps are imperceptibly similar at the first layers but are clearly different at the last layers.

Finally, we show qualitative examples to illustrate that FRIs are a concern for computer vision systems based on similar DNNs architectures. We conducted a test on detection algorithms, to validate that FRIs dramatically affect both the location and the label of the detected objects. In Figure \[fig:yolo\_examples\] we show FRIs for the widely used object detector called “YOLO” [@redmon2017yolo9000].

Fragile recognition with data augmentation and regularization
-------------------------------------------------------------

We now investigate if data augmentation and regularization help alleviate fragile recognition. In this experiment we use the CIFAR-10 dataset [@Krizhevsky_etal_2009], which contains $10$ object categories, $50,000$ training images and $10,000$ testing images of size $32 \times 32$ pixels. 