The evaluation criteria is top-$1$ accuracy. We use CIFAR-10 for convenience and without loss of generality, since the data augmentation and regularization we test are used in the models tested in ImageNet.

We reproduce the AlexNet version for CIFAR-10 introduced by [@zhang2016understanding], which consists of two convolutional-pooling-normalization layers followed by two fully connected layers. In the following, all regularizers and data augmentation are turned off unless stated otherwise. We will analyze the impact of each to fragile recognition.

  --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
   ![ *Impact of data augmentation and regularization in fragile recognition (CIFAR-10).* FRIs can be mitigated but not eliminated. (a) shows that augmenting the training set with crops of FRI sizes reduces overall FRI occurrence, but many FRIs remain. (b) shows that commonly used regularizers may also reduce the percentage of FRIs, but they still occur. []{data-label="fig:improved_generalization"}](confidence_maps/cifar_figures/shift_augmentation.pdf "fig:"){width="6.6cm"}   ![ *Impact of data augmentation and regularization in fragile recognition (CIFAR-10).* FRIs can be mitigated but not eliminated. (a) shows that augmenting the training set with crops of FRI sizes reduces overall FRI occurrence, but many FRIs remain. (b) shows that commonly used regularizers may also reduce the percentage of FRIs, but they still occur. []{data-label="fig:improved_generalization"}](confidence_maps/cifar_figures/shift_regularizers.pdf "fig:"){width="6.6cm"}
                                                                                                                                                                                                                        \(a) data augmentation by cropping image 