7 Appendix

Additional experimental results are presented from Section 7.12 on. In Section 5.2 "Alignment of adversarial perturbations with singular vectors", we have seen that As we have seen in Section 4.2, it is the dominant singular vector corresponding to the largest singular value that determines the optimal adversarial perturbation to the Jacobian and hence the maximal amount of signal-gain that can be induced when propagating an The gradient of the loss w.r.t. the logits of the classifier takes The derivation goes as follows. The rest is clever notation. By Hölder's inequality, we have for non-zero z, v See comment after Equation 1.1 in [21]. " 1 (40) where we have used that ( p Moreover, if v is of the form v " sign p z qd| z | Thus, the numerator (and hence the direction) remains the same.