perturb-ai/efficientnet-v2-l-adv-dataset

Perturb Adversarial Images

Verified adversarial examples for efficientnet_v2_l (torchvision/EfficientNet_V2_L_Weights.IMAGENET1K_V1), produced by the Perturb network. Each row is one clean image together with all of its verified adversarial versions: images that are imperceptibly different from the original (L∞ ≤ 0.03 in [0,1] pixel scale) yet change the model's top-1 prediction.

This dataset grows continuously. New rows are appended as the network produces them and uploaded in batches; re-run load_dataset (or pass download_mode="force_redownload") to pick up the latest.

Intended use

Adversarial training / fine-tuning of image classifiers, and evaluation of robustness against small L∞ perturbations. For each row, (image, label) is a clean training pair and every element of adversarial is a hard example that should be classified as label too. Clean images were sourced from ImageNet-100 at first and from ImageNet-1k later, so label indices live in two different spaces; label_name is the stable key.

from datasets import load_dataset
import random

ds = load_dataset("perturb-ai/efficientnet-v2-l-adv-dataset", split="train")
row = ds[0]
clean, label_name = row["image"], row["label_name"]   # map label_name to your model's class index
adv = random.choice(row["adversarial"])                # sample one adversarial version per step

Stream it if you don't want to download everything:

ds = load_dataset("perturb-ai/efficientnet-v2-l-adv-dataset", split="train", streaming=True)

Schema

One row per clean image sent to the network, with the adversarial versions returned for it. The same source image may appear in more than one row if it was sent again later; group by image_id if you need one entry per picture.

Verification

Every adversarial image was verified by the Perturb network's validators before it reached the leaderboard this dataset is built from: the perturbation stays within L∞ ≤ 0.03, SSIM ≥ 0.98 and PSNR ≥ 38 dB against the original, and torchvision/EfficientNet_V2_L_Weights.IMAGENET1K_V1 (torchvision's canonical preprocessing: resize → center crop → ImageNet normalization) predicts a different top-1 class for the adversarial image than for the original.

The dataset builder additionally enforces integrity: same size as the original, not identical, exact duplicates (pixel hash) and near-duplicate perturbation directions (cosine ≥ 0.98) dropped, and at most 50 adversarial images per row, kept by perturbation diversity.

Images are lossless PNG. Do not re-encode them as JPEG; the perturbations are 1–8 grey levels.

Splits

Assigned per clean image (deterministic by image_id), so every row built on the same image shares a split and no test image leaks into training.