Fig. 9
From: Defense against adversarial attacks in traffic sign images identification based on 5G
The difference of singular values between normal images and adversarial examples (this figure shows the larger singular value at the top of the sort is less likely to be affected by adversarial perturbation, but it is not true for the little one)