  The robustness of machine learning models has been questioned by the
existence of adversarial examples. We examine the threat of adversarial
examples in practical applications that require lightweight models for
one-class classification. Building on Ilyas et al. (2019), we investigate the
vulnerability of lightweight one-class classifiers to adversarial attacks and
possible reasons for it. Our results show that lightweight one-class
classifiers learn features that are not robust (e.g. texture) under stronger
attacks. However, unlike in multi-class classification (Ilyas et al., 2019),
these non-robust features are not always useful for the one-class task,
suggesting that learning these unpredictive and non-robust features is an
unwanted consequence of training.
