Adversarial Examples in Modern Machine Learning: A Review

Abstract

Recent research has found that many families of machine learning models are vulnerable to adversarial examples: inputs that are specifically designed to cause the target model to produce erroneous outputs. In this survey, we focus on machine learning models in the visual domain, where methods for generating and detecting such examples have been most extensively studied. We explore a variety of adversarial attack methods that apply to image-space content, real world adversarial attacks, adversarial defenses, and the transferability property of adversarial examples. We also discuss strengths and weaknesses of various methods of adversarial attack and defense. Our aim is to provide an extensive coverage of the field, furnishing the reader with an intuitive understanding of the mechanics of adversarial attack and defense mechanisms and enlarging the community of researchers studying this fundamental set of problems.

Work in progress, 97 pages

References in corpus (56)

• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• Distilling the Knowledge in a Neural Network
• Sequence to Sequence Learning with Neural Networks
• Overcoming catastrophic forgetting in neural networks
• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• YOLOv3: An Incremental Improvement
• On the difficulty of training Recurrent Neural Networks
• Trust Region Policy Optimization
• Conditional Image Generation with PixelCNN Decoders
• Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computation
• Densely Connected Convolutional Networks
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• CheXNet: Radiologist-Level Pneumonia Detection on Chest X-Rays with Deep Learning
• Delving into Transferable Adversarial Examples and Black-box Attacks
• The Loss Surfaces of Multilayer Networks
• ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness
• On Evaluating Adversarial Robustness
• Stacked Hourglass Networks for Human Pose Estimation
• Matrix estimation by Universal Singular Value Thresholding
• A large annotated corpus for learning natural language inference
• The Space of Transferable Adversarial Examples
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• Robustness May Be at Odds with Accuracy
• First Steps Toward Camera Model Identification with Convolutional Neural Networks
• Learning with a Strong Adversary
• A study of the effect of JPG compression on adversarial images
• Defensive Distillation is Not Robust to Adversarial Examples
• Towards the first adversarially robust neural network model on MNIST
• On Detecting Adversarial Perturbations
• Better Mixing via Deep Representations
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• Did you hear that? Adversarial Examples Against Automatic Speech Recognition
• Measuring the tendency of CNNs to Learn Surface Statistical Regularities
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• DeepFool: a simple and accurate method to fool deep neural networks
• Adversarial Attacks Against Medical Deep Learning Systems
• Fast Feature Fool: A data independent approach to universal adversarial perturbations
• Deep Learning Face Attributes in the Wild
• Adversarial Examples for Semantic Segmentation and Object Detection
• Blocking Transferability of Adversarial Examples in Black-Box Learning Systems
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing
• A Counter-Forensic Method for CNN-Based Camera Model Identification
• Interpreting Adversarially Trained Convolutional Neural Networks
• Adversarial Attacks on Neural Network Policies
• The Limitations of Deep Learning in Adversarial Settings
• Adversarial Manipulation of Deep Representations
• Deep Manifold Traversal: Changing Labels with Convolutional Features
• Standard detectors aren't (currently) fooled by physical adversarial stop signs
• Fortified Networks: Improving the Robustness of Deep Networks by Modeling the Manifold of Hidden Representations
• Beyond Pixel Norm-Balls: Parametric Adversaries using an Analytically Differentiable Renderer
• Transfer of Adversarial Robustness Between Perturbation Types

Cited by in corpus (11)

• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Recent Advances in Adversarial Training for Adversarial Robustness
• A survey on Adversarial Recommender Systems: from Attack/Defense strategies to Generative Adversarial Networks
• Physical Adversarial Attacks for Surveillance: A Survey
• Adversarial Machine Learning in Wireless Communications using RF Data: A Review
• Security and Privacy for Artificial Intelligence: Opportunities and Challenges
• Recent Advances in Understanding Adversarial Robustness of Deep Neural Networks
• EvoBA: An Evolution Strategy as a Strong Baseline forBlack-Box Adversarial Attacks
• Improving Adversarial Robustness for Free with Snapshot Ensemble
• Derivation of Information-Theoretically Optimal Adversarial Attacks with Applications to Robust Machine Learning
• Localized Uncertainty Attacks