Adversarial Examples on Object Recognition: A Comprehensive Survey
arXiv:2008.04094
Abstract
Deep neural networks are at the forefront of machine learning research. However, despite achieving impressive performance on complex tasks, they can be very sensitive: Small perturbations of inputs can be sufficient to induce incorrect behavior. Such perturbations, called adversarial examples, are intentionally designed to test the network's sensitivity to distribution drifts. Given their surprisingly small size, a wide body of literature conjectures on their existence and how this phenomenon can be mitigated. In this article we discuss the impact of adversarial examples on security, safety, and robustness of neural networks. We start by introducing the hypotheses behind their existence, the methods used to construct or protect against them, and the capacity to transfer adversarial examples between different machine learning models. Altogether, the goal is to provide a comprehensive and self-contained survey of this growing field of research.
Published in ACM CSUR. arXiv admin note: text overlap with arXiv:1810.01185
References in corpus (74)
- Distilling the Knowledge in a Neural Network
- Sequence to Sequence Learning with Neural Networks
- Stochastic Backpropagation and Approximate Inference in Deep Generative Models
- Ensemble Adversarial Training: Attacks and Defenses
- ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- Towards Deep Neural Network Architectures Robust to Adversarial Examples
- On Evaluating Adversarial Robustness
- Group Equivariant Convolutional Networks
- Robust Physical-World Attacks on Deep Learning Models
- The Space of Transferable Adversarial Examples
- Countering Adversarial Images using Input Transformations
- Security Evaluation of Pattern Classifiers under Attack
- Adversarial Examples Are Not Bugs, They Are Features
- Adversarial Machine Learning at Scale
- Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
- Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
- Detecting Adversarial Samples from Artifacts
- On the (Statistical) Detection of Adversarial Examples
- Certifying Some Distributional Robustness with Principled Adversarial Training
- Black-box Adversarial Attacks with Limited Queries and Information
- Adversarial Perturbations Against Deep Neural Networks for Malware Classification
- PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
- On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
- Learning with a Strong Adversary
- A study of the effect of JPG compression on adversarial images
- Spatially Transformed Adversarial Examples
- Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
- Adversarial Transformation Networks: Learning to Generate Adversarial Examples
- On Detecting Adversarial Perturbations
- Stochastic Activation Pruning for Robust Adversarial Defense
- Measuring the tendency of CNNs to Learn Surface Statistical Regularities
- Robust Audio Adversarial Example for a Physical Attack
- Simple Black-Box Adversarial Perturbations for Deep Networks
- Motivating the Rules of the Game for Adversarial Example Research
- Adversarial Examples that Fool both Computer Vision and Time-Limited Humans
- MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
- Foveation-based Mechanisms Alleviate Adversarial Examples
- A Boundary Tilting Persepective on the Phenomenon of Adversarial Examples
- Adversarial examples from computational constraints
- A Game-Based Approximate Verification of Deep Neural Networks with Provable Guarantees
- Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples
- Biologically inspired protection of deep networks from adversarial attacks
- Provably Minimally-Distorted Adversarial Examples
- Generative Adversarial Trainer: Defense to Adversarial Perturbations with GAN
- Attacking the Madry Defense Model with -based Adversarial Examples
- DeepCloak: Masking Deep Neural Network Models for Robustness Against Adversarial Samples
- Towards Practical Verification of Machine Learning: The Case of Computer Vision Systems
- Exploring the Space of Black-box Attacks on Deep Neural Networks
- Adversarial Attacks on Neural Network Policies
- Adversarial Manipulation of Deep Representations
- Are Accuracy and Robustness Correlated?
- A Survey of Safety and Trustworthiness of Deep Neural Networks: Verification, Testing, Adversarial Attack and Defence, and Interpretability
- Standard detectors aren't (currently) fooled by physical adversarial stop signs
- Defending against Adversarial Images using Basis Functions Transformations
- Robustness of classifiers to universal perturbations: a geometric perspective
- Adversarial Spheres
- Transferable Adversarial Attacks for Image and Video Object Detection
- Fortified Networks: Improving the Robustness of Deep Networks by Modeling the Manifold of Hidden Representations
- GenAttack: Practical Black-box Attacks with Gradient-Free Optimization
- Attacking Binarized Neural Networks
- Gradient Masking Causes CLEVER to Overestimate Adversarial Perturbation Size
- PAC-learning in the presence of evasion adversaries
- Robustness of Rotation-Equivariant Networks to Adversarial Perturbations
- Adversarially Robust Training through Structured Gradient Regularization
- HyperNetworks with statistical filtering for defending adversarial examples
- Generic Black-Box End-to-End Attack Against State of the Art API Call Based Malware Classifiers
- A Marauder's Map of Security and Privacy in Machine Learning
- Blind Pre-Processing: A Robust Defense Method Against Adversarial Examples
- Detecting Adversarial Examples via Key-based Network
- Limitations of the Lipschitz constant as a defense against adversarial examples
- Towards Understanding Limitations of Pixel Discretization Against Adversarial Attacks
- Detecting Adversarial Perturbations with Saliency