Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective

Abstract

Deep Learning algorithms have achieved the state-of-the-art performance for Image Classification and have been used even in security-critical applications, such as biometric recognition systems and self-driving cars. However, recent works have shown those algorithms, which can even surpass the human capabilities, are vulnerable to adversarial examples. In Computer Vision, adversarial examples are images containing subtle perturbations generated by malicious optimization algorithms in order to fool classifiers. As an attempt to mitigate these vulnerabilities, numerous countermeasures have been constantly proposed in literature. Nevertheless, devising an efficient defense mechanism has proven to be a difficult task, since many approaches have already shown to be ineffective to adaptive attackers. Thus, this self-containing paper aims to provide all readerships with a review of the latest research progress on Adversarial Machine Learning in Image Classification, however with a defender's perspective. Here, novel taxonomies for categorizing adversarial attacks and defenses are introduced and discussions about the existence of adversarial examples are provided. Further, in contrast to exisiting surveys, it is also given relevant guidance that should be taken into consideration by researchers when devising and evaluating defenses. Finally, based on the reviewed literature, it is discussed some promising paths for future research.

References in corpus (68)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Deep Learning in Neural Networks: An Overview
• A Survey on Deep Learning in Medical Image Analysis
• Distilling the Knowledge in a Neural Network
• End to End Learning for Self-Driving Cars
• Unpaired Image-to-Image Translation using Cycle-Consistent Adversarial Networks
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• One pixel attack for fooling deep neural networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Evasion Attacks against Machine Learning at Test Time
• Delving into Transferable Adversarial Examples and Black-box Attacks
• On Evaluating Adversarial Robustness
• Robust Physical-World Attacks on Deep Learning Models
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Adversarial Attacks and Defences: A Survey
• The Space of Transferable Adversarial Examples
• Countering Adversarial Images using Input Transformations
• Adversarial Examples Are Not Bugs, They Are Features
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• Certifying Some Distributional Robustness with Principled Adversarial Training
• Black-box Adversarial Attacks with Limited Queries and Information
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• Learning with a Strong Adversary
• Spatially Transformed Adversarial Examples
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Adversarial Transformation Networks: Learning to Generate Adversarial Examples
• On Detecting Adversarial Perturbations
• Adversarial Training Methods for Semi-Supervised Text Classification
• Stochastic Activation Pruning for Robust Adversarial Defense
• Mitigating Adversarial Effects Through Randomization
• Houdini: Fooling Deep Structured Prediction Models
• LaVAN: Localized and Visible Adversarial Noise
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• Early Methods for Detecting Adversarial Images
• On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses
• Adversarial and Clean Data Are Not Twins
• Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network
• UPSET and ANGRI : Breaking High Performance Image Classifiers
• Neural SDE: Stabilizing Neural ODE Networks with Stochastic Noise
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing
• APE-GAN: Adversarial Perturbation Elimination with GAN
• POBA-GA: Perturbation Optimized Black-Box Adversarial Attacks via Genetic Algorithm
• DeepCloak: Masking Deep Neural Network Models for Robustness Against Adversarial Samples
• Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks
• Cascade Adversarial Machine Learning Regularized with a Unified Embedding
• ME-Net: Towards Effective Adversarial Robustness with Matrix Estimation
• Data Poisoning Attacks against Online Learning
• Adversarial Examples in Modern Machine Learning: A Review
• Towards Robust Neural Networks via Random Self-ensemble
• Advbox: a toolbox to generate adversarial examples that fool neural networks
• On Robustness of Neural Ordinary Differential Equations
• Defensive Quantization: When Efficiency Meets Robustness
• Divide, Denoise, and Defend against Adversarial Attacks
• Adversarial Neural Network Inversion via Auxiliary Knowledge Alignment
• Adversarial Examples in Deep Learning: Characterization and Divergence
• Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples
• Robustness to Adversarial Examples through an Ensemble of Specialists
• Improving Network Robustness against Adversarial Attacks with Compact Convolution
• ReabsNet: Detecting and Revising Adversarial Examples
• Defending against Adversarial Attack towards Deep Neural Networks via Collaborative Multi-task Training
• VectorDefense: Vectorization as a Defense to Adversarial Examples
• Adversarial Robustness of Stabilized NeuralODEs Might be from Obfuscated Gradients
• Detecting Adversarial Samples Using Influence Functions and Nearest Neighbors

Cited by in corpus (7)

• Adversarial attacks and defenses in explainable artificial intelligence: A survey
• Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art
• Tarallo: Evading Behavioral Malware Detectors in the Problem Space
• EnTri: Ensemble Learning with Tri-level Representations for Explainable Scene Recognition
• Sticky Fingers: Resilience of Satellite Fingerprinting against Jamming Attacks
• Guiding the retraining of convolutional neural networks against adversarial inputs
• DDSA: Dual-Domain Strategic Attack for Spatial-Temporal Efficiency in Adversarial Robustness Testing