A Review of Adversarial Attack and Defense for Classification Methods

Abstract

Despite the efficiency and scalability of machine learning systems, recent studies have demonstrated that many classification methods, especially deep neural networks (DNNs), are vulnerable to adversarial examples; i.e., examples that are carefully crafted to fool a well-trained classification model while being indistinguishable from natural data to human. This makes it potentially unsafe to apply DNNs or related methods in security-critical areas. Since this issue was first identified by Biggio et al. (2013) and Szegedy et al.(2014), much work has been done in this field, including the development of attack methods to generate adversarial examples and the construction of defense techniques to guard against such examples. This paper aims to introduce this topic and its latest developments to the statistical community, primarily focusing on the generation and guarding of adversarial examples. Computing codes (in python and R) used in the numerical experiments are publicly available for readers to explore the surveyed methods. It is the hope of the authors that this paper will encourage more statisticians to work on this important and exciting field of generating and defending against adversarial examples.

References in corpus (41)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
• Theoretically Principled Trade-off between Robustness and Accuracy
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Certified Adversarial Robustness via Randomized Smoothing
• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• Fast is better than free: Revisiting adversarial training
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• Black-box Adversarial Attacks with Limited Queries and Information
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Adversarial Weight Perturbation Helps Robust Generalization
• Stochastic Activation Pruning for Robust Adversarial Defense
• On the Convergence and Robustness of Adversarial Training
• Improving Black-box Adversarial Attacks with a Transfer-based Prior
• Towards Crafting Text Adversarial Samples
• Simple Black-box Adversarial Attacks
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• A Boundary Tilting Persepective on the Phenomenon of Adversarial Examples
• Robustness of classifiers: from adversarial to random noise
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
• Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network
• MMA Training: Direct Input Space Margin Maximization through Adversarial Training
• Low Frequency Adversarial Perturbation
• You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle
• Boosting Adversarial Training with Hypersphere Embedding
• Wasserstein Adversarial Examples via Projected Sinkhorn Iterations
• Convergence of Adversarial Training in Overparametrized Neural Networks
• NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks
• Learning perturbation sets for robust machine learning
• Robustness Verification of Tree-based Models
• Rank Verification for Exponential Families
• Robustness of classifiers to uniform $\ell \_p$ and Gaussian noise
• Optimal Transport Classifier: Defending Against Adversarial Attacks by Regularized Deep Embedding

Cited by in corpus (4)

• Adversarial Driving: Attacking End-to-End Autonomous Driving
• Implementing Responsible AI: Tensions and Trade-Offs Between Ethics Aspects
• Cross-domain Cross-architecture Black-box Attacks on Fine-tuned Models with Transferred Evolutionary Strategies
• Multi-Excitation Projective Simulation with a Many-Body Physics Inspired Inductive Bias