Adversarial Attacks and Defense Mechanisms in Deep Neural Networks
Keywords:
adversarial examples, adversarial machine learning, deep neural networks, adversarial training, black-box attacks, poisoning, backdoors, certified robustness, model security, robustness evaluation.Abstract
Deep neural networks (DNNs) achieve high predictive accuracy but remain vulnerable to deliberately engineered inputs and training-time manipulations. This paper presents a structured review of adversarial attacks and defense mechanisms. It organizes attacks by attacker knowledge, objective, perturbation model, interaction budget, and lifecycle stage; compares gradient-based, optimization-based, transfer, query-based, universal, physical, poisoning, and backdoor attacks; and evaluates defenses spanning adversarial training, preprocessing, detection, architectural regularization, verification, and certified robustness. Particular attention is given to evaluation failure modes such as gradient masking, non-adaptive testing, weak attack configurations, and mismatched threat models. The review finds that empirical robustness is highly conditional on the assumed perturbation set and evaluation procedure, while certified methods provide stronger guarantees but at a cost in scalability and clean accuracy. Adversarial training remains the most consistently effective empirical defense for norm-bounded image perturbations, yet it does not solve poisoning, physical-world, semantic, or cross-domain threats. The paper concludes with an evaluation protocol and a set of research directions for secure DNN deployment.
Downloads
References
A. Oprea and A. Vassilev, “Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations,” NIST AI 100-2 E2023, Initial Public Draft, National Institute of Standards and Technology, Mar. 8, 2023, doi: 10.6028/NIST.AI.100-2e2023.ipd.
S. Zhou, C. Liu, D. Ye, T. Zhu, W. Zhou, and P. S. Yu, “Adversarial Attacks and Defenses in Deep Learning: From a Perspective of Cybersecurity,” ACM Computing Surveys, vol. 55, no. 8, Art. no. 163, pp. 1-39, Dec. 2022, doi: 10.1145/3547330.
Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay, “A survey on adversarial attacks and defences,” CAAI Trans. Intell. Technol. 6, 1, 25–45, 2021.
Alexandru Constantin Serban, Erik Poll, and Joost Visser, “Adversarial examples on object recognition: A comprehensive survey,” ACM Comput. Surv. 53, 3, 66:1–66:38. doi: 10.1145/3398394, 2020.
Gabriel Resende Machado, Eugênio Silva, and Ronaldo Ribeiro Goldschmidt, “Adversarial machine learning in image classification: A survey toward the defender’s perspective,” ACM Comput. Surv. 55, 1, 1–38, 2021.
Xingwei Zhang, Xiaolong Zheng, and Wenji Mao, “Adversarial perturbation defense on deep neural networks,” ACM Comput. Surv. 54, 8, 1–36, 2021.
Ishai Rosenberg, Asaf Shabtai, Yuval Elovici, and Lior Rokach, “Adversarial machine learning attacks and defense methods in the cyber security domain,” ACM Comput. Surv. 54, 5, 1–36, 2021.
Han Xu, Yao Ma, Haochen Liu, Debayan Deb, Hui Liu, Jiliang Tang, and Anil K. Jain, “Adversarial attacks and defenses in images, graphs and text: A review,” Int. J. Autom. Comput. 17, 2, 151–178. doi: 10. 1007/s11633-019-1211-x, 2020.
Kui Ren, Tianhang Zheng, Zhan Qin, and Xue Liu, “Adversarial attacks and defenses in deep learning,” Engineering 6, 3, 346–360. doi: 10.1016/j.eng.2019.12.012, 2020.
Micah Goldblum, Dimitris Tsipras, Chulin Xie, Xinyun Chen, Avi Schwarzschild, Dawn Song, Aleksander Madry, Bo Li, and Tom Goldstein, “Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses,” arXiv:2012.10544, 2020.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus, “Intriguing properties of neural networks,” in Proc. 2nd International Conference on Learning Representations, 2014.
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy, “Explaining and harnessing adversarial examples,” in Proc. 3rd International Conference on Learning Representations, 2015.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu, “Towards deep learning models resistant to adversarial attacks,” in Proc. 6th International Conference on Learning Representations, 2018.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry, “Robustness may be at odds with accuracy,” in Proc. 7th International Conference on Learning Representations, 2019.
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry, “Adversarial examples are not bugs, they are features,” in Proc. Annual Conference on Neural Information Processing Systems, 2019.
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard, “DeepFool: A simple and accurate method to fool deep neural networks,” in Proc. IEEE Conference on Computer Vision and Pattern Recognition, 2016.
Nicholas Carlini and David A. Wagner, “Towards evaluating the robustness of neural networks,” in Proc. IEEE Symposium on Security and Privacy. IEEE Computer Society, 39–57. doi: 10.1109/SP.2017.49, 2017.
Nicolas Papernot, Patrick D. McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami, “The limitations of deep learning in adversarial settings,” in Proc. IEEE European Symposium on Security and Privacy, 2016.
Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio, “Adversarial examples in the physical world,” in Proc. 5th International Conference on Learning Representations, 2017.
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard, “Universal adversarial perturbations,” in Proc. IEEE Conference on Computer Vision and Pattern Recognition. 86–94, 2017.
Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song, “Spatially transformed adversarial examples,” in Proc. 6th International Conference on Learning Representations, 2018.
Pin-Yu Chen, Yash Sharma, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsieh, “EAD: Elastic-net attacks to deep neural networks via adversarial examples,” in Proc. 32nd AAAI Conference on Artificial Intelligence, 2018.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li, “Boosting adversarial attacks with momentum,” in Proc. IEEE Conference on Computer Vision and Pattern Recognition. 9185–9193, 2018.
Francesco Croce and Matthias Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in Proc. International Conference on Machine Learning. PMLR, 2206–2216, 2020.
Francesco Croce and Matthias Hein, “Mind the box: l _1-APGD for sparse adversarial attacks on image classifiers,” in Proc. International Conference on Machine Learning. PMLR, 2201–2211, 2021.
Nicolas Papernot, Patrick D. McDaniel, Ian J. Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami, “Practical black-box attacks against machine learning,” in Proc. ACM on Asia Conference on Computer and Communications Security, 2017.
Wieland Brendel, Jonas Rauber, and Matthias Bethge, “Decision-based adversarial attacks: Reliable attacks against black-box machine learning models,” in Proc. 6th International Conference on Learning Representations, 2018.
Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh, “Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,” in Proc. 10th ACM Workshop on Artificial Intelligence and Security, 2017.
Chun-Chen Tu, Pai-Shun Ting, Pin-Yu Chen, Sijia Liu, Huan Zhang, Jinfeng Yi, Cho-Jui Hsieh, and Shin-Ming Cheng, “AutoZOOM: Autoencoder-based zeroth order optimization method for attacking black-box neural networks,” in Proc. 33rd AAAI Conference on Artificial Intelligence, 2019.
Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin, “Black-box adversarial attacks with limited queries and information,” in Proc. International Conference on Machine Learning. PMLR, 2137–2146, 2018.
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein, “Square attack: A query-efficient black-box adversarial attack via random search,” in Proc. European Conference on Computer Vision. Springer, 484–501, 2020.
Minhao Cheng, Thong Le, Pin-Yu Chen, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsieh, “Query-efficient hard-label black-box attack: An optimization-based approach,” in Proc. 7th International Conference on Learning Representations, 2019.
Minhao Cheng, Simranjit Singh, Patrick Chen, Pin-Yu Chen, Sijia Liu, and Cho-Jui Hsieh, “Sign-opt: A query-efficient hard-label adversarial attack,” arXiv:1909.10773, 2019.
Thibault Maho, Teddy Furon, and Erwan Le Merrer, “SurFree: A fast surrogate-free black-box attack,” in Proc. IEEE/CVF Conference on Computer Vision and Pattern Recognition. 10430–10439, 2021.
Andrew Ilyas, Logan Engstrom, and Aleksander Madry, “Prior convictions: Black-box adversarial attacks with bandits and priors,” in Proc. 7th International Conference on Learning Representations, 2019.
Nina Narodytska and Shiva Prasad Kasiviswanathan, “Simple black-box adversarial perturbations for deep networks,” arXiv:1612.06299, 2016.
Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai, “One pixel attack for fooling deep neural networks,” IEEE Trans. Evolut. Computat. 23, 5, 828–841, 2019.
Yue Zhao, Hong Zhu, Ruigang Liang, Qintao Shen, Shengzhi Zhang, and Kai Chen, “Seeing isn’t believing: Towards more robust adversarial attack against real world object detectors,” in Proc. the ACM SIGSAC Conference on Computer and Communications Security, 2019.
Xingxing Wei, Siyuan Liang, Ning Chen, and Xiaochun Cao, “Transferable adversarial attacks for image and video object detection,” in Proc. 28th International Joint Conference on Artificial Intelligence, 2019.
Chenxiao Zhao, P. Thomas Fletcher, Mixue Yu, Yaxin Peng, Guixu Zhang, and Chaomin Shen, “The adversarial attack and detection under the Fisher information metric,” in Proc. 33rd AAAI Conference on Artificial Intelligence, 2019.
Zhipeng Wei, Jingjing Chen, Xingxing Wei, Linxi Jiang, Tat-Seng Chua, Fengfeng Zhou, and Yu-Gang Jiang, “Heuristic black-box adversarial attacks on video recognition models,” in Proc. 34th AAAI Conference on Artificial Intelligence, 2020.
Yang Zhang, Hassan Foroosh, Philip David, and Boqing Gong, “CAMOU: Learning physical vehicle camouflages to adversarially attack detectors in the wild,” in Proc. 7th International Conference on Learning Representations, 2019.
Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Won Park, Sara Rampazzi, Qi Alfred Chen, Kevin Fu, and Z. Morley Mao, “Adversarial sensor attack on LiDAR-based perception in autonomous driving,” in Proc. ACM SIGSAC Conference on Computer and Communications Security, 2019.
Zhaohui Che, Ali Borji, Guangtao Zhai, Suiyi Ling, Jing Li, and Patrick Le Callet, “A new ensemble adversarial attack powered by long-term gradient memories,” in Proc. 34th AAAI Conference on Artificial Intelligence. 3405–3413, 2020.
Rima Alaifari, Giovanni S. Alberti, and Tandri Gauksson, “ADef: An iterative algorithm to construct adversarial deformations,” in Proc. 7th International Conference on Learning Representations, 2019.
Dawn Song, Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tramèr, Atul Prakash, and Tadayoshi Kohno, “Physical adversarial examples for object detectors,” in Proc. 12th USENIX Workshop on Offensive Technologies, 2018.
Hiromu Yakura and Jun Sakuma, “Robust audio adversarial example for a physical attack,” in Proc. 28th International Joint Conference on Artificial Intelligence. 5334–5341, 2019.
Kaidi Xu, Sijia Liu, Pu Zhao, Pin-Yu Chen, Huan Zhang, Quanfu Fan, Deniz Erdogmus, Yanzhi Wang, and Xue Lin, “Structured adversarial attack: Towards general implementation and better interpretability,” in Proc. 7th International Conference on Learning Representations, 2019.
Hsueh-Ti Derek Liu, Michael Tao, Chun-Liang Li, Derek Nowrouzezahrai, and Alec Jacobson, “Beyond pixel norm-balls: Parametric adversaries using an analytically differentiable renderer,” in Proc. 7th International Conference on Learning Representations, 2019.
Huan Zhang, Hongge Chen, Zhao Song, Duane S. Boning, Inderjit S. Dhillon, and Cho-Jui Hsieh, “The limitations of adversarial training and the blind-spot attack,” in Proc. 7th International Conference on Learning Representations, 2019.
Jinghui Chen, Dongruo Zhou, Jinfeng Yi, and Quanquan Gu, “A Frank-Wolfe framework for efficient and effective adversarial attacks,” in Proc. 34th AAAI Conference on Artificial Intelligence, 2020.
Tianhang Zheng, Changyou Chen, and Kui Ren, “Distributionally adversarial attack,” in Proc. 33rd AAAI Conference on Artificial Intelligence, 2019.
Zhengli Zhao, Dheeru Dua, and Sameer Singh, “Generating natural adversarial examples,” in Proc. 6th International Conference on Learning Representations, 2018.
Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song, “Generating adversarial examples with adversarial networks,” in Proc. 27th International Joint Conference on Artificial Intelligence, 2018.
Huy Phan, Yi Xie, Siyu Liao, Jie Chen, and Bo Yuan, “CAG: A real-time low-cost enhanced-robustness high-transferability content-aware adversarial attack generator,” in Proc. 34th AAAI Conference on Artificial Intelligence, 2020.
Kenneth T. Co, Luis Muñoz-González, Sixte de Maupeou, and Emil C. Lupu, “Procedural noise adversarial examples for black-box attacks on deep convolutional networks,” in Proc. ACM SIGSAC Conference on Computer and Communications Security. 275–289, 2019.
Chaoning Zhang, Philipp Benz, Chenguo Lin, Adil Karjauv, Jing Wu, and In So Kweon, “A survey on universal adversarial attack,” in Proc. 30th International Joint Conference on Artificial Intelligence. ijcai.org, 4687– 4694. doi: 10.24963/ijcai.2021/635, 2021.
Yash Sharma, Gavin Weiguang Ding, and Marcus A. Brubaker, “On the effectiveness of low frequency perturbations,” in Proc. 28th International Joint Conference on Artificial Intelligence. 3389–3396, 2019.
Zheng Yuan, Jie Zhang, Yunpei Jia, Chuanqi Tan, Tao Xue, and Shiguang Shan, “Meta gradient adversarial attack,” in Proc. IEEE/CVF International Conference on Computer Vision. 7748–7757, 2021.
Xiaosen Wang and Kun He, “Enhancing the transferability of adversarial attacks through variance tuning,” in Proc. IEEE/CVF Conference on Computer Vision and Pattern Recognition. 1924–1933, 2021.
Zhibo Wang, Hengchang Guo, Zhifei Zhang, Wenxin Liu, Zhan Qin, and Kui Ren, “Feature importance-aware transferable adversarial attacks,” in Proc. IEEE/CVF International Conference on Computer Vision. 7639– 7648, 2021.
Yan Feng, Bin Chen, Tao Dai, and Shu-Tao Xia, “Adversarial attack on deep product quantization network for image retrieval,” in Proc. 34th AAAI Conference on Artificial Intelligence, 2020.
Tzungyu Tsai, Kaichen Yang, Tsung-Yi Ho, and Yier Jin, “Robust adversarial objects against deep learning models,” in Proc. 34th AAAI Conference on Artificial Intelligence, 2020.
Elias B. Khalil, Amrita Gupta, and Bistra Dilkina, “Combinatorial attacks on binarized neural networks,” in Proc. 7th International Conference on Learning Representations, 2019.
Sandy Huang, Nicolas Papernot, Ian Goodfellow, Yan Duan, and Pieter Abbeel, “Adversarial attacks on neural network policies,” arXiv:1702.02284, 2017.
Shuyu Cheng, Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu, “Improving black-box adversarial attacks with a transfer-based prior,” Adv. Neural Inf. Process. Syst. 32, 2019.
Giulio Lovisotto, Henry Turner, Ivo Sluganovic, Martin Strohmeier, and Ivan Martinovic, “SLAP: Improving physical adversarial examples with short-lived adversarial perturbations,” in Proc. 30th USENIX Security Symposium (USENIX Security’21), 2021.
Abdullah Hamdi, Matthias Mueller, and Bernard Ghanem, “SADA: Semantic adversarial diagnostic attacks for autonomous applications,” in Proc. 34th AAAI Conference on Artificial Intelligence, 2020.
Bin Liang, Hongcheng Li, Miaoqiang Su, Pan Bian, Xirong Li, and Wenchang Shi, “Deep text classification can be fooled,” in Proc. 27th International Joint Conference on Artificial Intelligence, 2018.
Erwin Quiring, Alwin Maier, and Konrad Rieck, “Misleading authorship attribution of source code using adversarial learning,” in Proc. 28th USENIX Security Symposium, 2019.
Huangzhao Zhang, Zhuo Li, Ge Li, Lei Ma, Yang Liu, and Zhi Jin, “Generating adversarial examples for holding robustness of source code processing models,” in Proc. 34th AAAI Conference on Artificial Intelligence, 2020.
Xiaolei Liu, Kun Wan, Yufei Ding, Xiaosong Zhang, and Qingxin Zhu, “Weighted-sampling audio adversarial example attack,” in Proc. 34th AAAI Conference on Artificial Intelligence, 2020.
Hongting Zhang, Pan Zhou, Qiben Yan, and Xiao-Yang Liu, “Generating robust audio adversarial examples with temporal dependency,” in Proc. 29th International Joint Conference on Artificial Intelligence, 2020.
Xingxing Wei, Jun Zhu, Sha Yuan, and Hang Su, “Sparse adversarial perturbations for videos,” in Proc. 33rd AAAI Conference on Artificial Intelligence, 2019.
Yuan Gong, Boyang Li, Christian Poellabauer, and Yiyu Shi, “Real-time adversarial attacks,” in Proc. 28th International Joint Conference on Artificial Intelligence. 4672–4680, 2019.
Moustapha M. Cisse, Yossi Adi, Natalia Neverova, and Joseph Keshet, “Houdini: Fooling deep structured visual and speech recognition models with adversarial examples,” Adv. Neural Inf. Process. Syst. 30, 2017.
Hengtong Zhang, Tianhang Zheng, Jing Gao, Chenglin Miao, Lu Su, Yaliang Li, and Kui Ren, “Data poisoning attack against knowledge graph embedding,” in Proc. 28th International Joint Conference on Artificial Intelligence, 2019.
Yuzhe Ma, Xiaojin Zhu, and Justin Hsu, “Data poisoning against differentially-private learners: Attacks and defenses,” in Proc. 28th International Joint Conference on Artificial Intelligence, 2019.
Luis Muñoz-González, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C. Lupu, and Fabio Roli, “Towards poisoning of deep learning algorithms with back-gradient optimization,” in Proc. 10th ACM Workshop on Artificial Intelligence and Security. 27–38, 2017.
Chaofei Yang, Qing Wu, Hai Li, and Yiran Chen, “Generative poisoning attack method against neural networks,” arXiv:1703.01340, 2017.
W. Ronny Huang, Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein, “Metapoison: Practical general-purpose clean-label data poisoning,” Adv. Neural Inf. Process. Syst. 33, 12080–12091, 2020.
Ali Shafahi, W. Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein, “Poison frogs! Targeted clean-label poisoning attacks on neural networks,” Adv. Neural Inf. Process. Syst. 31, 2018.
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv:1712.05526, 2017.
Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash, “Hidden trigger backdoor attacks,” in Proc. AAAI Conference on Artificial Intelligence, Vol. 34. 11957–11965, 2020.
Saeed Mahloujifar, Dimitrios I. Diochnos, and Mohammad Mahmoody, “The curse of concentration in robust learning: Evasion and poisoning attacks from concentration of measure,” in Proc. 33rd AAAI Conference on Artificial Intelligence, 2019.
Akhilan Boopathy, Sijia Liu, Gaoyuan Zhang, Cynthia Liu, Pin-Yu Chen, Shiyu Chang, and Luca Daniel, “Proper network interpretability helps adversarial robustness in classification,” in Proc. International Conference on Machine Learning. PMLR, 1014–1023, 2020.
Gavin Weiguang Ding, Kry Yik Chau Lui, Xiaomeng Jin, Luyu Wang, and Ruitong Huang, “On the sensitivity of adversarial robustness to input data distributions,” in Proc. 7th International Conference on Learning Representations, 2019.
Tsui Wei, Huan Zhang, Pin Yu Chen, Jinfeng Yi, Dong Su, Yupeng Gao, Cho Jui Hsieh, and Luca Daniel, “Evaluating the robustness of neural networks: An extreme value theory approach,” in Proc. 6th International Conference on Learning Representations, 2018.
Wenjie Ruan, Min Wu, Youcheng Sun, Xiaowei Huang, Daniel Kroening, and Marta Kwiatkowska, “Global robustness evaluation of deep neural networks with provable guarantees for the Hamming distance,” in Proc. 28th International Joint Conference on Artificial Intelligence. 5944–5952, 2019.
Pengcheng Li, Jinfeng Yi, Bowen Zhou, and Lijun Zhang, “Improving the robustness of deep neural networks via adversarial training with triplet loss,” in Proc. 28th International Joint Conference on Artificial Intelligence, 2019.
Haifeng Qian and Mark N. Wegman, “L2-nonexpansive neural networks,” in Proc. 7th International Conference on Learning Representations, 2019.
Lukas Schott, Jonas Rauber, Matthias Bethge, and Wieland Brendel, “Towards the first adversarially robust neural network model on MNIST,” in Proc. 7th International Conference on Learning Representations, 2019.
Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman, “PixelDefend: Leveraging generative models to understand and defend against adversarial examples,” in Proc. 6th International Conference on Learning Representations, 2018.
Pouya Samangouei, Maya Kabkab, and Rama Chellappa, “Defense-GAN: Protecting classifiers against adversarial attacks using generative models,” in Proc. 6th International Conference on Learning Representations, 2018.
Chuan Guo, Mayank Rana, Moustapha Cissé, and Laurens van der Maaten, “Countering adversarial images using input transformations,” in Proc. 6th International Conference on Learning Representations, 2018.
Gaurav Goswami, Nalini K. Ratha, Akshay Agarwal, Richa Singh, and Mayank Vatsa, “Unravelling robustness of deep learning based face recognition against adversarial attacks,” in Proc. 32nd AAAI Conference on Artificial Intelligence, 2018.
Nicholas Carlini and David A. Wagner, “Adversarial examples are not easily detected: Bypassing ten detection methods,” in Proc. 10th ACM Workshop on Artificial Intelligence and Security. 3–14, 2017.
Ian Goodfellow, “Gradient masking causes clever to overestimate adversarial perturbation size,” arXiv:1804.07870, 2018.
Fuxun Yu, Zhuwei Qin, Chenchen Liu, Liang Zhao, Yanzhi Wang, and Xiang Chen, “Interpreting and evaluating neural network robustness,” in Proc. 28th International Joint Conference on Artificial Intelligence, 2019.
Aditi Raghunathan, Jacob Steinhardt, and Percy Liang, “Certified defenses against adversarial examples,” in Proc. 6th International Conference on Learning Representations, 2018.
Eric Wong and J. Zico Kolter, “Provable defenses against adversarial examples via the convex outer adversarial polytope,” in Proc. 35th International Conference on Machine Learning, 2018.
Aman Sinha, Hongseok Namkoong, and John C. Duchi, “Certifying some distributional robustness with principled adversarial training,” in Proc. 6th International Conference on Learning Representations, 2018.
Kai Y. Xiao, Vincent Tjeng, Nur Muhammad (Mahi) Shafiullah, and Aleksander Madry, “Training for faster adversarial robustness verification via inducing ReLU stability,” in Proc. 7th International Conference on Learning Representations, 2019.
Vincent Tjeng, Kai Y. Xiao, and Russ Tedrake, “Evaluating robustness of neural networks with mixed integer programming,” in Proc. 7th International Conference on Learning Representations, 2019.
Gagandeep Singh, Timon Gehr, Markus Püschel, and Martin T. Vechev, “Boosting robustness certification of neural networks,” in Proc. 7th International Conference on Learning Representations, 2019.
Jacob Buckman, Aurko Roy, Colin Raffel, and Ian J. Goodfellow, “Thermometer encoding: One hot way to resist adversarial examples,” in Proc. 6th International Conference on Learning Representations, 2018.
Xuanqing Liu, Yao Li, Chongruo Wu, and Cho-Jui Hsieh, “Adv-BNN: Improved adversarial defense through robust Bayesian neural network,” in Proc. 7th International Conference on Learning Representations, 2019.
Nupur Kumari, Mayank Singh, Abhishek Sinha, Harshitha Machiraju, Balaji Krishnamurthy, and Vineeth N. Balasubramanian, “Harnessing the vulnerability of latent layers in adversarially trained models,” in Proc. 28th International Joint Conference on Artificial Intelligence. 2779–2785, 2019.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian J. Goodfellow, Dan Boneh, and Patrick D. McDaniel, “Ensemble adversarial training: Attacks and defenses,” in Proc. 6th International Conference on Learning Representations, 2018.
Taesik Na, Jong Hwan Ko, and Saibal Mukhopadhyay, “Cascade adversarial machine learning regularized with a unified embedding,” in Proc. 6th International Conference on Learning Representations, 2018.
Qi-Zhi Cai, Chang Liu, and Dawn Song, “Curriculum adversarial training,” in Proc. 27th International Joint Conference on Artificial Intelligence. 3740–3747, 2018.
Farzan Farnia, Jesse M. Zhang, and David Tse, “Generalizable adversarial training via spectral normalization,” in Proc. 7th International Conference on Learning Representations, 2019.
Chuanbiao Song, Kun He, Liwei Wang, and John E. Hopcroft, “Improving the generalization of adversarial training with domain adaptation,” in Proc. 7th International Conference on Learning Representations, 2019.
Nicolas Papernot, Patrick D. McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in Proc. IEEE Symposium on Security and Privacy, 2016.
Micah Goldblum, Liam Fowl, Soheil Feizi, and Tom Goldstein, “Adversarially robust distillation,” in Proc. 34th AAAI Conference on Artificial Intelligence, 2020.
Jörn-Henrik Jacobsen, Jens Behrmann, Richard S. Zemel, and Matthias Bethge, “Excessive invariance causes adversarial vulnerability,” in Proc. 7th International Conference on Learning Representations, 2019.
Guneet S. Dhillon, Kamyar Azizzadenesheli, Zachary C. Lipton, Jeremy Bernstein, Jean Kossaifi, Aran Khanna, and Animashree Anandkumar, “Stochastic activation pruning for robust adversarial defense,” in Proc. 6th International Conference on Learning Representations, 2018.
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan L. Yuille, “Mitigating adversarial effects through randomization,” in Proc. 6th International Conference on Learning Representations, 2018.
Chong Xiang, Arjun Nitin Bhagoji, Vikash Sehwag, and Prateek Mittal, “PatchGuard: A provably robust defense against adversarial patches via small receptive fields and masking,” in Proc. 30th USENIX Security Symposium (USENIX Security’21), 2021.
Zhuolin Yang, Bo Li, Pin-Yu Chen, and Dawn Song, “Characterizing audio adversarial examples using temporal dependency,” in Proc. 7th International Conference on Learning Representations, 2019.
Shehzeen Hussain, Paarth Neekhara, Shlomo Dubnov, Julian McAuley, and Farinaz Koushanfar, “WaveGuard: Understanding and mitigating audio adversarial examples,” in Proc. 30th USENIX Security Symposium (USENIX Security’21), 2021.
Jan Svoboda, Jonathan Masci, Federico Monti, Michael M. Bronstein, and Leonidas J. Guibas, “PeerNets: Exploiting peer wisdom against adversarial attacks,” in Proc. 7th International Conference on Learning Representations, 2019.
Huijun Wu, Chen Wang, Yuriy Tyshetskiy, Andrew Docherty, Kai Lu, and Liming Zhu, “Adversarial examples for graph data: Deep insights into attack and defense,” in Proc. 28th International Joint Conference on Artificial Intelligence. 4816–4823, 2019.
Puyudi Yang, Jianbo Chen, Cho-Jui Hsieh, Jane-Ling Wang, and Michael I. Jordan, “ML-LOO: Detecting adversarial examples with feature attribution,” in Proc. 34th AAAI Conference on Artificial Intelligence, 2020.
Warren He, Bo Li, and Dawn Song, “Decision boundary analysis of adversarial examples,” in Proc. 6th International Conference on Learning Representations, 2018.
Xingjun Ma, Bo Li, Yisen Wang, Sarah M. Erfani, Sudanthi N. R. Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E. Houle, and James Bailey, “Characterizing adversarial subspaces using local intrinsic dimensionality,” in Proc. 6th International Conference on Learning Representations, 2018.
Bo Huang, Yi Wang, and Wei Wang, “Model-agnostic adversarial detection by random perturbations,” in Proc. 28th International Joint Conference on Artificial Intelligence, 2019.
Celia Cintas, Skyler Speakman, Victor Akinwande, William Ogallo, Komminist Weldemariam, Srihari Sridharan, and Edward McFowland, “Detecting adversarial attacks via subset scanning of autoencoder activations and reconstruction error,” in Proc. 29th International Joint Conference on Artificial Intelligence. 876–882, 2020.
Partha Ghosh, Arpan Losalka, and Michael J. Black, “Resisting adversarial attacks using Gaussian mixture variational autoencoders,” in Proc. 33rd AAAI Conference on Artificial Intelligence, 2019.
Haohan Wang, Xindi Wu, Zeyi Huang, and Eric P. Xing, “High-frequency component helps explain the generalization of convolutional neural networks,” in Proc. IEEE/CVF Conference on Computer Vision and Pattern Recognition. 8684–8694, 2020.
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry, “Adversarially robust generalization requires more data,” in Proc. 32nd International Conference on Neural Information Processing Systems. 5019–5031, 2018.
Dan Hendrycks, Kimin Lee, and Mantas Mazeika, “Using pre-training can improve model robustness and uncertainty,” in Proc. International Conference on Machine Learning. PMLR, 2712–2721, 2019.
Adnan Siraj Rakin, Zhezhi He, Boqing Gong, and Deliang Fan, “Blind pre-processing: A robust defense method against adversarial examples,” arXiv:1802.01549, 2018.
Zeyuan Allen-Zhu and Yuanzhi Li, “Feature purification: How adversarial training performs robust deep learning,” in Proc. IEEE 62nd Annual Symposium on Foundations of Computer Science (FOCS). IEEE, 977–988, 2022.
Jing Wu, Mingyi Zhou, Ce Zhu, Yipeng Liu, Mehrtash Harandi, and Li Li, “Performance evaluation of adversarial attacks: Discrepancies and solutions,” arXiv:2104.11103, 2021.
H. Zhang, Y. Yu, J. Jiao, E. P. Xing, L. El Ghaoui, and M. I. Jordan, “Theoretically Principled Trade-off between Robustness and Accuracy,” in Proc. 36th Int. Conf. Machine Learning (ICML), PMLR, vol. 97, pp. 7472-7482, 2019.
J. M. Cohen, E. Rosenfeld, and J. Z. Kolter, “Certified Adversarial Robustness via Randomized Smoothing,” in Proc. 36th Int. Conf. Machine Learning (ICML), PMLR, vol. 97, pp. 1310-1320, 2019.
A. Athalye, N. Carlini, and D. Wagner, “Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples,” in Proc. 35th Int. Conf. Machine Learning (ICML), PMLR, vol. 80, pp. 274-283, 2018.
A. Shafahi, M. Najibi, M. A. Ghiasi, Z. Xu, J. Dickerson, C. Studer, L. S. Davis, G. Taylor, and T. Goldstein, “Adversarial Training for Free!,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 32, 2019.
E. Wong, L. Rice, and J. Z. Kolter, “Fast Is Better Than Free: Revisiting Adversarial Training,” in Proc. Int. Conf. Learning Representations (ICLR), 2020.
L. Rice, E. Wong, and J. Z. Kolter, “Overfitting in Adversarially Robust Deep Learning,” in Proc. 37th Int. Conf. Machine Learning (ICML), PMLR, vol. 119, pp. 8093-8104, 2020.
Y. Wang, D. Zou, J. Yi, J. Bailey, X. Ma, and Q. Gu, “Improving Adversarial Robustness Requires Revisiting Misclassified Examples,” in Proc. Int. Conf. Learning Representations (ICLR), 2020.
F. Tramèr, N. Carlini, W. Brendel, and A. Madry, “On Adaptive Attacks to Adversarial Example Defenses,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 33, 2020.
F. Croce, M. Andriushchenko, V. Sehwag, E. Debenedetti, N. Flammarion, M. Chiang, P. Mittal, and M. Hein, “RobustBench: A Standardized Adversarial Robustness Benchmark,” in NeurIPS Datasets and Benchmarks Track, 2021.
Downloads
Published
How to Cite
Issue
Section
License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
All papers should be submitted electronically. All submitted manuscripts must be original work that is not under submission at another journal or under consideration for publication in another form, such as a monograph or chapter of a book. Authors of submitted papers are obligated not to submit their paper for publication elsewhere until an editorial decision is rendered on their submission. Further, authors of accepted papers are prohibited from publishing the results in other publications that appear before the paper is published in the Journal unless they receive approval for doing so from the Editor-In-Chief.
IJISAE open access articles are licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. This license lets the audience to give appropriate credit, provide a link to the license, and indicate if changes were made and if they remix, transform, or build upon the material, they must distribute contributions under the same license as the original.
