[Paper Review] Adversarial Examples: Attacks and Defenses for Deep Learning

Xiaoyong Yuan, Pan He+2 more|arXiv (Cornell University)|Dec 19, 2017

Adversarial Robustness in Machine Learning133 references222 citations

TL;DR

This survey reviews adversarial examples in deep learning, proposes a taxonomy of attack methods, surveys applications and defenses, and outlines key challenges and future directions.

ABSTRACT

With rapid progress and significant successes in a wide spectrum of applications, deep learning is being applied in many safety-critical environments. However, deep neural networks have been recently found vulnerable to well-designed input samples, called adversarial examples. Adversarial examples are imperceptible to human but can easily fool deep neural networks in the testing/deploying stage. The vulnerability to adversarial examples becomes one of the major risks for applying deep neural networks in safety-critical environments. Therefore, attacks and defenses on adversarial examples draw great attention. In this paper, we review recent findings on adversarial examples for deep neural networks, summarize the methods for generating adversarial examples, and propose a taxonomy of these methods. Under the taxonomy, applications for adversarial examples are investigated. We further elaborate on countermeasures for adversarial examples and explore the challenges and the potential solutions.

Motivation & Objective

• Systematically analyze approaches for generating adversarial examples in deep learning.
• Propose a taxonomy of attack methods based on threat model, perturbation, and benchmarks.
• Survey applications of adversarial examples across domains and discuss countermeasures.
• Identify major challenges and propose potential solutions for robustness and transferability.

Proposed method

• Taxonomy of adversarial attack methods along three axes: threat model, perturbation, and benchmark.
• Review of representative attack techniques such as L-BFGS, FGSM, BIM, JSMA, DeepFool, CPPN EA, and C&W attacks.
• Discussion of perturbation types (individual vs universal) and norms (l0, l1, l2, l∞) with perceptual considerations.
• Analysis of threat models including white-box vs black-box, targeted vs non-targeted, and one-time vs iterative attacks.
• Evaluation considerations through standard datasets (MNIST, CIFAR-10, ImageNet) and common victim models.
• Outline of countermeasures and challenges in evaluating robustness and transferability.

Experimental results

Research questions

• RQ1 What are the dominant attack strategies for generating adversarial examples against deep neural networks?
• RQ2 How should adversarial attacks be categorized to aid comparison and defense design?
• RQ3 What are the most effective defenses, and under what threat models do they fail?
• RQ4 What are the key challenges in robustness evaluation and transferability of adversarial examples, and what directions may address them?

Key findings

• Adversarial examples can mislead deep networks with imperceptible perturbations across various tasks and models.
• A formal taxonomy helps compare attacks and informs defense design across threat models, perturbations, and benchmarks.
• Multiple attack methods (e.g., L-BFGS, FGSM, BIM, JSMA, DeepFool, C&W) demonstrate varying trade-offs between perturbation size and success rate.
• Transfers between white-box and black-box settings rely on the transferability property of adversarial examples, influencing security in real-world services.
• Defenses may be circumvented by adaptive attacks, highlighting the necessity for robust evaluation frameworks and ongoing research.
• The survey identifies key open challenges including transferability, the existence of adversarial examples, and robust evaluation metrics.