[Paper Review] Adversarial Examples in Modern Machine Learning: A Review

Rey Reza Wiyatno, Anqi Xu+2 more|arXiv (Cornell University)|Nov 13, 2019

Adversarial Robustness in Machine Learning235 references50 citations

TL;DR

A comprehensive survey of adversarial examples in computer vision, detailing attack methods, defenses, transferability, and real-world considerations. It explains why models are vulnerable and how attacks and defenses evolve.

ABSTRACT

Recent research has found that many families of machine learning models are vulnerable to adversarial examples: inputs that are specifically designed to cause the target model to produce erroneous outputs. In this survey, we focus on machine learning models in the visual domain, where methods for generating and detecting such examples have been most extensively studied. We explore a variety of adversarial attack methods that apply to image-space content, real world adversarial attacks, adversarial defenses, and the transferability property of adversarial examples. We also discuss strengths and weaknesses of various methods of adversarial attack and defense. Our aim is to provide an extensive coverage of the field, furnishing the reader with an intuitive understanding of the mechanics of adversarial attack and defense mechanisms and enlarging the community of researchers studying this fundamental set of problems.

Motivation & Objective

• Summarize the landscape of adversarial examples in supervised learning for visual tasks.
• Provide a taxonomy of attack and defense methods with intuitive mechanisms.
• Highlight real-world and transferability aspects of adversarial threats.

Proposed method

• Survey and taxonomy of adversarial attack methods (whitebox and blackbox) across targeted and non-targeted settings.
• Discussion of defenses and their vulnerabilities, including gradient masking and robustness challenges.
• Exposition of real-world adversarial scenarios (physical and non-physical) and their implications.
• Discussion of the transferability property and factors influencing it.

Experimental results

Research questions

• RQ1 What are the main categories and mechanisms of adversarial attacks in computer vision models?
• RQ2 What defenses have been proposed against adversarial attacks, and where do they fail (e.g., gradient masking)?
• RQ3 How does transferability manifest across models and datasets, and what affects it?
• RQ4 What are the practical real-world considerations for adversarial threats (physical-world attacks)?

Key findings

• Adversarial examples reveal a robustness gap in modern visual models and can be constructed to be perceptually similar yet cause misclassification.
• A wide array of attack methods exist, including gradient-based, optimization-based, and blackbox approaches, with varying strengths and transferability.
• Defenses often rely on gradient obfuscation or masking, which can be circumvented by newer attack strategies; robust solutions remain challenging.
• Transferability of adversarial examples across models trained on the same data is observed, indicating shared vulnerabilities.
• Real-world adversarial scenarios (e.g., printed or physical patches) pose practical threats beyond digital inputs.