[Paper Review] Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective

Gabriel Resende Machado, Eugênio Silva+1 more|arXiv (Cornell University)|Sep 8, 2020

Adversarial Robustness in Machine LearningComputer Science197 references18 citations

TL;DR

This survey provides a comprehensive, defender-focused review of adversarial machine learning in image classification, introducing novel taxonomies for attacks and defenses, evaluating countermeasures with practical guidelines, and identifying promising future research directions such as hybrid defense architectures. It emphasizes robustness against adaptive attacks and offers a self-contained overview of state-of-the-art defenses and their limitations.

ABSTRACT

Deep Learning algorithms have achieved the state-of-the-art performance for Image Classification and have been used even in security-critical applications, such as biometric recognition systems and self-driving cars. However, recent works have shown those algorithms, which can even surpass the human capabilities, are vulnerable to adversarial examples. In Computer Vision, adversarial examples are images containing subtle perturbations generated by malicious optimization algorithms in order to fool classifiers. As an attempt to mitigate these vulnerabilities, numerous countermeasures have been constantly proposed in literature. Nevertheless, devising an efficient defense mechanism has proven to be a difficult task, since many approaches have already shown to be ineffective to adaptive attackers. Thus, this self-containing paper aims to provide all readerships with a review of the latest research progress on Adversarial Machine Learning in Image Classification, however with a defender's perspective. Here, novel taxonomies for categorizing adversarial attacks and defenses are introduced and discussions about the existence of adversarial examples are provided. Further, in contrast to exisiting surveys, it is also given relevant guidance that should be taken into consideration by researchers when devising and evaluating defenses. Finally, based on the reviewed literature, it is discussed some promising paths for future research.

Motivation & Objective

• To provide a comprehensive, self-contained survey of adversarial machine learning in image classification from the defender’s perspective.
• To introduce novel taxonomies for categorizing adversarial attacks and defense mechanisms, updating existing classifications to include recent approaches.
• To evaluate and discuss the effectiveness of existing defense methods, highlighting their vulnerabilities to adaptive attacks.
• To offer practical guidelines for researchers designing and evaluating defenses, including policies for robustness evaluation.
• To identify and discuss promising future research directions, such as hybrid defense architectures combining multiple countermeasures.

Proposed method

• The paper conducts a systematic literature review of adversarial attacks and defenses in image classification, focusing on works published up to 2020.
• It proposes a new taxonomy for adversarial attacks based on threat model, optimization method, and perturbation type, enhancing classification of attack strategies.
• A novel defense taxonomy is introduced, categorizing defenses by mechanism (e.g., adversarial training, input preprocessing, model analysis) and resilience level.
• The authors analyze and discuss explanations for the existence and transferability of adversarial examples, including high-dimensional geometry and model linearity.
• The paper evaluates defense methods using criteria such as robustness against adaptive attacks, generalization, and computational cost.
• It proposes hybrid defense architectures that combine reactive, preprocessing, and proactive modules, selecting components randomly from a defense repository to enhance robustness.

Experimental results

Research questions

• RQ1 What are the key characteristics and classifications of adversarial attacks in image classification, and how have they evolved since the seminal work of Szegedy et al.?
• RQ2 How can defenses against adversarial attacks be systematically categorized and evaluated to ensure robustness against adaptive adversaries?
• RQ3 What are the fundamental reasons behind the existence and transferability of adversarial examples in deep neural networks?
• RQ4 What practical guidelines should researchers follow when designing and evaluating new defense mechanisms?
• RQ5 What are the most promising future research directions for building robust deep learning models in the face of adversarial threats?

Key findings

• The paper identifies that many proposed defenses, despite initial promise, are brittle and ineffective against adaptive attacks, highlighting the persistent challenge of robustness.
• It demonstrates that adversarial examples arise due to high-dimensional model sensitivity and linear behavior in decision boundaries, even in state-of-the-art models.
• The survey reveals that transferability of adversarial examples is a widespread phenomenon, with attacks trained on one model often succeeding on others, even with different architectures.
• The authors find that current evaluation practices often lack rigor, with many defenses failing under strong adaptive attack settings, underscoring the need for standardized benchmarks.
• The proposed hybrid defense architecture—combining reactive detection, preprocessing, and proactive classification modules—represents a novel, unexplored path with potential for improved robustness.
• The paper concludes that no fully effective defense exists yet, and future work must focus on adaptive, modular, and interpretable defense mechanisms to secure real-world applications.