[Paper Review] Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Naveed Akhtar, Ajmal Mian|UWA Profiles and Research Repository (UWA)|Jan 2, 2018

Adversarial Robustness in Machine Learning156 references168 citations

TL;DR

A comprehensive survey of adversarial attacks on deep learning in computer vision, detailing attack methods, threat models, transferability, defenses, and real-world evaluations.

ABSTRACT

Deep learning is at the heart of the current rise of machine learning and artificial intelligence. In the field of Computer Vision, it has become the workhorse for applications ranging from self-driving cars to surveillance and security. Whereas deep neural networks have demonstrated phenomenal success (often beyond human capabilities) in solving complex problems, recent studies show that they are vulnerable to adversarial attacks in the form of subtle perturbations to inputs that lead a model to predict incorrect outputs. For images, such perturbations are often too small to be perceptible, yet they completely fool the deep learning models. Adversarial attacks pose a serious threat to the success of deep learning in practice. This fact has lead to a large influx of contributions in this direction. This article presents the first comprehensive survey on adversarial attacks on deep learning in Computer Vision. We review the works that design adversarial attacks, analyze the existence of such attacks and propose defenses against them. To emphasize that adversarial attacks are possible in practical conditions, we separately review the contributions that evaluate adversarial attacks in the real-world scenarios. Finally, we draw on the literature to provide a broader outlook of the research direction.

Motivation & Objective

• Summarize the landscape of adversarial attacks on deep learning for computer vision.
• Analyze the existence and properties of adversarial perturbations across tasks.
• Review defense strategies and their effectiveness against various attacks.
• Examine real-world evaluations and practical threat scenarios of adversarial attacks.
• Provide an outlook on future directions in the field.

Proposed method

• Systematic literature review of adversarial attack methods for vision tasks.
• Classification of attacks by threat models (black-box, white-box) and norms (L0, L2, L_inf).
• Technical exposition of representative attack algorithms (e.g., L-BFGS, FGSM, BIM, JSMA, C&W, DeepFool, universal perturbations).
• Discussion of attacks beyond classification (autoencoders, VAEs, GANs, RNNs) and real-world considerations.
• Synthesis of defenses and transferability considerations, with notes on open challenges.

Experimental results

Research questions

• RQ1 What are the main adversarial attack methodologies used to fool deep learning models in computer vision?
• RQ2 How do attack methods differ under white-box, black-box, and universal perturbation settings?
• RQ3 What defenses exist against adversarial attacks and how effective are they across scenarios?
• RQ4 How do adversarial attacks perform in real-world conditions beyond laboratory datasets?
• RQ5 What are the open challenges and future directions in adversarial robustness for vision systems?

Key findings

• Adversarial perturbations can fool vision models with imperceptible changes.
• Attack transferability enables black-box attacks by using perturbations crafted for other models.
• Universal perturbations generalize across images and models, achieving high fooling ratios.
• Numerous attack families exist (L-BFGS, FGSM, BIM, JSMA, C&W, DeepFool, UPSET, ANGRI, Houdini, ATNs) with varying norms and targets.
• Defenses such as defensive distillation often fail against stronger, newer attacks, highlighting ongoing robustness challenges.
• Research spans classification and beyond (autoencoders, VAEs, GANs, RNNs), with real-world evaluations showing practical threat potential.