Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

IEEE Access

Volumn 6, Issue , 2018, Pages 14410-14430

  Akhtar, Naveed ^a   Mian, Ajmal ^a  

^a UNIVERSITY OF WESTERN AUSTRALIA   (Australia)

Author keywords

adversarial learning; adversarial perturbation; black box attack; Deep learning; perturbation detection; white box attack

Indexed keywords

ARTIFICIAL HEART; ARTIFICIAL INTELLIGENCE; COMPUTER VISION; DEEP NEURAL NETWORKS; HUMAN COMPUTER INTERACTION; JOB ANALYSIS; LEARNING SYSTEMS; NEURAL NETWORKS; PERTURBATION TECHNIQUES; SURVEYS;

ADVERSARIAL LEARNING; ADVERSARIAL PERTURBATION; BLACK BOXES; COMPUTATIONAL MODEL; PERTURBATION DETECTION; PERTURBATION METHOD; PREDICTIVE MODELS; TASK ANALYSIS; WHITE BOX;

DEEP LEARNING;

EID: 85042198914     PISSN: None     EISSN: 21693536     Source Type: Journal    
DOI: 10.1109/ACCESS.2018.2807385     Document Type: Review

References (186)

1. Y. LeCun, Y. Bengio, and G. Hinton, "Deep learning," Nature, vol. 521, no. 7553, pp. 436-444, 2015.
2. M. Helmstaedter, K. L. Briggman, S. C. Turaga, V. Jain, H. S. Seung, and W. Denk, "Connectomic reconstruction of the inner plexiform layer in the mouse retina," Nature, vol. 500, no. 7461, pp. 168-174, 2013.
3. H. Y. Xiong et al., "The human splicing code reveals new insights into the genetic determinants of disease," Science, vol. 347, no. 6218, p. 1254806, 2015.
4. J. Ma, R. P. Sheridan, A. Liaw, G. E. Dahl, and V. Svetnik, "Deep neural nets as a method for quantitative structure-activity relationships," J. Chem. Inf. Model., vol. 55, no. 2, pp. 263-274, 2015.
5. T. Ciodaro, D. Deva, J. M. de Seixas, and D. Damazio, "Online particle detection with neural networks based on topological calorimetry information," J. Phys., Conf. Series. vol. 368, no. 1, p. 012030, 2012.
6. Kaggle. (2014). Higgs Boson Machine Learning Challenge. [Online]. Available: https://www.kaggle.com/c/higgs-boson
7. G. Hinton et al., "Deep neural networks for acoustic modeling in speech recognition: The shared views of four research groups," IEEE Signal Process. Mag., vol. 29, no. 6, pp. 82-97, Nov. 2012.
8. I. Sutskever, O. Vinyals, and Q. V. Le, "Sequence to sequence learning with neural networks," in Proc, Adv. Neural Inf. Process. Syst., 2014, pp. 3104-3112.
9. A. Krizhevsky, I. Sutskever, and G. E. Hinton, "ImageNet classification with deep convolutional neural networks," in Proc. Adv. Neural Inf. Process. Syst., 2012, pp. 1097-1105.
10. Y. LeCun et al., "Backpropagation applied to handwritten zip code recognition," Neural Comput., vol. 1, no. 4, pp. 541-551, 1989.
11. J. Deng, W. Dong, R. Socher, L. J. Li, K. Li, and L. Fei-Fei, "ImageNet: A large-scale hierarchical image database," in Proc. IEEE Conf. Comput. Vis. Patt. Recognit., Jun. 2009, pp. 248-255.
12. E. Ackerman. How Drive.ai is Mastering Autonomous Driving With Deep Learning. Accessed: Dec. 2017. [Online]. Available: https://spectrum.ieee.org/cars-that-think/transportation/self-driving/how-driveai-is-mastering-autonomous-driving-with-deep-learning
13. M. M. Najafabadi, F. Villanustre, T. M. Khoshgoftaar, N. Seliya, R.Wald, and E. Muharemagic, "Deep learning applications and challenges in big data analytics," J. Big Data, vol. 2, no. 1, pp. 1-21, 2015.
14. D. Silver et al., "Mastering the game of go without human knowledge," Nature, vol. 550, no. 7676, pp. 354-359, 2017.
15. K. He, X. Zhang, S. Ren, and J. Sun, "Deep residual learning for image recognition," in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., Jun. 2016, pp. 770-778.
16. S. M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, "Universal adversarial perturbations," in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. (CVPR), Jul. 2017, pp. 86-94.
17. K. Chatfield, K. Simonyan, A. Vedaldi, and A. Zisserman. (2014). "Return of the devil in the details: Delving deep into convolutional nets." [Online]. Available: https://arxiv.org/abs/1405.3531
18. C. Szegedy et al., "Going deeper with convolutions," in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., Jun. 2015, pp. 1-9.
19. J. Lu, H. Sibai, E. Fabry, and D. Forsyth. (2017). "Standard detectors aren't (currently) fooled by physical adversarial stop signs." [Online]. Available: https://arxiv.org/abs/1710.03337
20. R. Fletcher, Practical Methods of Optimization. Hoboken, NJ, USA; Wiley, 2013.
21. A. Esteva et al., "Dermatologist-level classification of skin cancer with deep neural networks," Nature, vol. 542, no. 7639, pp. 115-118, 2017.
22. C. Szegedy et al. (2014). "Intriguing properties of neural networks." [Online]. Available: https://arxiv.org/abs/1312.6199
23. I. J. Goodfellow, J. Shlens, and C. Szegedy. (2015). "Explaining and harnessing adversarial examples." [Online]. Available: https://arxiv.org/abs/1412.6572
24. S. Gu and L. Rigazio. (2015). "Towards deep neural network architectures robust to adversarial examples." [Online]. Available: https://arxiv. org/abs/1412.5068
25. P. Tabacof and E. Valle, "Exploring the space of adversarial images," in Proc. IEEE Int. Joint Conf. Neural Netw., Jul. 2016, pp. 426-433.
26. S. Sabour, Y. Cao, F. Faghri, and D. J. Fleet. (2015). "Adversarial manipulation of deep representations." [Online]. Available: https://arxiv.org/abs/1511.05122s
27. U. Shaham, Y. Yamada, and S. Negahban. (2016). "Understanding adversarial training: Increasing local stability of neural nets through robust optimization." [Online]. Available: https://arxiv.org/abs/1511.05432
28. C. Lyu, K. Huang, and H.-N. Liang, "A unified gradient regularization family for adversarial examples," in Proc. IEEE Int. Conf. Data Mining, Nov. 2015, pp. 301-309.
29. I. Evtimov et al. (2017). "Robust physical-world attacks on deep learning models." [Online]. Available: https://arxiv.org/abs/1707.08945
30. J. Lu, H. Sibai, E. Fabry, and D. Forsyth. (2017). "No need to worry about adversarial examples in object detection in autonomous vehicles." [Online]. Available: https://arxiv.org/abs/1707.03501
31. Y. Liu, W. Zhang, S. Li, and N. Yu. (2017). "Enhanced attacks on defensively distilled deep neural networks." [Online]. Available: https://arxiv.org/abs/1711.05934
32. H. Hosseini, Y. Chen, S. Kannan, B. Zhang, and R. Poovendran. (2017). "Blocking transferability of adversarial examples in black-box learning systems." [Online]. Available: https://arxiv.org/abs/1703.04318
33. T. Gu, B. Dolan-Gavitt, and S. Garg. (2017). "BadNets: Identifying vulnerabilities in the machine learning model supply chain." [Online]. Available: https://arxiv.org/abs/1708.06733
34. N. Papernot, P. McDaniel, A. Sinha, and M. Wellman. (2016). "Towards the science of security and privacy in machine learning." [Online]. Available: https://arxiv.org/abs/1611.03814
35. A. Kurakin, I. Goodfellow, and S. Bengio. (2016). "Adversarial examples in the physical world." [Online]. Available: https://arxiv.org/abs/1607.02533
36. N. Carlini and D.Wagner. (2016). "Towards evaluating the robustness of neural networks." [Online]. Available: https://arxiv.org/abs/1608.04644
37. N. Das et al. (2017). "Keeping the bad guys out: Protecting and vaccinating deep learning with JPEG compression." [Online]. Available: https://arxiv.org/abs/1705.02900
38. N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, "Distillation as a defense to adversarial perturbations against deep neural networks," in Proc. IEEE Symp. Secur. Privacy (SP), May 2016, pp. 582-597.
39. N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, "Practical black-box attacks against machine learning," in Proc. ACM Asia Conf. Comput. Commun. Secur., 2017, pp. 506-519.
40. X. Xu, X. Chen, C. Liu, A. Rohrbach, T. Darell, and D. Song. (2017). "Can you fool AI with adversarial examples on a visual Turing test?" [Online]. Available: https://arxiv.org/abs/1709.08693
41. P.-Y. Chen, H. Zhang, Y. Sharma, J. Yi, and C.-J. Hsieh, "ZOO: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models," in Proc. 10th ACMWorkshop Artif. Intell. Secur. (AISEC), 2017, pp. 15-26.
42. S. Baluja and I. Fischer. (2017). "Adversarial transformation networks: Learning to generate adversarial examples." [Online]. Available: https://arxiv.org/abs/1703.09387
43. W. Xu, D. Evans, and Y. Qi. (2017). "Feature squeezing: Detecting adversarial examples in deep neural networks." [Online]. Available: https://arxiv.org/abs/1704.01155
44. L. Nguyen, S. Wang, and A. Sinha. (2017). "A learning and masking approach to secure learning." [Online]. Available: https://arxiv. org/abs/1709.04447
45. D. Meng and H. Chen, "MagNet: A two-pronged defense against adversarial examples," in Proc. ACM Conf. Comput. Commun. Secur. (CCS), 2017, pp. 135-147.
46. V. Zantedeschi, M.-I. Nicolae, and A. Rawat. (2017). "Efficient defenses against adversarial attacks." [Online]. Available: https://arxiv.org/abs/1707.06728
47. J. Hayes and G. Danezis. (2017). "Machine learning as an adversarial service: Learning black-box adversarial examples." [Online]. Available: https://arxiv.org/abs/1708.05207
48. A. Graese, A. Rozsa, and T. E. Boult, "Assessing threat of adversarial examples on deep neural networks," in Proc. IEEE Int. Conf. Mach. Learn. Appl., Dec. 2016, pp. 69-74.
49. N. Carlini and D. Wagner. (2017). "Adversarial examples are not easily detected: Bypassing ten detection methods." [Online]. Available: https://arxiv.org/abs/1705.07263
50. B. Liang, H. Li, M. Su, X. Li, W. Shi, and X. Wang. (2017). "Detecting adversarial examples in deep networks with adaptive noise reduction'." [Online]. Available: https://arxiv.org/abs/1705.08378
51. A. Arnab, O. Miksik, and P. H. S. Torr. (2017). "On the robustness of semantic segmentation models to adversarial attacks." [Online]. Available: https://arxiv.org/abs/1711.09856
52. A. S. Ross and F. Doshi-Velez. (2017). "Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients." [Online]. Available: https://arxiv.org/abs/1711.09404
53. Y. Song, T. Kim, S. Nowozin, S. Ermon, and N. Kushman. (2017). "PixelDefend: Leveraging generative models to understand and defend against adversarial examples." [Online]. Available: https://arxiv.org/abs/1710.10766
54. N. Narodytska and S. P. Kasiviswanathan. (2016). "Simple blackbox adversarial perturbations for deep networks." [Online]. Available: https://arxiv.org/abs/1612.06299
55. A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. (2017). "Towards deep learning models resistant to adversarial attacks." [Online]. Available: https://arxiv.org/abs/1706.06083
56. Z. Sun, M. Ozay, and T. Okatani. (2017). "HyperNetworks with statistical filtering for defending adversarial examples." [Online]. Available: https://arxiv.org/abs/1711.01791
57. K. Grosse, P. Manoharan, N. Papernot, M. Backes, and P. McDaniel. (2017). "On the (statistical) detection of adversarial examples." [Online]. Available: https://arxiv.org/abs/1702.06280
58. S. Shen, G. Jin, K. Gao, and Y. Zhang. (2017). "APE-GAN: Adversarial perturbation elimination with GAN." [Online]. Available: https://arxiv. org/abs/1707.05474
59. N. Carlini, G. Katz, C. Barrett, and D. L. Dill. (2017). "Groundtruth adversarial examples." [Online]. Available: https://arxiv.org/abs/1709.10207
60. N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, "The limitations of deep learning in adversarial settings," in Proc. IEEE Eur. Symp. Secur. Privacy, Mar. 2016, pp. 372-387.
61. K. Grosse, N. Papernot, P. Manoharan, M. Backes, and P. McDaniel. (2016). "Adversarial perturbations against deep neural networks for malware classification." [Online]. Available: https://arxiv.org/abs/1606.04435
62. S. Huang, N. Papernot, I. Goodfellow, Y. Duan, and P. Abbeel. (2017). "Adversarial attacks on neural network policies." [Online]. Available: https://arxiv.org/abs/1702.02284
63. M. Melis, A. Demontis, B. Biggio, G. Brown, G. Fumera, and F. Roli. (2017). "Is deep learning safe for robot vision? Adversarial examples against the iCub humanoid." [Online]. Available: https://arxiv.org/abs/1708.06939
64. I. Rosenberg, A. Shabtai, L. Rokach, and Y. Elovici. (2017). "Generic black-box end-to-end attack against state of the art API call based malware classifiers." [Online]. Available: https://arxiv.org/abs/1707.05970
65. A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok. (2017). "Synthesizing robust adversarial examples." [Online]. Available: https://arxiv.org/abs/1707.07397
66. J. Lu, T. Issaranon, and D. Forsyth. (2017). "SafetyNet: Detecting and rejecting adversarial examples robustly." [Online]. Available: https://arxiv.org/abs/1704.00103
67. J. H. Metzen, M. C. Kumar, T. Brox, and V. Fischer, "Universal adversarial perturbations against semantic image segmentation," in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., Oct. 2017, pp. 2755-2764.
68. J. Su, D. V. Vargas, and S. Kouichi. (2017). "One pixel attack for fooling deep neural networks." [Online]. Available: https://arxiv.org/abs/1710.08864
69. A. Fawzi, S. Moosavi-Dezfooli, and P. Frossard, "Robustness of classifiers: From adversarial to random noise," in Proc. Adv. Neural Inf. Process. Syst., 2016, pp. 1632-1640.
70. S. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, P. Frossard, and S. Soatto. (2017). "Analysis of universal adversarial perturbations." [Online]. Available: https://arxiv.org/abs/1705.09554
71. A. Fawzi, O. Fawzi, and P. Frossard. (2015). "Analysis of classifiers' robustness to adversarial perturbations." [Online]. Available: https://arxiv.org/abs/1502.02590
72. S. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, "DeepFool: A simple and accurate method to fool deep neural networks," in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., Jun. 2016, pp. 2574-2582.
73. C. Kanbak, S.-M. Moosavi-Dezfooli, and P. Frossard. (2017). "Geometric robustness of deep networks: Analysis and improvement." [Online]. Available: https://arxiv.org/abs/1711.09115
74. T. Tanay and L. Griffin. (2016). "A boundary tilting persepective on the phenomenon of adversarial examples." [Online]. Available: https://arxiv.org/abs/1608.07690
75. I. Evtimov et al. (2017). "Robust physical-world attacks on deep learning models." [Online]. Available: https://arxiv.org/abs/1707.08945
76. W. He, J. Wei, X. Chen, N. Carlini, and D. Song. (2017). "Adversarial example defenses: ensembles of weak defenses are not strong." [Online]. Available: https://arxiv.org/abs/1706.04701
77. F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel. (2017). "Ensemble adversarial training: Attacks and defenses." [Online]. Available: https://arxiv.org/abs/1705.07204
78. J. H. Metzen, T. Genewein, V. Fischer, and B. Bischoff. (2017). "On detecting adversarial perturbations." [Online]. Available: https://arxiv.org/abs/1702.04267
79. C. Xie, J. Wang, Z. Zhang, Z. Ren, and A. Yuille. (2017). "Mitigating adversarial effects through randomization." [Online]. Available: https://arxiv.org/abs/1711.01991
80. A. Kurakin, I. Goodfellow, and S. Bengio. (2017). "Adversarial machine learning at scale." [Online]. Available: https://arxiv.org/abs/1611.01236
81. N. Akhtar, J. Liu, and A. Mian. (2017). "Defense against universal adversarial perturbations." [Online]. Available: https://arxiv.org/abs/1711.05929
82. C. Guo, M. Rana, M. Cisse, and L. van der Maaten. (2017). "Countering adversarial images using input transformations." [Online]. Available: https://arxiv.org/abs/1711.00117
83. A. Galloway, G.W. Taylor, and M. Moussa. (2017). "Attacking binarized neural networks." [Online]. Available: https://arxiv.org/abs/1711.00449
84. N. Papernot and P. McDaniel. (2017). "Extending defensive distillation." [Online]. Available: https://arxiv.org/abs/1705.05264
85. T. Na, J. H. Ko, and S. Mukhopadhyay. (2017). "Cascade adversarial machine learning regularized with a unified embedding." [Online]. Available: https://arxiv.org/abs/1708.02582
86. R. Feinman, R. R. Curtin, S. Shintre, and A. B. Gardner. (2017). "Detecting adversarial samples from artifacts." [Online]. Available: https://arxiv.org/abs/1703.00410
87. X. Zeng et al. (2017). "Adversarial attacks beyond the image space." [Online]. Available: https://arxiv.org/abs/1711.07183
88. Y. Liu, X. Chen, C. Liu, and D. Song. (2017). "Delving into transferable adversarial examples and black-box attacks." [Online]. Available: https://arxiv.org/abs/1611.02770
89. T. Strauss, M. Hanselmann, A. Junginger, and H. Ulmer. (2017). "Ensemble methods as a defense to adversarial perturbations against deep neural networks." [Online]. Available: https://arxiv.org/abs/1709.03423
90. S. Sankaranarayanan, A. Jain, R. Chellappa, and S. N. Lim. (2017). "Regularizing deep networks using efficient layerwise adversarial training." [Online]. Available: https://arxiv.org/abs/1705.07819
91. E. D. Cubuk, B. Zoph, S. S. Schoenholz, and Q. V. Le. (2017). "Intriguing properties of adversarial examples." [Online]. Available: https://arxiv.org/abs/1711.02846
92. T. Gebhart and P. Schrater. (2017). "Adversary detection in neural networks via persistent homology." [Online]. Available: https://arxiv.org/abs/1711.10056
93. J. Bradshaw, A. G. de G. Matthews, and Z. Ghahramani. (2017). "Adversarial examples, uncertainty, and transfer testing robustness in Gaussian process hybrid deep networks." [Online]. Available: https://arxiv.org/abs/1707.02476
94. A. Rozsa, E. M. Rudd, and T. E. Boult. (2016). "Adversarial diversity and hard positive generation." [Online]. Available: https://arxiv.org/abs/1605.01775
95. O. Bastani, Y. Ioannou, L. Lampropoulos, D. Vytiniotis, A. Nori, and A. Criminisi. (2017). "Measuring neural net robustness with constraints." [Online]. Available: https://arxiv.org/abs/1605.07262
96. J. Z. Kolter and E. Wong. (2017). "Provable defenses against adversarial examples via the convex outer adversarial polytope." [Online]. Available: https://arxiv.org/abs/1711.00851
97. A. Rozsa, M. Günther, and T. E. Boult, "Are accuracy and robustness correlated," in Proc. IEEE Int. Conf. Mach. Learn. Appl., Dec. 2016, pp. 227-232.
98. H. Hosseini, B. Xiao, M. Jaiswal, and R. Poovendran. (2017). "On the limitation of convolutional neural networks in recognizing negative images." [Online]. Available: https://arxiv.org/abs/1703.06857
99. M. Cisse, P. Bojanowski, E. Grave, Y. Dauphin, and N. Usunier. (2017). "Parseval networks: Improving robustness to adversarial examples." [Online]. Available: https://arxiv.org/abs/1704.08847
100. N. Cheney, M. Schrimpf, and G. Kreiman. (2017). "On the robustness of convolutional neural networks to internal architecture and weight perturbations." [Online]. Available: https://arxiv.org/abs/1703.08245
101. H. Lee, S. Han, and J. Lee. (2017). "Generative adversarial trainer: Defense to adversarial perturbations with GAN." [Online]. Available: https://arxiv.org/abs/1705.03387
102. A. Rozsa, M. Gunther, and T. E. Boult. (2017). "Towards robust deep neural networks with BANG." [Online]. Available: https://arxiv.org/abs/1612.00138
103. T. Miyato, S.-I. Maeda, M. Koyama, and S. Ishii. (2017). "Virtual adversarial training: A regularization method for supervised and semisupervised learning." [Online]. Available: https://arxiv.org/abs/1704. 03976
104. D. Arpit et al. (2017). "A closer look at memorization in deep networks." [Online]. Available: https://arxiv.org/abs/1706.05394
105. X. Li and F. Li, "Adversarial examples detection in deep networks with convolutional filter statistics," in Proc. Int. Conf. Comput. Vis., 2017, pp. 1-9.
106. T. Lee, M. Choi, and S. Yoon. (2016). "Manifold regularized deep neural networks using adversarial examples." [Online]. Available: https://arxiv.org/abs/1511.06381
107. K. Grosse, N. Papernot, P. Manoharan, M. Backes, and P. McDaniel, "Adversarial examples for malware detection," in Proc. Eur. Symp. Res. Comput. Secur., 2017, pp. 62-79.
108. N. Papernot and P. McDaniel. (2016). "On the effectiveness of defensive distillation." [Online]. Available: https://arxiv.org/abs/1607.05113
109. N. Papernot, P. McDaniel, and I. Goodfellow. (2016). "Transferability in machine learning: From phenomena to black-box attacks using adversarial samples." [Online]. Available: https://arxiv.org/abs/1605.07277
110. N. Papernot, P. McDaniel, A. Swami, and R. Harang, "Crafting adversarial input sequences for recurrent neural networks," in Proc. IEEE Military Commun. Conf., 2016, pp. 49-54.
111. N. Papernot et al. (2016). "Cleverhans v2.0.0: An adversarial machine learning library." [Online]. Available: https://arxiv.org/abs/1610.00768
112. I. Goodfellow et al. (2016). "cleverhans v2.0.0: An adversarial machine learning library." [Online]. Available: https://arxiv.org/abs/1610.00768
113. T. Miyato, A. M. Dai, and I. Goodfellow. (2016). "Adversarial training methods for semi-supervised text classification." [Online]. Available: https://arxiv.org/abs/1605.07725
114. A. Nguyen, J. Yosinski, and J. Clune, "Deep neural networks are easily fooled: High confidence predictions for unrecognizable images," in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., 2015, pp. 427-436.
115. C. Xie, J. Wang, Z. Zhang, Y. Zhou, L. Xie, and A. Yuille. (2017). "Adversarial examples for semantic segmentation and object detection." [Online]. Available: https://arxiv.org/abs/1703.08603
116. S. Zheng, Y. Song, T. Leung, and I. Goodfellow, "Improving the robustness of deep neural networks via stability training," in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., Jun. 2016, pp. 4480-4488.
117. A. Fawzi, O. Fawzi, and P. Frossard, "Fundamental limits on adversarial robustness," in Proc. ICML, Workshop Deep Learn., 2015, pp. 1-7.
118. Y. Luo, X. Boix, G. Roig, T. Poggio, and Q. Zhao. (2015). "Foveationbased mechanisms alleviate adversarial examples." [Online]. Available: https://arxiv.org/abs/1511.06292
119. J. Jin, A. Dundar, and E. Culurciello. (2015). "Robust convolutional neural networks under adversarial noise." [Online]. Available: https://arxiv.org/abs/1511.06306
120. J. Kos, I. Fischer, and D. Song. (2017). "Adversarial examples for generative models." [Online]. Available: https://arxiv.org/abs/1702.06832
121. Q. Wang et al. (2016). "Adversary resistant deep neural networks with an application to malware detection." [Online]. Available: https://arxiv.org/abs/1610.01239
122. G. K. Dziugaite, Z. Ghahramani, and D. M. Roy. (2016). "A study of the effect of JPG compression on adversarial images." [Online]. Available: https://arxiv.org/abs/1608.00853
123. A. Nayebi and S. Ganguli. (2017). "Biologically inspired protection of deep networks from adversarial attacks." [Online]. Available: https://arxiv.org/abs/1703.09202
124. W. Hu and Y. Tan. (2017). "Generating adversarial malware examples for black-box attacks based on GAN." [Online]. Available: https://arxiv.org/abs/1702.05983
125. G. Katz, C. Barrett, D. L. Dill, K. Julian, and M. J. Kochenderfer. (2017). "Towards proving the adversarial robustness of deep neural networks." [Online]. Available: https://arxiv.org/abs/1709.02802
126. D. Krotov and J. J. Hopfield. (2017). "Dense associative memory is robust to adversarial inputs." [Online]. Available: https://arxiv.org/abs/1701.00939
127. P. Tabacof, J. Tavares, and E. Valle. (2016). "Adversarial images for variational autoencoders." [Online]. Available: https://arxiv.org/abs/1612.00155
128. Q. Wang et al. (2016). "Using non-invertible data transformations to build adversarial-robust neural networks." [Online]. Available: https://arxiv.org/abs/1610.01934
129. A. Rozsa, M. Günther, E. M. Rudd, and T. E. Boult. (2018). "Facial attributes: Accuracy and adversarial robustness." [Online]. Available: https://arxiv.org/abs/1801.02480
130. M. Cisse, Y. Adi, N. Neverova, and J. Keshet. (2017). "Houdini: Fooling deep structured prediction models." [Online]. Available: https://arxiv.org/abs/1707.05373
131. F. Tramèr, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel. (2017). "The space of transferable adversarial examples." [Online]. Available: https://arxiv.org/abs/1704.03453
132. S. J. Oh, M. Fritz, and B. Schiele. (2017). "Adversarial image perturbation for privacy protection-A game theory perspective." [Online]. Available: https://arxiv.org/abs/1703.09471
133. Y.-C. Lin, Z.-W. Hong, Y.-H. Liao, M.-L. Shih, M.-Y. Liu, and M. Sun. (2017). "Tactics of adversarial attack on deep reinforcement learning agents." [Online]. Available: https://arxiv.org/abs/1703.06748
134. K. R. Mopuri, U. Garg, and R. V. Babu. (2017). "Fast feature fool: A data independent approach to universal adversarial perturbations." [Online]. Available: https://arxiv.org/abs/1707.05572
135. N. Kardan and K. O. Stanley, "Mitigating fooling with competitive overcomplete output layer neural networks," in Proc. Int. Joint Conf. Neural Netw., May 2017, pp. 518-525.
136. Y. Dong, H. Su, J. Zhu, and F. Bao. (2017). "Towards interpretable deep neural networks by leveraging adversarial examples." [Online]. Available: https://arxiv.org/abs/1708.05493
137. Q. Wang et al. (2016). "Learning adversary-resistant deep neural networks." [Online]. Available: https://arxiv.org/abs/1612.01401
138. J. Gao, B.Wang, Z. Lin,W. Xu, and Y. Qi. (2017). "DeepCloak: Masking deep neural network models for robustness against adversarial samples." [Online]. Available: https://arxiv.org/abs/1702.06763
139. W. Xu, D. Evans, and Y. Qi. (2017). "Feature squeezing mitigates and detects carlini/wagner adversarial examples." [Online]. Available: https://arxiv.org/abs/1705.10686
140. W. Bai, C. Quan, and Z. Luo, "Alleviating adversarial attacks via convolutional autoencoder," in Proc. Int. Conf. Softw. Eng., Artif. Intell., Netw. Parallel/Distrib. Comput. (SNPD), Jun. 2017, pp. 53-58.
141. A. P. Norton and Y. Qi, "Adversarial-Playground: A visualization suite showing how adversarial examples fool deep learning," in Proc. IEEE Symp. Vis. Cyber Secur., Oct. 2017, pp. 1-4.
142. Y. Dong, F. Liao, T. Pang, X. Hu, and J. Zhu. (2017). "Discovering adversarial examples with momentum." [Online]. Available: https://arxiv.org/abs/1710.06081
143. S. Shen, R. Furuta, T. Yamasaki, and K. Aizawa, "Fooling neural networks in face attractiveness evaluation: Adversarial examples with high attractiveness score but lowsubjective score," in Proc. IEEE 3rd Int. Conf. Multimedia Big Data, Apr. 2017, pp. 66-69.
144. C. Szegedy, V. Vincent, S. Ioffe, J. Shlens, and Z.Wojna, "Rethinking the inception architecture for computer vision," in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., Jun. 2016, pp. 2818-2826.
145. S. Sarkar, A. Bansal, U. Mahbub, and R. Chellappa. (2017). "UPSET and ANGRI: Breaking high performance image classifiers." [Online]. Available: https://arxiv.org/abs/1707.01159
146. S. Das and P. N. Suganthan, "Differential evolution: A survey of the state-of-the-art," IEEE Trans. Evol. Comput., vol. 15, no. 1, pp. 4-31, Feb. 2011.
147. J. Redmon and A. Farhadi. (2016). "YOLO9000: Better, faster, stronger." [Online]. Available: https://arxiv.org/abs/1612.08242
148. S. Ren, K. He, R. Girshick, and J. Sun, "Faster R-CNN: Towards real-time object detection with region proposal networks," in Proc. Adv. Neural Inf. Process. Syst., 2015, pp. 91-99.
149. D. Amodei et al. (2015). "Deep speech 2: End-to-end speech recognition in English and Mandarin." [Online]. Available: https://arxiv.org/abs/1512.02595
150. A. Krizhevsky, "Learning multiple layers of features from tiny images," M.S. thesis, Dept. Comput. Sci., Univ. Toronto, Toronto, ON, Canada, 2009.
151. D. P. Kingma and M. Welling. (2013). "Auto-encoding variational Bayes." [Online]. Available: https://arxiv.org/abs/1312.6114
152. Y. Bengio, "Learning deep architectures for AI," Found. Trends Mach. Learn., vol. 2, no. 1, pp. 1-127, 2009.
153. D. E. Rumelhart, G. E. Hinton, and R. J. Williams, "Learning representations by back-propagating errors," Nature, vol. 323, pp. 533-536, Oct. 1986.
154. S. Hochreiter and J. Schmidhuber, "Long short-term memory," Neural Comput., vol. 9, no. 8, pp. 1735-1780, 1997.
155. V. Mnih et al., "Human-level control through deep reinforcement learning," Nature, vol. 518, pp. 529-533, 2015.
156. M. Volodymyr et al., "Asynchronous methods for deep reinforcement learning," in Proc. Int. Conf. Mach. Learn., 2016, pp. 1-10.
157. J. Long, E. Shelhamer, and T. Darrell, "Fully convolutional networks for semantic segmentation," in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., Jun. 2015, pp. 3431-3440.
158. A. Rozsa, M. Günther, E. M. Rudd, and T. E. Boult, "Are facial attributes adversarially robust?" in Proc. Int. Conf. Pattern Recognit., Dec. 2016, pp. 3121-3127.
159. Z. Liu, P. Luo, X. Wang, and X. Tang, "Deep learning face attributes in the wild," in Proc. Int. Conf. Comput. Vis., 2015, pp. 3730-3738.
160. V. Mirjalili and A. Ross, "Soft biometric privacy: Retaining biometric utility of face images while perturbing gender," in Proc. Int. Joint Conf. Biometrics, 2017, pp. 1-10.
161. K. Simonyan and A. Zisserman. (2015). "Very deep convolutional networks for large-scale image recognition." [Online]. Available: https://arxiv.org/abs/1409.1556
162. D. Krotov and J. J. Hopfield, "Dense associative memory for pattern recognition," in Proc. Adv. Neural Inf. Process. Syst., 2016, pp. 1172-1180.
163. R. H. R. Hahnloser, R. Sarpeshkar, M. A. Mahowald, R. J. Douglas, and H. S. Seung, "Digital selection and analogue amplification coexist in a cortex-inspired silicon circuit," Nature, vol. 405, no. 6789, pp. 947-951, Jun. 2000.
164. G. Hinton, O. Vinyals, and J. Dean. (2014). "Distilling the knowledge in a neural network." [Online]. Available: https://arxiv.org/abs/1503.02531
165. H. Drucker and Y. Le Cun, "Improving generalization performance using double backpropagation," IEEE Trans. Neural Netw., vol. 3, no. 6, pp. 991-997, Nov. 1992.
166. G. Huang, Z. Liu, L. van der Maaten, and K. Q. Weinberger. (2016). "Densely connected convolutional networks." [Online]. Available: https://arxiv.org/abs/1608.06993
167. A. N. Bhagoji, D. Cullina, C. Sitawarin, and P. Mittal. (2017). "Enhancing robustness of machine learning systems via data transformations." [Online]. Available: https://arxiv.org/abs/1704.02654
168. Y. Dong et al. (2017). "Boosting adversarial attacks with momentum." [Online]. Available: https://arxiv.org/abs/1710.06081
169. I. Goodfellow et al., "Generative adversarial nets," in Proc. Adv. Neural Inf. Process. Syst., 2014, pp. 2672-2680.
170. J. Kovačević and C. Amina, "An introduction to frames," Found. Trends Signal Process., vol. 2, no. 1, pp. 1-94, 2008.
171. S. Rifai, P. Vincent, X. Muller, X. Glorot, and Y. Bengio, "Contractive auto-encoders: Explicit invariance during feature extraction," in Proc. Int. Conf. Mach. Learn., 2011, pp. 833-840.
172. S. S. Liew, M. Khalil-Hani, and R. Bakhteri, "Bounded activation functions for enhanced training stability of deep neural networks on visual pattern recognition problems," Neurocomputing, vol. 216, pp. 718-734, Dec. 2016.
173. M. Abbasi and C. Gagné. (2017). "Robustness to adversarial examples through an ensemble of specialists." [Online]. Available: https://arxiv. org/abs/1702.06856
174. A. Mogelmose, M. M. Trivedi, and T. B. Moeslund, "Vision-based traffic sign detection and analysis for intelligent driver assistance systems: Perspectives and survey," IEEE Trans. Intell. Transp. Syst., vol. 13, no. 4, pp. 1484-1497, Dec. 2012.
175. A. Vedaldi and K. Lenc, "MatConvNet-Convolutional neural networks for MATLAB," in Proc. ACM Int. Conf. Multimedia, 2015, pp. 689-692.
176. Y. Jia et al. (2014). "Caffe: Convolutional architecture for fast feature embedding." [Online]. Available: https://arxiv.org/abs/1408.5093
177. M. Abadi et al. (2015). "TensorFlow: Large-scale machine learning on heterogeneous distributed systems." [Online]. Available: https://arxiv. org/abs/1603.04467
178. A. Giusti et al., "A machine learning approach to visual perception of forest trails for mobile robots," IEEE Robot. Autom. Lett., vol. 1, no. 2, pp. 661-667, Jul. 2016.
179. Objects Detection Machine Learning TensorFlow Demo. Accessed: Dec. 2017. [Online]. Available: https://play.google.com/store/apps/details?id=org.tensorflow.detect&hl=en
180. Class Central, Deep Learning for Self-Driving Cars. Accessed: Dec. 2017. [Online]. Available: https://www.class-central.com/mooc/8132/6-s094-deep-learning-for-self-driving-cars
181. C. Middlehurst. (2015). China Unveils World's First Facial Recognition ATM. [Online]. Available: http://www.telegraph.co.uk/news/worldnews/asia/china/11643314/China-unveils-worlds-first-facialrecognitionATM.html
182. About Face ID Advanced Technology. Accessed: Dec. 2017. [Online]. Available: https://support.apple.com/en-au/HT208108
183. M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, "Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition," in Proc. ACM SIGSAC Conf. Comput. Commun. Secur., 2016, pp. 1528-1540.
184. R. Shin and D. Song, "JPEG-resistant adversarial images," in Proc. Mach. Learn. Comput. Secur. Workshop, 2017, pp. 1-6.
185. W. Brendel and M. Bethge. (Apr. 2017). "Comment on 'Biologically inspired protection of deep networks from adversarial attacks."' [Online]. Available: https://arxiv.org/abs/1704.01547
186. N. Carlini and D.Wagner. (Nov. 2017). "MagNet and 'efficient defenses against adversarial attacks' are not robust to adversarial examples." [Online]. Available: https://arxiv.org/abs/1711.08478