Adversarial Attacks and Defences: A Survey (1810.00069v1)

Abstract: Deep learning has emerged as a strong and efficient framework that can be applied to a broad spectrum of complex learning problems which were difficult to solve using the traditional machine learning techniques in the past. In the last few years, deep learning has advanced radically in such a way that it can surpass human-level performance on a number of tasks. As a consequence, deep learning is being extensively used in most of the recent day-to-day applications. However, security of deep learning systems are vulnerable to crafted adversarial examples, which may be imperceptible to the human eye, but can lead the model to misclassify the output. In recent times, different types of adversaries based on their threat model leverage these vulnerabilities to compromise a deep learning system where adversaries have high incentives. Hence, it is extremely important to provide robustness to deep learning algorithms against these adversaries. However, there are only a few strong countermeasures which can be used in all types of attack scenarios to design a robust deep learning system. In this paper, we attempt to provide a detailed discussion on different types of adversarial attacks with various threat models and also elaborate the efficiency and challenges of recent countermeasures against them.

Analysis of "Adversarial Attacks and Defences: A Survey"

The paper "Adversarial Attacks and Defences: A Survey" offers a comprehensive examination of the vulnerabilities deep learning models face from adversarial attacks and explores various defense mechanisms. With the increasing prevalence of deep learning applications in critical sectors, understanding and mitigating these vulnerabilities is crucial for ensuring system security and integrity.

Overview of Adversarial Attacks

The authors categorize adversarial attacks primarily into three types, namely evasion, poisoning, and exploratory attacks, each posing distinct challenges and exploits in the deep learning model lifecycle:

• Evasion Attacks: Here, malicious inputs are crafted to be misclassified by a trained model during its testing phase. The paper explores various methodologies, such as the generation of adversarial examples, which are slight perturbations imperceptible to humans but significant enough to alter model outputs.
• Poisoning Attacks: These attacks manipulate the training data, embedding strategically designed examples to corrupt the learning process. The potential to degrade accuracy during model deployment poses a significant threat, especially in applications relying heavily on real-time learning.
• Exploratory Attacks: These do not tamper with the data but aim at understanding the model. Techniques like model inversion and extraction using APIs allow adversaries to reconstruct sensitive features or the model itself, posing severe privacy concerns.

Defense Mechanisms

The paper presents an array of current defense strategies, though acknowledging none offers a complete safeguard:

• Adversarial Training: This approach involves incorporating adversarial examples into the training dataset to improve model robustness. While effective for known attack types, it remains limited against adaptive adversaries exploiting model weaknesses differently.
• Gradient Hiding and Defensive Distillation: By obscuring gradient information, models may resist certain attacks; however, they are vulnerable to alternative or surrogate model-based assaults.
• Feature Squeezing and Blocking Transferability: These methods attempt to diminish adversarial perturbations through input representation simplification or nullifying transferability across models, yet practical efficacy often varies based on attack type and model architecture.
• Advanced Techniques: The use of Generative Adversarial Networks (GANs) and defensive mechanisms like MagNet and Basis Function Transformations illustrate innovative yet complex strategies for enhancing model defenses.

Implications and Future Directions

The paper underscores the persistent vulnerability of machine learning systems, highlighting the pressing need for more generalizable and adaptive defense strategies. In practice, the combination of multiple defense mechanisms and continuous monitoring appears imperative for robust AI deployment.

Advancements in understanding adversarial attack patterns and developing real-time adaptive defenses could provide comprehensive solutions. Moreover, enhancing the theoretical framework governing adversarial dynamics is crucial for anticipating and mitigating future threats effectively.

The survey by Chakraborty et al. is vital for researchers intent on fortifying machine learning models, urging the community toward collaborative and innovative approaches in safeguarding AI systems against increasingly sophisticated adversarial threats. Future research must explore creating seamless integration between defense strategies, ensuring minimal impact on model performance and broader applicability in diverse real-world scenarios.