The DOI matches its Crossref record; 43 of the 45 references it cites were found in a registry or an index.
Towards Evaluating the Robustness of Neural Networks
Open accessAbstract
Neural networks provide state-of-the-art results for most machine learning tasks. Unfortunately, neural networks are vulnerable to adversarial examples: given an input x and any target classification t, it is possible to find a new input x' that is similar to x but classified as t. This makes it difficult to apply neural networks in security-critical areas. Defensive distillation is a recently proposed approach that can take an arbitrary neural network, and increase its robustness, reducing the success rate of current attacks' ability to find adversarial examples from 95% to 0.5%. In this paper, we demonstrate that defensive distillation does not significantly increase the robustness of neural networks by introducing three new attack algorithms that are successful on both distilled and undistilled neural networks with 100% probability. Our attacks are tailored to three distance metrics used previously in the literature, and when compared to previous adversarial example generation algorithms, our attacks are often much more effective (and never worse). Furthermore, we propose using high-confidence adversarial examples in a simple transferability test we show can also be used to break defensive distillation. We hope our attacks will be used as a benchmark in future defense attempts to create neural networks that resist adversarial examples.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“For example, Carlini and Farid (2020) add imperceptible adversarial perturbations to the fake/real faces and show that even the state-of-the-art DeepFake detectors are vulnerable to both white-box and black-box attacks (Carlini and Wagner 2017; Brown et al. 2017) with significant accuracy reduction on the public datasets (Wang et al. 2020e; Frank et al. 2020).”
From Countering Malicious DeepFakes: Survey, Battleground, and Horizon (2022) · cites this paper as Carlini and Wagner 2017
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Existing detection methods face challenges with generalization across datasets and vulnerability to adversarial attacks.”
From Comprehensive Evaluation of Deepfake Detection Models: Accuracy, Generalization, and Resilience to Adversarial Attacks (2025) · cites this paper as [4]
Experimental — accuracy not yet measuredThe cited source says what the claim attributes to it.
In the citing paper
“Adversarial attacks have been widely studied against ML models [47,50] under both white-box [9, 21, 31, 55] and black-box assumptions [33, 43].”
From Adversarial Detection Avoidance Attacks: Evaluating the robustness of perceptual hashing-based client-side scanning (2021) · cites this paper as [9]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155
Adam: A Method for Stochastic Optimization
Kingma, D. P., & Ba, J. (2014) · arXiv · doi:10.48550/arxiv.1412.6980 · Cited by 98,946
ImageNet: A large-scale hierarchical image database
Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., & Fei-Fei, L. (2009) · 2009 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2009.5206848 · Cited by 65,333
Gradient-based learning applied to document recognition
Lecun, Y., Bottou, L., Bengio, Y., & Haffner, P. (1998) · Proceedings of the IEEE · doi:10.1109/5.726791 · Cited by 58,805
ImageNet Large Scale Visual Recognition Challenge
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al. (2015) · International Journal of Computer Vision · doi:10.1007/s11263-015-0816-y · Cited by 39,380
Human-level control through deep reinforcement learning
Mnih, V., Kavukcuoglu, K., Silver, D., Rusu, A. A., Veness, J., Bellemare, M. G., Graves, A., Riedmiller, M., Fidjeland, A. K., Ostrovski, G., et al. (2015) · Nature · doi:10.1038/nature14236 · Cited by 30,357
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,889
Mastering the game of Go with deep neural networks and tree search
Silver, D., Huang, A., Maddison, C. J., Guez, A., Sifre, L., van den Driessche, G., Schrittwieser, J., Antonoglou, I., Panneershelvam, V., Lanctot, M., et al. (2016) · Nature · doi:10.1038/nature16961 · Cited by 15,612
Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate ShiftPreprint
Ioffe, S. (2024) · arXiv (Cornell University) · doi:10.57702/o9raffed · Cited by 15,273
Flagged first, then by citations
2 of the 45 references couldn’t be matched to a known paper.
Research works printed but not linked: 9
- papernot, 0, cleverhans v1 0 0 an adversarial machine learning library
- goodfellow, 2014, Explaining and Harnessing Adversarial Examples
- 10.1109/MSP.2012.2205597 · DOI · Paper page
- lecun, 1998, The MNIST Database of Handwritten Digits
- bringing, 2016, big neural networks to self-driving cars smartphones and drones
- maas, 2013, Rectifier nonlinearities improve neural network acoustic models, Proc ICML, 30
- szegedy, 2015, Rethinking the inception architecture for computer vision
- warde-farley, 2016, Advanced Structured Prediction
- huang, 2016, Safety verification of deep neural networks
Cited by
Sorted by citations
Items 101–200 of 1,019
Making machine learning robust against adversarial inputs
Goodfellow, I., McDaniel, P., & Papernot, N. (2018) · Communications of the ACM · doi:10.1145/3134599 · Cited by 358
Generative Adversarial Perturbations
Poursaeed, O., Katsman, I., Gao, B., & Belongie, S. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00465 · Cited by 387
Optimization problems for machine learning: A survey
Gambella, C., Ghaddar, B., & Naoum‐Sawaya, J. (2020) · European Journal of Operational Research · doi:10.1016/j.ejor.2020.08.045 · Cited by 409
Latent Backdoor Attacks on Deep Neural Networks
Yao, Y., Li, H., Zheng, H.-T., & Zhao, B. Y. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354209 · Cited by 382
A Survey on Security Threats and Defensive Techniques of Machine Learning: A Data Driven View
Liu, Q., Li, P., Zhao, W., Cai, W., Yu, S., & Leung, V. C. M. (2018) · IEEE Access · doi:10.1109/access.2018.2805680 · Cited by 421
Shaham, U., Yamada, Y., & Negahban, S. N. (2018) · Neurocomputing · doi:10.1016/j.neucom.2018.04.027 · Cited by 432
Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep LearningPreprint
Papernot, N., & McDaniel, P. D. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1803.04765 · Cited by 592
A Comprehensive Survey on Deep Graph Representation Learning
Ju, W., Fang, Z., Gu, Y., Liu, Z., Long, Q., Qiao, Z., Qin, Y., Shen, J., Sun, F., Xiao, Z., et al. (2024) · Neural Networks · doi:10.1016/j.neunet.2024.106207 · Cited by 395
ComDefend: An Efficient Image Compression Model to Defend Adversarial Examples
Jia, X., Wei, X., Cao, X., & Foroosh, H. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00624 · Cited by 349
Su, D., Zhang, H., Chen, H., Yi, J., Chen, P., & Gao, Y. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01258-8_39 · Cited by 353
Generating 3D Adversarial Point Clouds
Xiang, C., Qi, C. R., & Li, B. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00935 · Cited by 345
Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection
Chen, X., Li, C., Wang, D., Wen, S., Zhang, J., Nepal, ., Xiang, Y., & Ren, K. (2019) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2932228 · Cited by 340
Efficient Defenses Against Adversarial Attacks
Zantedeschi, V., Nicolae, M.-I., & Rawat, A. (2017) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3128572.3140449 · Cited by 354
Deflecting Adversarial Attacks with Pixel Deflection
Prakash, A., Moran, N., Garber, S., DiLillo, A., & Storer, J. A. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00894 · Cited by 342
On the Robustness of Semantic Segmentation Models to Adversarial Attacks
Arnab, A., Mikšík, O., & Torr, P. H. S. (2018) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/cvpr.2018.00099 · Cited by 376
Jia, J., Salem, A., Michael Backes, A., Zhang, Y., & Gong, N. Z. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363201 · Cited by 396
Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples
Liu, Z., Liu, Q., Liu, T., Xu, N., Lin, X., Wang, Y., & Wen, W. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00095 · Cited by 344
A Self-supervised Approach for Adversarial Robustness
Naseer, M., Khan, S. H., Hayat, M., Khan, F. S., & Porikli, F. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00034 · Cited by 330
Intriguing Properties of Adversarial ML Attacks in the Problem Space
Pierazzi, F., Pendlebury, F., Cortellazzi, J., & Cavallaro, L. (2020) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40000.2020.00073 · Cited by 326
Adversarial Attacks and Defences Competition
Kurakin, A., Goodfellow, I., Samy Bengio, A., Dong, Y., Liao, F., Liang, M., Pang, T., Zhu, J., Hu, X., Xie, C., et al. (2018) · The Springer series on challenges in machine learning · doi:10.1007/978-3-319-94042-7_11 · Cited by 342
Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization
Li, S., Xue, M., Zhao, B. Z. H., Zhu, H., & Zhang, X. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3021407 · Cited by 346
Bai, X., Wang, X., Liu, X., Liu, Q., Song, J., Sebe, N., & Kim, B. (2021) · Pattern Recognition · doi:10.1016/j.patcog.2021.108102 · Cited by 313
A Systematic Review on Data Scarcity Problem in Deep Learning: Solution and Applications
Bansal, M. A., Sharma, R., & Kathuria, M. (2022) · ACM Computing Surveys · doi:10.1145/3502287 · Cited by 335
Advances in Adversarial Attacks and Defenses in Computer Vision: A Survey
Akhtar, N., Mian, A. S., Kardan, N., & Shah, M. (2021) · IEEE Access · doi:10.1109/access.2021.3127960 · Cited by 355
Adversarial Weight Perturbation Helps Robust GeneralizationPreprint
Wu, D., Xia, S., & Wang, Y. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2004.05884 · Cited by 413
Feature Importance-aware Transferable Adversarial Attacks
Wang, Z., Guo, H., Zhang, Z., Liu, W., Qin, Z., & Ren, K. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.00754 · Cited by 332
Evaluating the Robustness of Neural Networks: An Extreme Value Theory ApproachPreprint
Weng, T.-W., Zhang, H., Chen, P., Yi, J., Su, D., Gao, Y., Hsieh, C., & Daniel, L. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1801.10578 · Cited by 402
Formal Security Analysis of Neural Networks using Symbolic IntervalsPreprint
Wang, S., Pei, K.-X., Whitehouse, J., Yang, J., & Jana, S. (2018) · USENIX Security Symposium · doi:10.48550/arxiv.1804.10829 · Cited by 549
Linking AI quality performance and customer engagement: The moderating effect of AI preference
Prentice, C., Weaven, S. K., & Wong, I. A. (2020) · International Journal of Hospitality Management · doi:10.1016/j.ijhm.2020.102629 · Cited by 327
Adversarial Attack and Defense on Graph Data: A Survey
Sun, L., Dou, Y., Yang, C., Zhang, K., Wang, J., Yu, P. S., He, L., & Li, B. (2022) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2022.3201243 · Cited by 373
Tactics of Adversarial Attack on Deep Reinforcement Learning Agents
Lin, Y.-C., Hong, Z.-W., Liao, Y.-H., Shih, M.-L., Liu, M.-Y., & Sun, M. (2017) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2017/525 · Cited by 452
Admix: Enhancing the Transferability of Adversarial Attacks
Wang, X., He, X., Wang, J., & He, K. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01585 · Cited by 322
Self-Supervised Learning for Time Series Analysis: Taxonomy, Progress, and Prospects
Zhang, K., Wen, Q., Zhang, C., Cai, R., Jin, M., Liu, Y., Zhang, J. Y., Liang, Y., Pang, G., Song, D., et al. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3387317 · Cited by 295
“…various recent and typical adversarial attack and defense methods for fault classifiers in data-driven fault detection and classificationsystems,includingwhite-boxattack(FGSM[209], IGSM[210],C & W attack [211], DeepFool [212]) and gray-box and black-box attack (UAP [213], SPSA [214], Random noise).”
BackgroundAdversarial Machine Learning Attacks and Defense Methods in the Cyber Security Domain
Rosenberg, I., Shabtai, A., Elovici, Y., & Rokach, L. (2022) · ACM Computing Surveys · doi:10.1145/3453158 · Cited by 295
Adversarial Attacks in Modulation Recognition With Convolutional Neural Networks
Lin, Y., Zhao, H., Ma, X., Tu, Y., & Wang, M. (2020) · IEEE Transactions on Reliability · doi:10.1109/tr.2020.3032744 · Cited by 297
Guo, W., Mu, D., Xu, J., Su, P., Wang, G., & Xing, X. (2018) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3243734.3243792 · Cited by 301
Demystifying Membership Inference Attacks in Machine Learning as a Service
Truex, S., Liu, L., Gürsoy, M. E., Yu, L., & Wei, W. (2019) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2019.2897554 · Cited by 427
Şahin, E., Arslan, N. N., & Özdemir, D. (2024) · Neural Computing and Applications · doi:10.1007/s00521-024-10437-2 · Cited by 358
DeepFake Detection for Human Face Images and Videos: A Survey
Malik, A., Kuribayashi, M., Abdullahi, S. M., & Khan, A. N. (2022) · IEEE Access · doi:10.1109/access.2022.3151186 · Cited by 297
Privacy and Security Issues in Deep Learning: A Survey
Liu, X., Xie, L., Wang, Y., Zou, J., Xiong, J., Ying, Z., & Vasilakos, A. V. (2020) · IEEE Access · doi:10.1109/access.2020.3045078 · Cited by 311
He, Z., Rakin, A. S., & Fan, D. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00068 · Cited by 302
On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust ModelsPreprint
Gowal, S., Dvijotham, K., Stanforth, R., Bunel, R., Qin, C., Uesato, J., Arandjelović, R., Mann, T., & Kohli, P. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1810.12715 · Cited by 556
Detecting Adversarial Image Examples in Deep Neural Networks with Adaptive Noise Reduction
Liang, B., Li, H., Su, M., Li, X., Shi, W., & Wang, X. (2018) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2018.2874243 · Cited by 290
Deep Learning-Based Intrusion Detection With Adversaries
Wang, Z. (2018) · IEEE Access · doi:10.1109/access.2018.2854599 · Cited by 282
Detecting AI Trojans Using Meta Neural Analysis
Xu, X., Wang, Q., Li, H., Borisov, N., Gunter, C. A., & Li, B. (2021) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40001.2021.00034 · Cited by 306
Adversarial Attacks Against Automatic Speech Recognition Systems via Psychoacoustic Hiding
Schönherr, L., Kohls, K. S., Zeiler, S., Holz, T., & Kolossa, D. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23288 · Cited by 270
Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
Cheng, M., Le, T., Chen, P.-Y., Yi, J., Zhang, H., & Hsieh, C.-J. (2018) · arXiv · doi:10.48550/arxiv.1807.04457 · Cited by 269
Strike (With) a Pose: Neural Networks Are Easily Fooled by Strange Poses of Familiar Objects
Alcorn, M. A., Li, Q., Gong, Z., Wang, C., Mai, L., Ku, W., & Nguyen, A. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00498 · Cited by 265
Prior Convictions: Black-Box Adversarial Attacks with Bandits and PriorsPreprint
Ilyas, A., Engstrom, L., & Mądry, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.07978 · Cited by 300
Trusting artificial intelligence in cybersecurity is a double-edged sword
Taddeo, M., McCutcheon, T., & Floridi, L. (2019) · Nature Machine Intelligence · doi:10.1038/s42256-019-0109-1 · Cited by 299
Physical Adversarial Examples for Object DetectorsPreprint
Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Tramèr, F., Prakash, A., Kohno, T., & Song, D. X. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.07769 · Cited by 292
Azam, Z., Islam, M. M., & Huda, M. N. (2023) · IEEE Access · doi:10.1109/access.2023.3296444 · Cited by 265
DeepTest: Automated Testing of Deep-Neural-Network-driven Autonomous CarsPreprint
Tian, Y., Pei, K., Jana, S., & Ray, B. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1708.08559 · Cited by 259
Qayyum, A., Usama, M., Qadir, J., & Al-Fuqaha, A. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2975048 · Cited by 257
Transferable Adversarial Perturbations
Zhou, W., Hou, X., Chen, Y., Tang, M., Huang, X., Gan, X., & Yang, Y. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01264-9_28 · Cited by 267
Attacks Which Do Not Kill Training Make Adversarial Learning StrongerPreprint
Zhang, J., Xu, X., Han, B., Niu, G., Cui, L., Sugiyama, M., & Kankanhalli, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.11242 · Cited by 267
Adversarial machine learning in Network Intrusion Detection Systems
Alhajjar, E., Maxwell, P., & Bastian, N. D. (2021) · Expert Systems with Applications · doi:10.1016/j.eswa.2021.115782 · Cited by 255
Benchmarking Adversarial Robustness on Image Classification
Dong, Y., Fu, Q.-A., Yang, X. F., Pang, T., Su, H., Xiao, Z., & Zhu, J. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00040 · Cited by 292
Adversarial Attacks on Deep Learning Models in Natural Language Processing: A SurveyPreprint
Zhang, W. E., Sheng, Q. Z., Alhazmi, A., & Li, C. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.06796 · Cited by 253
Enhancing Adversarial Example Transferability With an Intermediate Level Attack
Huang, Q., Katsman, I., Gu, Z., He, H., Belongie, S., & Lim, S.-N. (2019) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2019.00483 · Cited by 274
Reachability Analysis of Deep Neural Networks with Provable Guarantees
Ruan, W., Huang, X., & Kwiatkowska, M. (2018) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2018/368 · Cited by 250
Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
Doan, B. G., Abbasnejad, E., & Ranasinghe, D. C. (2020) · Annual Computer Security Applications Conference · doi:10.1145/3427228.3427264 · Cited by 263
Vulnerability of Deep Reinforcement Learning to Policy Induction Attacks
Behzadan, V., & Munir, A. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-62416-7_19 · Cited by 247
Threats, attacks and defenses to federated learning: issues, taxonomy and perspectives
Liu, P., Xu, X., & Wang, W. (2022) · Cybersecurity · doi:10.1186/s42400-021-00105-6 · Cited by 261
Adversarial Examples for Generative Models
Kos, J., Fischer, I., & Song, D. X. (2018) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2018.00014 · Cited by 275
Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses
Rony, J., Hafemann, L. G., Oliveira, L. S., Ayed, I. B., Sabourin, R., & Granger, É. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00445 · Cited by 263
Physically Realizable Adversarial Examples for LiDAR Object Detection
Tu, J., Ren, M., Manivasagam, S., Liang, M., Yang, B., Du, R., Cheng, F., & Urtasun, R. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.01373 · Cited by 263
Load Forecasting Techniques and Their Applications in Smart Grids
Habbak, H., Mahmoud, M. M. E. A., Metwally, K., Fouda, M. M., & Ibrahem, M. I. (2023) · Energies · doi:10.3390/en16031480 · Cited by 261
“The convergence point is when the system no longer produces a better output after changing the weights and the error no longer decreases [57].”
BackgroundOlowononi, F. O., Rawat, D. B., & Liu, C. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.3036778 · Cited by 256
NIC: Detecting Adversarial Samples with Neural Network Invariant Checking
Ma, S., Liu, Y., Tao, G., Lee, W., & Zhang, X. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23415 · Cited by 252
Cao, Y., Wang, N., Xiao, C., Yang, D., Jin, F., Yang, R., Chen, Q. A., Liu, M., & Li, B. (2021) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40001.2021.00076 · Cited by 273
Adversarial Camouflage: Hiding Physical-World Attacks With Natural Styles
Duan, R., Ma, X., Wang, Y., Bailey, J., Qin, A. K., & Yang, Y. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00108 · Cited by 258
Network traffic classification: Techniques, datasets, and challenges
Azab, A., Khasawneh, M., Alrabaee, S., Choo, K. R., & Sarsour, M. (2022) · Digital Communications and Networks · doi:10.1016/j.dcan.2022.09.009 · Cited by 283
Minimally distorted Adversarial Examples with a Fast Adaptive Boundary AttackPreprint
Croce, F., & Hein, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1907.02044 · Cited by 253
Adversarial Examples: Opportunities and Challenges
Zhang, J., & Li, C. (2019) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2019.2933524 · Cited by 251
Practical Black-Box Attacks on Deep Neural Networks Using Efficient Query Mechanisms
Bhagoji, A. N., He, W., Li, B., & Song, D. X. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01258-8_10 · Cited by 235
Miller, D. J., Xiang, Z. J., & Kesidis, G. (2020) · Proceedings of the IEEE · doi:10.1109/jproc.2020.2970615 · Cited by 246
Detecting Deep-Fake Videos from Appearance and Behavior
Agarwal, S., Farid, H., El-Gaaly, T., & Lim, S.-N. (2020) · 2020 IEEE International Workshop on Information Forensics and Security (WIFS) · doi:10.1109/wifs49906.2020.9360904 · Cited by 242
“The drawback is that they can be highly sensitive to intentional or unintentional laundering including resizing or trans-coding, as well as adversarial attacks [7] and extrapolation to novel datasets.”
BackgroundLearning to Attack: Adversarial Transformation Networks
Baluja, S., & Fischer, I. (2018) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v32i1.11672 · Cited by 242
MagNet: a Two-Pronged Defense against Adversarial ExamplesPreprint
Meng, D., & Chen, H. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1705.09064 · Cited by 299
Privacy Risks of Securing Machine Learning Models against Adversarial Examples
Song, L., Shokri, R., & Mittal, P. (2019) · Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3319535.3354211 · Cited by 229
DeepGini: prioritizing massive tests to enhance the robustness of deep neural networks
Feng, Y., Shi, Q., Gao, X., Wan, J., Fang, C., & Chen, Z. (2020) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3395363.3397357 · Cited by 257
Enhancing robustness of machine learning systems via data transformations
Bhagoji, A. N., Cullina, D., Sitawarin, C., & Mittal, P. (2018) · Conference on Information Sciences and Systems · doi:10.1109/ciss.2018.8362326 · Cited by 307
Exploring Adversarial Examples in Malware Detection
Suciu, O., Coull, S. E., & Johns, J. M. (2019) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2019.00015 · Cited by 225
Dynamic Backdoor Attacks Against Machine Learning Models
Salem, A., Wen, R., Michael Backes, A., Ma, S., & Zhang, Y. (2022) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp53844.2022.00049 · Cited by 233
Mini-YOLOv3: Real-Time Object Detector for Embedded Applications
Mao, Q.-C., Sun, H.-M., Liu, Y., & Jia, R. (2019) · IEEE Access · doi:10.1109/access.2019.2941547 · Cited by 234
Feature-Guided Black-Box Safety Testing of Deep Neural Networks
Wicker, M., Huang, X., & Kwiatkowska, M. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-89960-2_22 · Cited by 228
Capra, M., Bussolino, B., Marchisio, A., Masera, G., Martina, M., & Shafique, M. (2020) · IEEE Access · doi:10.1109/access.2020.3039858 · Cited by 244
Backdoor Attacks Against Deep Learning Systems in the Physical World
Wenger, E., Passananti, J., Bhagoji, A. N., Yao, Y., Zheng, H.-T., & Zhao, B. Y. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00614 · Cited by 249
A Dual Approach to Scalable Verification of Deep NetworksPreprint
Krishnamurthy, Dvijotham, Stanforth, R., Gowal, S., Mann, T., & Kohli, P. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1803.06567 · Cited by 253
Detecting Deep-Fake Videos from Phoneme-Viseme Mismatches
Agarwal, S., Farid, H., Fried, O., & Agrawala, M. (2020) · 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw50498.2020.00338 · Cited by 234
Dos and Don'ts of Machine Learning in Computer SecurityPreprint
Arp, D., Quiring, E., Pendlebury, F., Warnecke, A., Pierazzi, F., Wressnegger, C., Cavallaro, L., & Rieck, K. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.09470 · Cited by 222
Disentangling Adversarial Robustness and Generalization
Stutz, D., Hein, M., & Schiele, B. (2019) · 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2019.00714 · Cited by 223
SparseFool: A Few Pixels Make a Big Difference
Modas, A., Moosavi-Dezfooli, S.-M., & Frossard, P. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00930 · Cited by 224
Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural NetworksPreprint
Li, Y., Lyu, X., Koren, N., Lyu, L., Li, B., & Ma, X. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2101.05930 · Cited by 264
Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning AttacksPreprint
Demontis, A., Melis, M., Pintor, M., Jagielski, M., Biggio, B., Oprea, A., Nita-Rotaru, C., & Roli, F. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.02861 · Cited by 219
Generic Black-Box End-to-End Attack Against State of the Art API Call Based Malware Classifiers
Rosenberg, I., Shabtai, A., Rokach, L., & Elovici, Y. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-00470-5_23 · Cited by 233
Learning to Anonymize Faces for Privacy Preserving Action Detection
Ren, Z., Lee, Y. J., & Ryoo, M. S. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01246-5_38 · Cited by 221
Transferable Adversarial Attacks for Image and Video Object Detection
Wei, X., Liang, S., Chen, N., & Cao, X. (2019) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/134 · Cited by 274
Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples
Cheng, M., Yi, J., Chen, P., Zhang, H., & Hsieh, C. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i04.5767 · Cited by 218
Metadata
- Authors
- Carlini, N., & Wagner, D.
- Affiliations
- University of California, Berkeley (US)
- Venue
- 2017 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2017-05
- Pages
- 39-57
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2516574342
- Cited by
- 8,859
- References
- 45
- Citations by year
- 2026: 566 · 2025: 983 · 2024: 1222 · 2023: 1200 · 2022: 1111 · 2021: 1308 · 2020: 1181 · 2019: 801 · 2018: 393 · 2017: 86
- FWCI
- 306.99
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- Cisco Systems
- International Science and Technology Center
- Multidisciplinary University Research Initiative (FA9550-12–1-0040)
- Air Force Office of Scientific Research (FA9550-, FA9550-12, FA9550‐12‐1, FA9550-12-1-0040)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
- Keywords
- adversarial examples, defensive distillation, adversarial attacks, neural network robustness, attack transferability, distance measures, robustness analysis
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
