Robust Physical-World Attacks on Machine Learning Models

By Ivan Evtimov, Kevin Eykholt, Earlence Fernandes, Tadayoshi Kohno, Bo Li, Atul Prakash, Amir Rahmati, Dawn Song. 2017

343 citations recorded by the source corpus.

Subfields: Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Safety, Robustness & Interpretability

Citations in the corpus

Strike (With) a Pose: Neural Networks Are Easily Fooled by Strange Poses of Familiar Objects (2018, background): “, by synthesizing an entire image [27], a small patch [16, 11], a few pixels [7], or only a single pixel [35].”
Certified Robustness to Adversarial Examples with Differential Privacy (2018, background): “A small 0-norm attack is permitted to arbitrarily change a few entries of the input; for example, an attack on the image recognition system for self-driving cars based on putting a sticker in the field of vision is such an attack [18].”
SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems (2018, methodology): “More speciﬁcally we consider an adversary that makes use of localized universal malicious objects, e.g., printed patches [26], [3], [10], [9] or 3D objects [2] (see, e.g., Figure 1), that can fool a model under real-world conditions such as lighting, sensor noise, and rotation.”
Spectral Signatures in Backdoor Attacks (2018, background): “We also point out that backdoor poisoning is related to adversarial examples [13, 26, 21, 12, 29, 4, 24, 32].”
Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning (2017, background): “In particular, a body of literature studying adversarial examples belongs to this category [29], [53], [36], [48], [54], [52], [15], [40], [25].”
BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain (2017, background): “[17]; however, whereas that attack assumes an honest network and then creates stickers with patterns that cause the network misclassify the stop sign, our work would allow the attacker to freely choose their backdoor trigger, which could make it less noticeable.”
ZOO: Zeroth Order Optimization Based Black-box Attacks to Deep Neural Networks without Training Substitute Models (2017, background): “…the inherent weakness of lacking robustness to adversarial examples for DNNs brings about security concerns, especially for mission-critical applications requiring guaranteed reliability, including traffic sign identification for autonomous driving and malware prevention [8, 15, 16], among others.”
Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Representations (2018, background): “Beyond data inference, MLmodels have been shown to be subject to a variety of other attacks, such as, adversarial attacks on object detectors [27] or classifiers [13, 29, 30, 32], malicious algorithms which discreetly memorize the training data samples [39], and malicious classifiers which mislead t”
AI2: Safety and Robustness Certification of Neural Networks with Abstract Interpretation (2018, background): “For instance, it has been shown that attacks can be executed physically (e.g., [9], [24]) and against neural networks accessible only as a black box (e.g., [12], [40], [43]).”
Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach (2018, background): “Even worse, researchers have identiﬁed that these adversarial examples are not only valid in the digital space but also plausible in the physical world (Kurakin et al., 2016a; Evtimov et al., 2017).”
Certified Defenses against Adversarial Examples (2018, background): “In addition to being an intriguing phenonemon, the existence of such “adversarial examples” exposes a serious vulnerability in current ML systems (Evtimov et al., 2017; Sharif et al., 2016; Carlini et al., 2016).”
Spatially Transformed Adversarial Examples (2018, background): “…can be used to subvert malware detection, fraud detection, or even potentially mislead autonomous navigation systems (Papernot et al., 2016b; Evtimov et al., 2017; Grosse et al., 2016; Li & Vorobeychik, 2014; 2015) and therefore pose security risks when applied to security-related…”
A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks (2018, background): “, self-driving cars and secure authentication system [6, 30].”
Robustness May Be at Odds with Accuracy (2018, background): “…a number of approaches both to ﬁnding these perturbations, and to training models that are robust to them (Goodfellow et al., 2014b; Nguyen et al., 2015; Moosavi-Dezfooli et al., 2016; Carlini & Wagner, 2016; Sharif et al., 2016; Kurakin et al., 2016a; Evtimov et al., 2017; Athalye et al., 2017).”
EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples (2017, background): “Moreover, moving beyond the digital space, researchers have shown that these adversarial examples are still effective in the physical world at fooling DNNs (Kurakin, Goodfellow, and Bengio 2016a; Evtimov et al. 2017).”
Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality (2018, background): “This undesirable property of deep networks has become a major security concern in real-world applications of DNNs, such as self-driving cars and identity recognition (Evtimov et al., 2017; Sharif et al., 2016).”