Adversarial Attacks and Defenses in Images, Graphs and Text: A Review

By Han Xu, Yao Ma, Haochen Liu, Debayan Deb, Hui Liu, Jiliang Tang, Anil K. Jain. 2019

757 citations recorded by the source corpus.

Deep neural networks (DNN) have achieved unprecedented success in numerous machine learning tasks in various domains. However, the existence of adversarial examples raises our concerns in adopting deep learning to safety-critical applications. As a result, we have witnessed increasing interests in studying attack and defense mechanisms for DNN models on different data types, such as images, graphs and text. Thus, it is necessary to provide a systematic and comprehensive overview of the main threats of attacks and the success of corresponding countermeasures. In this survey, we review the state of the art algorithms for generating adversarial examples and the countermeasures against adversarial examples, for three most popular data types, including images, graphs and text.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned (2022, background): “Finally, a large body of work aims to learn adversarial examples that cause downstream models to produce spurious outputs [50], some of which are reviewed in [59].”
Red Teaming Language Models with Language Models (2022, methodology): “Our approach is related to work on adversarial examples (Szegedy et al., 2014) which edits inputs to negatively impact a model’s outputs (for an overview, see Xu et al., 2020).”
Adversarial Example Games (2020, background): “Broadly speaking, most defense approaches can be categorized into either robust optimization techniques, gradient obfuscation methods, or adversarial example detection algorithms [71].”
Chat as Expected: Learning to Manipulate Black-box Neural Dialogue Models (2020, background): “More recently it has been demonstrated that neural networks suffer from some problems including vulnerability due to their black-box nature and our lack of truly understanding their inner processing (Szegedy et al., 2013; Xu et al., 2019).”
Mitigating Gender Bias for Neural Dialogue Generation with Adversarial Learning (2020, background): “Dialogue systems have been shown to be sensitive to the input messages (Niu and Bansal, 2018; Zhang et al., 2020; Xu et al., 2020).”
Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger (2021, background): “Adversarial attacks (Szegedy et al., 2014; Good-fellow et al., 2015; Xu et al., 2020; Zang et al., 2020) are a kind of widely studied security threat to DNNs.”
Beyond Leaderboards: A survey of methods for revealing weaknesses in Natural Language Inference data and models (2020, neutral): “For an overview thereof, we refer the interested reader to respective surveys conducted by Zhang et al. (2019c) or Xu et al. (2019) for the ﬁrst, and by Mehrabi et al. (2019) for the latter.”
Digital Twin: Values, Challenges and Enablers From a Modeling Perspective (2019, result): “In fact the vulnerability of DNN have been been exposed beyond doubt in several recent works [146], [147], [148].”
Node Similarity Preserving Graph Convolutional Networks (2020, background): “Traditional deep neural networks can be easily fooled by adversarial attacks [19, 20, 36].”
On the Detection of Digital Face Manipulation (2019, background): “ii) Adversarial face attacks generate high-quality and perceptually imperceptible adversarial images that can evade automated face matchers [18, 20, 37, 57].”
Graph Structure Learning for Robust Graph Neural Networks (2020, background): “However, given the complexity of structural information, the majority of existing adversarial attacks on graph data have focused on modifying graph structure especially adding/deleting/rewiring edges [34].”
When Combating Hype, Proceed with Caution (2021, background): “Looking only to highly-cited works from the last two years that cite Jia and Liang, similar statements can be found in Xu et al. (2020), Zhang et al. (2020), and others.”
Relating Adversarially Robust Generalization to Flat Minima (2021, background): “, see [50, 69, 1, 5, 65], adversarial training (AT) has become the de-facto standard for (empirical) robustness.”