Built on

Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, Nov 1998
1998
Earlier work this paper cites.
A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” University of Toronto, Tech. Rep. Vol. 1 No. 4, 2009
2009
Earlier work this paper cites.
K. Simonyan, A. Vedaldi, and A. Zisserman, “Deep inside convolutional networks: Visualising image classification models and saliency maps,” CoRR , vol. abs/1312.6034, 2013
Original
2013
Earlier work this paper cites.
C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” in International Conference on Learning Representations (ICLR’14) , 2014. [Online]. Available: http://arxiv.org/abs/1312.6199
Original
2014
Earlier work this paper cites.
I. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in International Conference on Learning Representations (ICLR’15) , 2015. [Online]. Available: http://arxiv.org/abs/1412.6572
Original
2015
Earlier work this paper cites.

Similar

N. Papernot, P. D. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in adversarial settings,” in IEEE European Symposium on Security and Privacy (EuroS&P’16) , 2016, pp. 372–387
2016
Cited alongside, same era.
A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” CoRR , vol. abs/1607.02533, 2016. [Online]. Available: http://arxiv.org/abs/1607.02533
Original
2016
Cited alongside, same era.
N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in 2016 IEEE Symposium on Security and Privacy (SP) , vol. 00, May 2016, pp. 582–597. [Online]. Available: doi.ieeecomputersociety.org/10.1109/SP.2016.41
2016
Cited alongside, same era.
N. Papernot, P. D. McDaniel, A. Sinha, and M. P. Wellman, “Towards the science of security and privacy in machine learning,” CoRR , vol. abs/1611.03814, 2016. [Online]. Available: http://arxiv.org/abs/1611.03814
Original

Then

N. Carlini and D. A. Wagner, “Towards evaluating the robustness of neural networks,” in IEEE Symposium on Security and Privacy (SP’17) , 2017, pp. 39–57
2017
Later among the works it cites.
H. Xiao, K. Rasul, and R. Vollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” CoRR , vol. abs/1708.07747, 2017. [Online]. Available: http://arxiv.org/abs/1708.07747
Original
2017
Later among the works it cites.
N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in ACM Asia Conference on Computer and Communications Security (ASIACCS’17) . New York, NY, USA: ACM, 2017, pp. 506–519. [Online]. Available: http://doi.acm.org/10.1145/3052973.3053009
2017
Later among the works it cites.
F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, “Ensemble adversarial training: Attacks and defenses,” in International Conference on Learning Representations (ICLR’18) , 2018. [Online]. Available: https://openreview.net/forum?id=rkZvSe-RZ

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…

2018

Maximal Jacobian-based Saliency Map Attack

Wiyatno, Rey, Xu, Anqi

Understand

The Jacobian-based Saliency Map Attack is a family of adversarial attack methods for fooling classification models, such as deep neural networks for image classification tasks.

By saturating a few pixels in a given image to their maximum or minimum values, JSMA can cause the model to misclassify the resulting adversarial image as a specified erroneous target class.
We propose two variants of JSMA, one which removes the requirement to specify a target class, and another that additionally does not need to specify whether to only increase or decrease pixel intensities.
Our experiments highlight the competitive speeds and qualities of these variants when applied to datasets of hand-written digits and natural scenes.

Built on

Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, Nov 1998
1998
Earlier work this paper cites.
A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” University of Toronto, Tech. Rep. Vol. 1 No. 4, 2009
2009
Earlier work this paper cites.
K. Simonyan, A. Vedaldi, and A. Zisserman, “Deep inside convolutional networks: Visualising image classification models and saliency maps,” CoRR , vol. abs/1312.6034, 2013
Original
2013
Earlier work this paper cites.
C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” in International Conference on Learning Representations (ICLR’14) , 2014. [Online]. Available: http://arxiv.org/abs/1312.6199
Original
2014
Earlier work this paper cites.
I. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in International Conference on Learning Representations (ICLR’15) , 2015. [Online]. Available: http://arxiv.org/abs/1412.6572
Original
2015
Earlier work this paper cites.

Similar

N. Papernot, P. D. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in adversarial settings,” in IEEE European Symposium on Security and Privacy (EuroS&P’16) , 2016, pp. 372–387
2016
Cited alongside, same era.
A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” CoRR , vol. abs/1607.02533, 2016. [Online]. Available: http://arxiv.org/abs/1607.02533
Original
2016
Cited alongside, same era.
N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in 2016 IEEE Symposium on Security and Privacy (SP) , vol. 00, May 2016, pp. 582–597. [Online]. Available: doi.ieeecomputersociety.org/10.1109/SP.2016.41
2016
Cited alongside, same era.
N. Papernot, P. D. McDaniel, A. Sinha, and M. P. Wellman, “Towards the science of security and privacy in machine learning,” CoRR , vol. abs/1611.03814, 2016. [Online]. Available: http://arxiv.org/abs/1611.03814
Original

Then

N. Carlini and D. A. Wagner, “Towards evaluating the robustness of neural networks,” in IEEE Symposium on Security and Privacy (SP’17) , 2017, pp. 39–57
2017
Later among the works it cites.
H. Xiao, K. Rasul, and R. Vollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” CoRR , vol. abs/1708.07747, 2017. [Online]. Available: http://arxiv.org/abs/1708.07747
Original
2017
Later among the works it cites.
N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in ACM Asia Conference on Computer and Communications Security (ASIACCS’17) . New York, NY, USA: ACM, 2017, pp. 506–519. [Online]. Available: http://doi.acm.org/10.1145/3052973.3053009
2017
Later among the works it cites.
F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, “Ensemble adversarial training: Attacks and defenses,” in International Conference on Learning Representations (ICLR’18) , 2018. [Online]. Available: https://openreview.net/forum?id=rkZvSe-RZ

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

2016

Cited alongside, same era.

N. Carlini and D. A. Wagner, “Defensive distillation is not robust to adversarial examples,” CoRR , vol. abs/1607.04311, 2016. [Online]. Available: http://arxiv.org/abs/1607.04311

Original

2016

Cited alongside, same era.

2018

Closest in time.