Adversarial Robustness Assessment: Why both $L_0$ and $L_\infty$ Attacks Are Necessary

R. Storn and K. Price, “Differential evolution–a simple and efficient heuristic for global optimization over continuous spaces,” Journal of global optimization , vol. 11, no. 4, pp. 341–359, 1997

1997

Earlier work this paper cites.

Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 1998

1998

Earlier work this paper cites.

N. Hansen, S. D. Müller, and P. Koumoutsakos, “Reducing the time complexity of the derandomized evolution strategy with covariance matrix adaptation (cma-es),” Evolutionary computation , vol. 11, no. 1, pp. 1–18, 2003

2003

Earlier work this paper cites.

A. Krizhevsky, G. Hinton et al. , “Learning multiple layers of features from tiny images,” Tech. Rep., 2009

2009

Earlier work this paper cites.

M. Lin, Q. Chen, and S. Yan, “Network in network,” arXiv preprint arXiv:1312.4400 , 2013

Original

2013

Earlier work this paper cites.

C. e. a. Szegedy, “Intriguing properties of neural networks,” in In ICLR . Citeseer, 2014

2014

Earlier work this paper cites.

I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

Original

2014

Earlier work this paper cites.

F. Iandola, M. Moskewicz, S. Karayev, R. Girshick, T. Darrell, and K. Keutzer, “Densenet: Implementing efficient convnet descriptor pyramids,” arXiv preprint arXiv:1404.1869 , 2014

Original

2014

Earlier work this paper cites.

J. T. Springenberg, A. Dosovitskiy, T. Brox, and M. Riedmiller, “Striving for simplicity: The all convolutional net,” arXiv preprint arXiv:1412.6806 , 2014

Original

2014

Earlier work this paper cites.

A. Nguyen, J. Yosinski, and J. Clune, “Deep neural networks are easily fooled: High confidence predictions for unrecognizable images,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2015, pp. 427–436

2015

Earlier work this paper cites.

R. Huang, B. Xu, D. Schuurmans, and C. Szepesvári, “Learning with a strong adversary,” arXiv preprint arXiv:1511.03034 , 2015

Original

2015

Earlier work this paper cites.

A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” arXiv preprint arXiv:1607.02533 , 2016

Original

2016

Earlier work this paper cites.

M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security . Acm, 2016, pp. 1528–1540

2016

Earlier work this paper cites.

N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in 2016 IEEE Symposium on Security and Privacy (SP) . Ieee, 2016, pp. 582–597

2016

Earlier work this paper cites.

G. K. Dziugaite, Z. Ghahramani, and D. M. Roy, “A study of the effect of jpg compression on adversarial images,” arXiv preprint arXiv:1608.00853 , 2016

Original

2016

Cited alongside, same era.

T. Hazan, G. Papandreou, and D. Tarlow, Perturbations, Optimization, and Statistics . MIT Press, 2016

2016

Cited alongside, same era.

K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

2016

Cited alongside, same era.

S. Zagoruyko and N. Komodakis, “Wide residual networks,” arXiv preprint arXiv:1605.07146 , 2016

Original

2016

Cited alongside, same era.

S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “Deepfool: a simple and accurate method to fool deep neural networks,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2016, pp. 2574–2582

S. Sabour, N. Frosst, and G. E. Hinton, “Dynamic routing between capsules,” in Advances in neural information processing systems , 2017, pp. 3856–3866

2017

Later among the works it cites.

U. Jang, X. Wu, and S. Jha, “Objective metrics and gradient descent algorithms for adversarial examples in machine learning,” in Proceedings of the 33rd Annual Computer Security Applications Conference . Acm, 2017, pp. 262–277

2017

Later among the works it cites.

A. Athalye and I. Sutskever, “Synthesizing robust adversarial examples,” in Icml , 2018

2018

Later among the works it cites.

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in Iclr , 2018

2018

Later among the works it cites.

C. Guo, M. Rana, M. Cisse, and L. van der Maaten, “Countering adversarial images using input transformations,” in Iclr , 2018