Adversarial Examples - A Complete Characterisation of the Phenomenon
Alexandru Constantin Serban Radboud University Software Improvement Group The Netherlands Erik Poll Radboud University The Netherlands Joost Visser Radboud University Software Improvement Group The Netherlands
Abstract
We provide a complete characterisation of the phenomenon of adversarial examples - inputs intentionally crafted to fool machine learning models. We aim to cover all the important concerns in this field of study: (1) the conjectures on the existence of adversarial examples, (2) the security, safety and robustness implications, (3) the methods used to generate and (4) protect against adversarial examples and (5) the ability of adversarial examples to transfer between different machine learning models. We provide ample background information in an effort to make this document self-contained. Therefore, this document can be used as survey, tutorial or as a catalog of attacks and defences using adversarial examples.
中文速览
机器学习模型容易被"对抗样本"（adversarial examples）欺骗——只需对输入数据做肉眼难以察觉的微小改动，就能让模型给出完全错误的预测，这在安全攸关的场景中是个严重隐患。这篇综述系统梳理了对抗样本领域的全貌，从它为何存在的理论猜想，到各类攻击方法（如何生成对抗样本）和防御手段（如何让模型更鲁棒），再到对抗样本能否在不同模型之间"迁移"这一关键特性，都做了深入覆盖。作者还专门补充了大量背景知识，让这份文档兼具综述、教程和攻防方法目录三重功能，无需太多前置知识即可阅读。弄清这些问题对于在人脸识别、自动驾驶、医疗诊断等高风险场景中安全部署AI至关重要，这份系统性梳理为后续研究和实践提供了可靠的参考框架。
原文 arXiv:1810.01185;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1810.01185v2