自从2014年Szegedy等人提出对抗样本以来，不断有研究者提出新的对抗攻击方法。本文汇总了当前已有的绝大多数算法，以抛砖引玉用，并不断更新。
| Adversarial Attacks | Transparency | Specificity |
|---|---|---|
| L-BFGS | White box | Targeted, Non targeted |
| FGSM | White box | Targeted, Non targeted |
| BIM | White box | Targeted, Non targeted |
| ILCM | White box | Targeted |
| R+FGSM | White box | Targeted, Non targeted |
| AMDR | White box | Targeted, Non targeted |
| JSMA | White box | Targeted, Non targeted |
| SBA | Black box | Targeted, Non targeted |
| Hot/Cold | White box | Targeted |
| One-pixel | Semi-blackbox | Targeted, Non targeted |
| C&W | White box | Targeted, Non targeted |
| DeepFool | White box | Non targeted |
| UAP | White box | Non targeted |
| DFUAP | White box | Non targeted |
| VAE Attacks | White box | Targeted, Non targeted |
| ZOO | Black box | Targeted, Non targeted |
| UPSET | Black box | Targeted |
| ANGRI | Black box | Targeted |
| Houdini | White, Black box | Targeted, Non targeted |
| MI-FGSM | White box | Targeted, Non targeted |
| ATN | White box | Targeted |
| PGD | White box | Targeted |
| AdvGAN | White box | Targeted, Non targeted |
| Boundary Attack | Black box | Targeted, Non targeted |
| NAA | Black box | Non targeted |
| stAdv | White box | Targeted, Non targeted |
| EOT | White box | Targeted, Non targeted |
| BPDA | White box | Targeted, Non targeted |
| SPSA | Black box | Targeted, Non targeted |
| DDN | White box | Targeted, Non targeted |
| CAMOU | Black box | Non targeted |
- L-BFGS: Intriguing properties of neural networks
- FGSM: Explaining and Harnessing Adversarial Examples
- BIM & ILCM: Adversarial examples in the physical world
- R+FGSM: Ensemble Adversarial Training: Attacks and Defenses
- AMDR: Adversarial Manipulation of Deep Representations
- JSMA: The Limitations of Deep Learning in Adversarial Settings
- SBA: Practical Black-Box Attacks against Machine Learning
- Hot/Cold: Adversarial Diversity and Hard Positive Generation
- One-pixel: One pixel attack for fooling deep neural networks
- C&W: Towards Evaluating the Robustness of Neural Networks
- DeepFool: DeepFool: a simple and accurate method to fool deep neural networks
- UAP: Universal adversarial perturbations
- DFUAP: Generalizable Data-free Objective for Crafting Universal Adversarial Perturbations
- VAE Attacks: Adversarial examples for generative models
- ZOO: ZOO: Zeroth Order Optimization Based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- UPSET: UPSET and ANGRI : Breaking High Performance Image Classifiers
- ANGRI: UPSET and ANGRI : Breaking High Performance Image Classifiers
- Houdini: Houdini: Fooling Deep Structured Prediction Models
- MI-FGSM: Boosting Adversarial Attacks With Momentum
- ATN: Adversarial Transformation Networks: Learning to Generate Adversarial Examples
- PGD: Towards Deep Learning Models Resistant to Adversarial Attacks
- AdvGAN: ## Generating Adversarial Examples with Adversarial Networks
- Boundary Attack: Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
- NAA: ## Generating Natural Adversarial Examples
- stAdv: Spatially Transformed Adversarial Examples
- EOT: Synthesizing Robust Adversarial Examples
- BPDA: Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- SPSA: Multivariate stochastic approximation using a simultaneous perturbation gradient approximation
- DDN: Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses
- CAMOU: CAMOU: Learning Physical Vehicle Camouflages to Adversarially Attack Detectors in the Wild
参考
[1] Akhtar N, Mian A. Threat of adversarial attacks on deep learning in computer vision: A survey[J]. IEEE Access, 2018, 6: 14410-14430.
[2] Yuan X, He P, Zhu Q, et al. Adversarial examples: Attacks and defenses for deep learning[J]. IEEE transactions on neural networks and learning systems, 2019, 30(9): 2805-2824.
[3] Wiyatno R R, Xu A, Dia O, et al. Adversarial Examples in Modern Machine Learning: A Review[J]. arXiv preprint arXiv:1911.05268, 2019.
