Adversarial Attacks and Defense Mechanisms in AI

References

[1] Goodfellow, I. J., Shlens, J., & Szegedy, C. (2015). Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572.

[2] Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2019). Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083.

[3] Carlini, N., & Wagner, D. (2017). Towards evaluating the robustness of neural networks. Proceedings of the 2017 IEEE Symposium on Security and Privacy.

[4] Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2014). Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199.

[5] Papernot, N., McDaniel, P., & Goodfellow, I. (2016). Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277.

[6] Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., & Swami, A. (2017). Practical black-box attacks against machine learning. Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security.

[7] Papernot, N., McDaniel, P., Wu, X., Jha, S., & Swami, A. (2016). Distillation as a defense to adversarial perturbations against deep neural networks. 2016 IEEE Symposium on Security and Privacy (SP).

[8] Moosavi-Dezfooli, S.-M., Fawzi, A., & Frossard, P. (2016). DeepFool: a simple and accurate method to fool deep neural networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR).

[9] Athalye, A., Carlini, N., & Wagner, D. (2018). Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples. Proceedings of the 35th International Conference on Machine Learning (ICML).

[10] Croce, F., & Hein, M. (2020). Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. arXiv preprint arXiv:2003.01690.

[11] Wang, Y., Sun, T., Li, S., Yuan, X., Ni, W., & Hossain, E. (2023). Adversarial attacks and defenses in machine learning-powered networks: A contemporary survey. arXiv preprint arXiv:2303.06302.

[12] Wu, B., Zhu, Z., Liu, L., Q. Liu, He, Z., & Lyu, S. (2023). Attacks in adversarial machine learning: A systematic survey from the life-cycle perspective. arXiv preprint arXiv:2302.09457.

[13] NIST (Vassilev, A., Oprea, A., Fordyce, A., Anderson, H., Davies, X., & Hamin, M.). (2025). Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2e2025). National Institute of Standards and Technology.

[14] Carlini, N. (2019). A complete list of all adversarial example papers. Retrieved from https://nicholas.carlini.com/writing/2019/all-adversarial-example-papers.html Link

[15] Ibitoye, O., Abou-Khamis, R., elShehaby, M., Matrawy, A., & Shafiq, M. O. (2025). The threat of adversarial attacks against machine learning in network security: A survey. Journal of Electronics and Electrical Engineering.

[16] Akhtar, N., & Mian, A. (2018). Threat of adversarial attacks on deep learning in computer vision: A survey. IEEE Access, 6, 14410–14430.

[17] Zhou, Y., Kantarcioglu, M., & Xi, B. (2019). A survey of game theoretic approach for adversarial machine learning. Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery, 9(e1259).

[18] Dusdu, V. (2018). A survey of adversarial machine learning in cyber warfare. Defence Science Journal, 68, 356.

[19] Bhagoji, A. N., Cullina, D., & Mittal, P. (2018). Dimensionality’s curse: defenses fail for high-dimensional spaces. Proceedings of the 35th International Conference on Machine Learning (ICML).

[20] Guo, C., Rana, M., Cisse, M., & van der Maaten, L. (2018). Countering adversarial images using input transformations. arXiv preprint arXiv:1711.00117.

[21] Salman, H., Yang, G., Newsam, S., Basu, S., & Natarajan, K. (2020). Provable defenses against adversarial examples via the convex outer adversarial polytope. arXiv preprint arXiv:1805.11774.

[22] Raghunathan, A., Steinhardt, J., & Liang, P. (2018). Certified defenses against adversarial examples. Proceedings of the 6th International Conference on Learning Representations (ICLR).

[23] Lecuyer, M., Atlidakis, V., Gehr, T., Miracle-Sole, C., & Vechev, M. (2019). Certified robustness to adversarial examples with differential privacy. Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP).

[24] Cissé, M., Bojanowski, P., Grave, E., Dauphin, Y., & Usunier, N. (2017). Parseval networks: improving robustness to adversarial examples. Proceedings of the 34th International Conference on Machine Learning (ICML).

[25] Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2020). Adversarial training is not robust enough — toward better defenses. ArXiv Preprint.

@article{1711957,
      author = {Geetha Aradhyula},
      title = {Adversarial Attacks and Defense Mechanisms in AI},
      journal = {Iconic Research And Engineering Journals},
      year = {2024},
      volume = {8},
      number = {5},
      pages = {1453-1461},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1711957.pdf},
      abstract = {The performance of Artificial Intelligence (AI) systems and especially those relying on deep learning has been impressive in the breadth of their application in computer vision, natural language processing, healthcare, and autonomous system domains. Nevertheless, their increased reliance on neural networks of large scale has left them vulnerable to a fatal attack--adversarial attacks. These attacks include the purposeful control of the input data by well-crafted, and typically invisible, perturbations that trigger AI models to make erroneous predictions or classifications. These counter-examples cast severe doubts on the resilience, stability, and safety of the AI-based technologies, with respect to safety-related purposes like self-driving cars, biometric authentication, and medical diagnosis. In this paper, the approach to adversarial attacks is described in detail, and they are divided into white-box, black-box, and gray-box models, depending on the knowledge of the attacker of the target system. It also discusses the various attack approaches including Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD) and optimization-based approaches which exploit the sensitivities and gradients of models. Simultaneously, the paper examines the current defense mechanisms to enhance AI resilience, such as adversarial training, defensive distillation, input transformation, gradient masking, and certified robustness methods. Regardless of the great advances, the majority of defense mechanisms have a low scalability, generalization, or computing efficiency, creating a continuous arms race between the generation of adversarial attacks and defense of models. The paper ends by covering areas where the research is moving including explainable AI, robust optimization, and the incorporation of security-by-design concepts in the development of neural networks. To make AI models more trustworthy, transparent and safe to deploy in the real world, it is necessary to strengthen them against adversarial manipulation.},
      month = {November},
      doi = {https://doi.org/10.64388/IREV9I5-1711957}
  }