First published: 2017/12/08 (5 years ago) Abstract: Learning-based pattern classifiers, including deep networks, have
demonstrated impressive performance in several application domains, ranging
from computer vision to computer security. However, it has also been shown that
adversarial input perturbations carefully crafted either at training or at test
time can easily subvert their predictions. The vulnerability of machine
learning to adversarial inputs (also known as adversarial examples), along with
the design of suitable countermeasures, have been investigated in the research
field of adversarial machine learning. In this work, we provide a thorough
overview of the evolution of this interdisciplinary research area over the last
ten years, starting from pioneering, earlier work up to more recent work aimed
at understanding the security properties of deep learning algorithms, in the
context of different applications. We report interesting connections between
these apparently-different lines of work, highlighting common misconceptions
related to the evaluation of the security of machine-learning algorithms. We
finally discuss the main limitations of current work, along with the
corresponding future research challenges towards the design of more secure
Biggio and Roli provide a comprehensive survey and discussion of work in adversarial machine learning. In contrast to related work [1,2], they explicitly discuss the relation of recent developments regarding the security of deep neural networks (as primarily discussed in  and ) and adversarial machine learning in general. The latter can be traced back to early work starting in 2004, e.g. involving adversarial attacks on spam filters. As a result, terminology used by Biggio and Roli is slightly different compared to publications focusing on deep neural networks. However, it also turns out that many approaches recently discussed in the deep learning community (such as adversarial training as defense) has already been introduced earlier regarding other machine learning algorithms. They also give a concise discussion of different threat models that is worth reading.
 N. Akhtar and A. Mian. Threat of adversarial attacks on deep learning in computer vision: A survey. arXiv.org, abs/1801.00553, 2018.
 X. Yuan, P. He, Q. Zhu, R. R. Bhat, and X. Li. Adversarial examples: Attacks and defenses for deep learning. arXiv.org, abs/1712.07107, 2017.
Also find this summary at [davidstutz.de](https://davidstutz.de/category/reading/).