Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Adversarial Attacks and Defenses in Images, Graphs and Text: A Review

Han Xu, Yao Ma, Haochen Liu, Debayan Deb, Hui Liu, Jiliang Tang, Anil K. Jain

TL;DR

This survey provides a structured, cross-domain synthesis of adversarial attacks and defenses for images, graphs, and text. It catalogs white-box, black-box, grey-box, and poisoning attacks, alongside gradient-masking, robust optimization, and detection-based defenses, including provable guarantees. It highlights practical realities such as transferability, physical-world adversaries, and domain-specific challenges in graphs and NLP. The work emphasizes the evolving cat-and-mouse dynamic and offers guidance for building more robust, verifiable systems.

Abstract

Deep neural networks (DNN) have achieved unprecedented success in numerous machine learning tasks in various domains. However, the existence of adversarial examples has raised concerns about applying deep learning to safety-critical applications. As a result, we have witnessed increasing interests in studying attack and defense mechanisms for DNN models on different data types, such as images, graphs and text. Thus, it is necessary to provide a systematic and comprehensive overview of the main threats of attacks and the success of corresponding countermeasures. In this survey, we review the state of the art algorithms for generating adversarial examples and the countermeasures against adversarial examples, for the three popular data types, i.e., images, graphs and text.

Adversarial Attacks and Defenses in Images, Graphs and Text: A Review

TL;DR

This survey provides a structured, cross-domain synthesis of adversarial attacks and defenses for images, graphs, and text. It catalogs white-box, black-box, grey-box, and poisoning attacks, alongside gradient-masking, robust optimization, and detection-based defenses, including provable guarantees. It highlights practical realities such as transferability, physical-world adversaries, and domain-specific challenges in graphs and NLP. The work emphasizes the evolving cat-and-mouse dynamic and offers guidance for building more robust, verifiable systems.

Abstract

Deep neural networks (DNN) have achieved unprecedented success in numerous machine learning tasks in various domains. However, the existence of adversarial examples has raised concerns about applying deep learning to safety-critical applications. As a result, we have witnessed increasing interests in studying attack and defense mechanisms for DNN models on different data types, such as images, graphs and text. Thus, it is necessary to provide a systematic and comprehensive overview of the main threats of attacks and the success of corresponding countermeasures. In this survey, we review the state of the art algorithms for generating adversarial examples and the countermeasures against adversarial examples, for the three popular data types, i.e., images, graphs and text.

Paper Structure

This paper contains 85 sections, 20 equations, 11 figures, 1 table, 1 algorithm.

Table of Contents

  1. Introduction
  2. Definitions and Notations
  3. Threat Model
  4. Adversary's Goal
  5. Adversary's Knowledge
  6. Victim Models
  7. Security Evaluation
  8. Robustness
  9. Adversarial Risk (Loss)
  10. Adversarial Risk vs Risk
  11. Notations
  12. Generating Adversarial Examples
  13. White-box Attacks
  14. Biggio's Attack
  15. Szegedy's L-BFGS Attack
  16. ...and 70 more sections

Figures (11)

  • Figure 1: Biggio's attack on SVM classifier for letter recognition. (Image Credit: biggio2013evasion)
  • Figure 2: By adding an unnoticeable perturbation, "panda" is classified as "gibbon". (Image Credit: goodfellow2014explaining)
  • Figure 3: Decision Boundaries: the hyperplane $\mathcal{F}_1$ ($\mathcal{F}_2$ or $\mathcal{F}_3$) separates the data points belonging to class 4 and class 1 (class 2 or 3). The sample $x_0$ crosses the decision boundary $\mathcal{F}_3$, so the perturbed data $x_0'$ is classified as class 3. (Image Credit: moosavi2016deepfool)
  • Figure 4: The top part of digit "5"' is perturbed to be "thicker". For the image which was correctly classified as "5", after distortion is now classified as "3".
  • Figure 5: The attacker puts some stickers on a road sign to confuse an autonomous vehicle's road sign recognizer from any viewpoint. (Image Credit: eykholt2017robust)
  • ...and 6 more figures

Theorems & Definitions (6)

  • Definition 1
  • Definition 2
  • Definition 3
  • Definition 4
  • Definition 5
  • Definition 6