Defense Against the Dark Arts: An overview of adversarial example security research and future research directions

This article presents a summary of a keynote lecture at the Deep Learning Security workshop at IEEE Security and Privacy 2018. This lecture summarizes the state of the art in defenses against adversarial examples and provides recommendations for future research directions on this topic. "I.I.D." stands for "independent and identically distributed". It means that all of the examples in the training and test set are generated independently from each other, and are all drawn from the same data-generating distribution. This diagram illustrates this with an example training set and test set sampled for a classification problem with 2 input features (one plotted on horizontal axis, one plotted on vertical axis) and 2 classes (orange plus versus blue X). 2 ML reached "human-level performance" on many IID tasks circa 2013 (Goodfellow 2018) Figure 2: Until recently, machine learning was difficult, even in the I.I.D. setting. Adversarial examples were not interesting to most researchers because mistakes were the rule, not the exception. In about 2013, machine learning started to reach human-level performance on several benchmark tasks (here I highlight vision tasks because they have nice pictures to put on a slide).