What are the most common adversarial attacks on neural networks?

The most common adversarial attacks on neural networks include gradient-based methods like the Fast Gradient Sign Method (FGSM), which introduces small, carefully crafted perturbations to input data to mislead predictions. Iterative techniques such as the Basic Iterative Method (BIM) and Projected Gradient Descent (PGD) use multiple iterations for enhanced effectiveness. Transfer attacks exploit model vulnerabilities across architectures or datasets, while white-box attacks assume complete knowledge of the target model's architecture and parameters. These attacks underscore neural networks' susceptibility to subtle input manipulations, raising concerns about their robustness and generalization.

The're specialized inputs created with the purpose of confusing/fooling a neural network, resulting in the misclassification of a given input. Adverserial examples are the #White Box attack and #Black Box attack, #indistinguishable to the human eye, adding hard-to-notice #noise to the inputs of the network and cause network to #fail to identify the contents of the image (thereby #fooling neural network into making wrong predictions).

The Carlini and Wagner (C&W) attack is an advanced optimization-based method used to craft adversarial examples that can deceive machine learning models, especially neural networks, by making slight alterations to input data. Unlike simpler attacks such as the Fast Gradient Sign Method (FGSM), the C&W attack is more sophisticated, aiming to find the minimum perturbation needed to cause misclassification while simultaneously minimizing the magnitude of the perturbation.

Backdoor attacks can be inadvertently introduced via biased training data, as seen in the urban legend "tank classifier" example. Here, a neural network trained to identify tanks was actually recognizing the clear skies in the images, not the tanks themselves. This occurred because tank images were consistently taken on sunny days, creating a bias. Similarly, biased data can embed unintentional triggers in a model, causing it to respond to these biases rather than the intended features.

Adversarial attacks have also been observed to be transferable. Even if you can't perform an FGSM attack on a model directly you can still attack a model that achieves the same goal and is believed to have a similar architecture. The resulting malicious payload is still very likely to work on the former model.

Model inversion attacks are common attacks where model parameters are targetted by bad actors, especially for closed source models which are served as API service.

DeepFool Attack: DeepFool is an iterative method that computes the minimal perturbation needed to misclassify an input sample. It iteratively computes the perturbation by linearizing the decision boundary of the neural network and finding the closest point to the original input that crosses the decision boundary. Transferability Attacks: Transferability attacks exploit the phenomenon where adversarial examples crafted for one model can often fool other models trained on similar tasks. This means an attacker can generate adversarial examples on a substitute model and use them to attack the target model, even if the attacker does not have access to the target model's parameters.