{"type":"ScholarlyArticle","title":"Real-Time Adversarial Attacks","authors":[{"name":"Yuan Gong","slug":"yuan-gong","given":"Yuan","family":"Gong","affiliation":"University of Notre Dame"},{"name":"Boyang Li","slug":"boyang-li","given":"Boyang","family":"Li","affiliation":"University of Notre Dame"},{"name":"Christian Poellabauer","slug":"christian-poellabauer","given":"Christian","family":"Poellabauer","affiliation":"University of Notre Dame"},{"name":"Yiyu Shi","slug":"yiyu-shi","given":"Yiyu","family":"Shi","affiliation":"University of Notre Dame"}],"abstract":"In recent years, many efforts have demonstrated that modern machine learning algorithms are vulnerable to adversarial attacks, where small, but carefully crafted, perturbations on the input can make them fail. While these attack methods are very effective, they only focus on scenarios where the target model takes static input, i.e., an attacker can observe the entire original sample and then add a perturbation at any point of the sample. These attack approaches are not applicable to situations where the target model takes streaming input, i.e., an attacker is only able to observe past data points and add perturbations to the remaining (unobserved) data points of the input. In this paper, we propose a real-time adversarial attack scheme for machine learning models with streaming inputs.","doi":"10.24963/ijcai.2019/649","url":"https://ijcai.org/proceedings/2019/649","pdf":"https://ijcai.org/proceedings/2019/0649.pdf","markdown":"https://ijcai.org/proceedings/2019/649.md","bibtex":"https://ijcai.org/proceedings/2019/bibtex/649","volume":{"slug":"2019","title":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2019","url":"https://ijcai.org/proceedings/2019/","year":2019,"location":"Macao","dates":"10-16 August 2019","editors":"Sarit Kraus","isbn":"978-0-9992411-4-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2019"},"section":"Multidisciplinary Topics and Applications","track":"Main track","number":649,"pages":{"first":4672,"last":4680},"keywords":["Multidisciplinary Topics and Applications: Real-Time Systems","Machine Learning Applications: Applications of Reinforcement Learning","Multidisciplinary Topics and Applications: Security and Privacy","Machine Learning: Time-series;Data Streams"],"videos":[],"references":[{"position":1,"raw":"[Alzantot et al., 2018] Moustafa Alzantot, Bharathan Balaji, and Mani Srivastava. Did you hear that? adversarial exam- ples against automatic speech recognition. arXiv preprint arXiv:1801.00554, 2018.","title":"Did you hear that? adversarial examples against automatic speech recognition","authors":"Moustafa Alzantot, Bharathan Balaji, Mani Srivastava","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Atkeson and Schaal, 1997] Christopher G Atkeson and Ste- fan Schaal. Robot learning from demonstration. In ICML, volume 97, pages 12-20. Citeseer, 1997.","title":"Robot learning from demonstration","authors":"G Christopher, Stefan Atkeson, Schaal","year":"1997","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Carlini and Wagner, 2018] Nicholas Carlini and David Wagner. Audio adversarial examples: Targeted attacks on speech-to-text. In 2018 IEEE Security and Privacy Workshops (SPW), pages 1-7. IEEE, 2018.","title":"Audio adversarial examples: Targeted attacks on speech-to-text","authors":"Wagner Carlini, Nicholas Carlini, David Wagner","year":"2018","venue":"2018 IEEE Security and Privacy Workshops (SPW)","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Carlini et al., 2016] Nicholas Carlini, Pratyush Mishra, Tavish Vaidya, Yuankai Zhang, Micah Sherr, Clay Shields, David Wagner, and Wenchao Zhou. Hidden voice commands. In 25th {USENIX} Security Symposium ({USENIX} Security 16), pages 513-530, 2016.","title":"Hidden voice commands","authors":"Nicholas Carlini, Pratyush Mishra, Tavish Vaidya, Yuankai Zhang, Micah Sherr, Clay Shields, David Wagner, Wenchao Zhou","year":"2016","venue":"25th {USENIX} Security Symposium ({USENIX} Security 16)","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Cisse et al., 2017] Moustapha Cisse, Yossi Adi, Natalia Neverova, and Joseph Keshet. Houdini: Fooling deep structured prediction models. arXiv preprint arXiv:1707.05373, 2017.","title":"Houdini: Fooling deep structured prediction models","authors":"Moustapha Cisse, Yossi Adi, Natalia Neverova, Joseph Keshet","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Ebrahimi et al., 2017] Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. Hotflip: White-box adver- sarial examples for text classification. arXiv preprint arXiv:1712.06751, 2017.","title":"Hotflip: White-box adversarial examples for text classification","authors":"Javid Ebrahimi, Anyi Rao, Daniel Lowd, Dejing Dou","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Gong and Poellabauer, 2017] Yuan Gong and Chris- tian Poellabauer. Crafting adversarial examples for speech paralinguistics applications. arXiv preprint arXiv:1711.03280, 2017.","title":"Crafting adversarial examples for speech paralinguistics applications","authors":"Yuan Gong, Christian Poellabauer","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Gong and Poellabauer, 2018] Yuan Gong and Christian Poellabauer. An overview of vulnerabilities of voice con- trolled systems. arXiv preprint arXiv:1803.09156, 2018.","title":"Yuan Gong and Christian Poellabauer. An overview of vulnerabilities of voice controlled systems","authors":"Poellabauer Gong","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Goodfellow et al., 2014] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Grosse et al., 2017] Kathrin Grosse, Nicolas Papernot, Praveen Manoharan, Michael Backes, and Patrick Mc- Daniel. Adversarial examples for malware detection. In European Symposium on Research in Computer Security, pages 62-79. Springer, 2017.","title":"Adversarial examples for malware detection","authors":"Kathrin Grosse, Nicolas Papernot, Praveen Manoharan, Michael Backes, Patrick Mc-Daniel","year":"2017","venue":"European Symposium on Research in Computer Security","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Hochreiter and Schmidhuber, 1997] Sepp Hochreiter and Jürgen Schmidhuber. Long short-term memory. Neural computation, 9(8):1735-1780, 1997.","title":"Long short-term memory","authors":"Schmidhuber Hochreiter, Sepp Hochreiter, Jürgen Schmidhuber","year":"1997","venue":"Neural computation","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Kingma and Ba, 2014] Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.","title":"Adam: A method for stochastic optimization","authors":"P Diederik, Jimmy Kingma, Ba","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Li et al., 2018] Shasha Li, Ajaya Neupane, Sujoy Paul, Chengyu Song, Srikanth V Krishnamurthy, Amit K Roy Chowdhury, and Ananthram Swami. Adversarial perturba- tions against real-time video classification systems. arXiv preprint arXiv:1807.00458, 2018.","title":"Adversarial perturbations against real-time video classification systems","authors":"Shasha Li, Ajaya Neupane, Sujoy Paul, Chengyu Song, V Srikanth, Amit K Roy Krishnamurthy, Ananthram Chowdhury, Swami","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Moosavi-Dezfooli et al., 2016] Seyed-Mohsen Moosavi- Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deep- fool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 2574-2582, 2016.","title":"Deepfool: a simple and accurate method to fool deep neural networks","authors":"Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Pascal Frossard","year":"2016","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Moosavi-Dezfooli et al., 2017] Seyed-Mohsen Moosavi- Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Pro- ceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 1765-1773, 2017.","title":"Universal adversarial perturbations","authors":"Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, Pascal Frossard","year":"2017","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Neekhara et al., 2019] Paarth Neekhara, Shehzeen Hussain, Prakhar Pandey, Shlomo Dubnov, Julian McAuley, and Farinaz Koushanfar. Universal adversarial perturba- tions for speech recognition systems. arXiv preprint arXiv:1905.03828, 2019.","title":"Universal adversarial perturbations for speech recognition systems","authors":"Neekhara","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Qin et al., 2019] Yao Qin, Nicholas Carlini, Ian Goodfel- low, Garrison Cottrell, and Colin Raffel. Imperceptible, robust, and targeted adversarial examples for automatic speech recognition. arXiv preprint arXiv:1903.10346, 2019.","title":"Imperceptible, robust, and targeted adversarial examples for automatic speech recognition","authors":"Nicholas Yao Qin, Ian Carlini, Garrison Goodfellow, Colin Cottrell, Raffel","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Ross et al., 2011] Stéphane Ross, Geoffrey Gordon, and Drew Bagnell. A reduction of imitation learning and struc- tured prediction to no-regret online learning. In Proceed- ings of the fourteenth international conference on artificial intelligence and statistics, pages 627-635, 2011.","title":"A reduction of imitation learning and structured prediction to no-regret online learning","authors":"Stéphane Ross, Geoffrey Gordon, Drew Bagnell","year":"2011","venue":"Proceedings of the fourteenth international conference on artificial intelligence and statistics","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Sainath and Parada, 2015] Tara Sainath and Carolina Parada. Convolutional neural networks for small-footprint keyword spotting. 2015.","title":"Convolutional neural networks for small-footprint keyword spotting","authors":"Parada Sainath, Tara Sainath, Carolina Parada","year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Schönherr et al., 2018] Lea Schönherr, Katharina Kohls, Steffen Zeiler, Thorsten Holz, and Dorothea Kolossa. Adversarial attacks against automatic speech recogni- tion systems via psychoacoustic hiding. arXiv preprint arXiv:1808.05665, 2018.","title":"Adversarial attacks against automatic speech recognition systems via psychoacoustic hiding","authors":"Lea Schönherr, Katharina Kohls, Steffen Zeiler, Thorsten Holz, Dorothea Kolossa","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Storn and Price, 1997] Rainer Storn and Kenneth Price. Differential evolution-a simple and efficient heuristic for global optimization over continuous spaces. Journal of global optimization, 11(4):341-359, 1997.","title":"Differential evolution-a simple and efficient heuristic for global optimization over continuous spaces","authors":"Price ; Storn, Rainer Storn, Kenneth Price","year":"1997","venue":"Journal of global optimization","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Su et al., 2019] Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computa- tion, 2019.","title":"One pixel attack for fooling deep neural networks","authors":"Jiawei Su, Danilo Vasconcellos Vargas, Kouichi Sakurai","year":"2019","venue":"IEEE Transactions on Evolutionary Computation","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Sutton et al., 1998] Richard S Sutton, Andrew G Barto, et al. Introduction to reinforcement learning, volume 135. MIT press Cambridge, 1998.","title":"Introduction to reinforcement learning","authors":"Andrew G Richard S Sutton, Barto","year":"1998","venue":null,"doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Szegedy et al., 2013] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Warden, 2018] Pete Warden. Speech commands: A dataset for limited-vocabulary speech recognition. arXiv preprint arXiv:1804.03209, 2018.","title":"Pete Warden. Speech commands: A dataset for limited-vocabulary speech recognition","authors":"Warden","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Yakura and Sakuma, 2018] Hiromu Yakura and Jun Sakuma. Robust audio adversarial example for a physical attack. arXiv preprint arXiv:1810.11793, 2018.","title":"Hiromu Yakura and Jun Sakuma. Robust audio adversarial example for a physical attack","authors":"Sakuma Yakura","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}