{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/the-limitations-of-deep-learning-in","title":"The Limitations of Deep Learning in Adversarial Settings","arxiv_id":"1511.07528","date":"2015-11-24","proceeding":null,"authors":["Nicolas Papernot","Patrick McDaniel","Somesh Jha","Matt Fredrikson","Z. Berkay Celik","Ananthram Swami"],"abstract":"Deep learning takes advantage of large datasets and computationally efficient\ntraining algorithms to outperform other approaches at various machine learning\ntasks. However, imperfections in the training phase of deep neural networks\nmake them vulnerable to adversarial samples: inputs crafted by adversaries with\nthe intent of causing deep neural networks to misclassify. In this work, we\nformalize the space of adversaries against deep neural networks (DNNs) and\nintroduce a novel class of algorithms to craft adversarial samples based on a\nprecise understanding of the mapping between inputs and outputs of DNNs. In an\napplication to computer vision, we show that our algorithms can reliably\nproduce samples correctly classified by human subjects but misclassified in\nspecific targets by a DNN with a 97% adversarial success rate while only\nmodifying on average 4.02% of the input features per sample. We then evaluate\nthe vulnerability of different sample classes to adversarial perturbations by\ndefining a hardness measure. Finally, we describe preliminary work outlining\ndefenses against adversarial samples by defining a predictive measure of\ndistance between a benign input and a target classification.","url_abs":"http://arxiv.org/abs/1511.07528v1","url_pdf":"http://arxiv.org/pdf/1511.07528v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"the-limitations-of-deep-learning-in","repo_url":"https://github.com/AngusG/cleverhans-attacking-bnns","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"the-limitations-of-deep-learning-in","repo_url":"https://github.com/HowToMakeABomb101/Hot2MakeAB0mbSite","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"the-limitations-of-deep-learning-in","repo_url":"https://github.com/cleverhans-lab/cleverhans","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"the-limitations-of-deep-learning-in","repo_url":"https://github.com/elites2k19/prism-attack","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"the-limitations-of-deep-learning-in","repo_url":"https://github.com/formal-verification-research/NJSMA","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"the-limitations-of-deep-learning-in","repo_url":"https://github.com/iirishikaii/cleverhans","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"the-limitations-of-deep-learning-in","repo_url":"https://github.com/johnsonkee/graduate_design","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"the-limitations-of-deep-learning-in","repo_url":"https://github.com/openai/cleverhans","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}},{"paper_slug":"the-limitations-of-deep-learning-in","repo_url":"https://github.com/shijiel2/cleverhans","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":null},{"paper_slug":"the-limitations-of-deep-learning-in","repo_url":"https://github.com/tensorflow/cleverhans","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"the-limitations-of-deep-learning-in","repo_url":"https://github.com/yaq007/cleverhans","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"},{"task_slug":"adversarial-defense","task_name":"Adversarial Defense"},{"task_slug":"deep-learning","task_name":"Deep Learning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1511.07528","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}