Signal Processing - November 2017 - 62

2014, he was a research intern with ABB Corporate Research,
Baden-Daettwil. His research interests include signal processing, machine learning, and computer vision.
Pascal Frossard (pascal.frossard@epfl.ch) received
the M.S. and Ph.D. degrees in electrical engineering
from the École Polytechnique Fédérale de Lausanne (EPFL),
Switzerland, in 1997 and 2000, respectively. From 2001 to
2003, he was a member of the research staff with the IBM T.J.
Watson Research Center, Yorktown Heights, New York, where
he was involved in media coding and streaming technologies.
Since 2003, he has been a faculty member at EPFL, where he
is currently the head of the Signal Processing Laboratory. His
research interests include signal processing on graphs and networks, image representation and coding, visual information
analysis, and machine learning.

[19] H. Larochelle, D. Erhan, A. Courville, J. Bergstra, and Y. Bengio, "An
empirical evaluation of deep architectures on problems with many factors of variation," in ACM Int. Conf. Machine Learning, 2007, pp. 473-480.
[20] M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, "Accessorize to a crime:
Real and stealthy attacks on state-of-the-art face recognition," in Proc. 2016 ACM
SIGSAC Conf. Computer and Communications Security, 2016, pp. 1528-1540.
[21] N Karianakis, J Dong, and S Soatto, "An empirical evaluation of current convolutional architectures ability to manage nuisance location and scale variability," in Proc.
IEEE Conf. Computer Vision and Pattern Recognition, 2016, pp. 4442-4451.
[22] S.-M. Moosavi-Dezfooli, A Fawzi, O Fawzi, and P Frossard, "Universal adversarial perturbations," in Proc. IEEE Conf. Computer Vision and Pattern Recognition,
2017.
[23] Y. Liu, X. Chen, C. Liu, and D. Song, "Delving into transferable adversarial examples and black-box attacks," arXiv Preprint, arXiv:1611.02770, 2016.
[24] N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. Berkay Celik, and A. Swami,
"Practical black-box attacks against deep learning systems using adversarial examples,"
arXiv Preprint, arXiv:1602.02697, 2016.
[25] D. Warde-Farley, I. Goodfellow, T. Hazan, G. Papandreou, and D. Tarlow,
"Adversarial perturbations of deep neural networks," in Perturbations, Optimization,
and Statistics. Cambridge, MA: MIT Press, 2016.
[26] S. Sabour, Y. Cao, F. Faghri, and D. J. Fleet, "Adversarial manipulation of deep
representations," in Proc. Int. Conf. Learning Representations, 2016.

References

[1] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and
R. Fergus, "Intriguing properties of neural networks," in Proc. Int. Conf.
Learning Representations, 2014.
[2] A Krizhevsky, I Sutskever, and G E Hinton, "Imagenet classification with
deep convolutional neural networks," in Proc. Advances in Neural Information
Processing Systems, 2012, pp. 1097-1105.
[3] A Nguyen, J Yosinski, and J Clune, "Deep neural networks are easily fooled:
High confidence predictions for unrecognizable images," in Proc. IEEE Conf.
Computer Vision and Pattern Recognition, 2015, pp. 427-436.
[4] G. Litjens, T. Kooi, B. Ehteshami Bejnordi, A. A. A. Setio, F. Ciompi, M.
Ghafoorian, J. A. W. M. van der Laak, B. van Ginneken and C. I. Sánchez, "A
survey on deep learning in medical image analysis," Med. Image Anal., vol. 42,
pp. 60-88, 2017.
[5] S-M Moosavi-Dezfooli, A Fawzi, and P Frossard, "Deepfool: A simple and
accurate method to fool deep neural networks," in Proc. IEEE Conf. Computer
Vision and Pattern Recognition, 2016, pp. 2574-2582.

[27] T. Tanay and L. Griffin, "A boundary tilting persepective on the phenomenon of
adversarial examples," arXiv Preprint, arXiv:1608.07690, 2016.
[28] A. Fawzi, S.-M. Moosavi-Dezfooli, P. Frossard, and S. Soatto, "Classification
regions of deep neural networks," arXiv Preprint, arXiv:1705.09552, 2017.
[29] B. Poole, S. Lahiri, M. Raghu, J. Sohl-Dickstein, and S. Ganguli, "Exponential
expressivity in deep neural networks through transient chaos," in Proc. Advances in
Neural Information Processing Systems Conf., 2016, pp. 3360-3368.
[30] S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, P. Frossard, and S. Soatto,
"Analysis of universal adversarial perturbations," arXiv Preprint, arXiv:1705.09554,
2017.
[31] S. Gu and L. Rigazio, "Towards deep neural network architectures robust to adversarial examples," arXiv Preprint, arXiv:1412.5068, 2014.
[32] U. Shaham, Y. Yamada, and S. Negahban, "Understanding adversarial training:
Increasing local stability of neural nets through robust optimization," arXiv Preprint,
arXiv:1511.05432, 2015.

[6] A. Fawzi and P. Frossard, "Manitest: Are classifiers really invariant?" in Proc.
British Machine Vision Conf., 2015, pp. 106.1-106.13.

[33] C. Caramanis, S. Mannor, and H. Xu, "Robust optimization in machine learning," in Optimization for Machine Learning, S. Suvrit, N. Sebastian, and W. J.
Stephen, Eds., Cambridge, MA: MIT Press, ch. 14, 2012.

[7] A. Fawzi and P. Frossard, "Measuring the effect of nuisance variables on classifiers," in Proc. British Machine Vision Conf., 2016, pp. 137.1-137.12.

[34] H. Xu, C. Caramanis, and S. Mannor, "Robustness and regularization of support
vector machines," J. Machine Learning Res., vol. 10, pp. 1485-1510, July 2009.

[8] A Fawzi, H Samulowitz, D Turaga, and P Frossard, "Adaptive data augmentation for image classification," in Proc. Int. Conf. Image Processing, 2016, pp.
3688-3692.

[35] G. Lanckriet, L. E. Ghaoui, C. Bhattacharyya, and M. I. Jordan, "A robust minimax approach to classification," J. Machine Learning Res., vol. 3, pp. 555-582, Dec.
2003.

[9] B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. Srndic, P. Laskov, G.
Giacinto, and F. Roli, "Evasion attacks against machine learning at test time," in
Proc. Joint European Conf. Machine Learning and Knowledge Discovery in
Databases, 2013, pp. 387-402.

[36] C Bhattacharyya, "Robust classification of noisy data using second order cone
programming approach," in Proc. Intelligent Sensing and Information Processing
Conf., 2004, pp. 433-438.

[10] A. Fawzi, O. Fawzi, and P. Frossard, "Analysis of classifiers' robustness to
adversarial perturbations," Machine Learning, Aug. 2017. [Online]. Available:
https://doi.org/10.1007/s10994-017-5663-3
[11] I. J. Goodfellow, J. Shlens, and C. Szegedy, "Explaining and harnessing
adversarial examples," in Proc. Int. Conf. Learning Representations, 2015.
[12] A. Rozsa, E. M. Rudd, and T. E. Boult, "Adversarial diversity and hard positive generation," in Proc. IEEE Conf. Computer Vision and Pattern Recognition
Workshops, 2016, pp. 25-32.
[13] N. Carlini and D. Wagner, "Towards evaluating the robustness of neural networks," arXiv Preprint, arXiv:1608.04644, 2016.
[14] S. Baluja and I. Fischer, "Adversarial transformation networks: Learning to
generate adversarial examples," arXiv Preprint, arXiv:1703.09387, 2017.
[15] Y Jia, E Shelhamer, J Donahue, S Karayev, J Long, R Girshick, S
Guadarrama, and T Darrell, "Caffe: Convolutional architecture for fast feature
embedding," in Proc. ACM Int. Conf. Multimedia, 2014, pp. 675-678.
[16] C. Szegedy, W. Liu, Y. Jia, P. Sermanet, S. Reed, D. Anguelov, D. Erhan, V.
Vanhoucke, and A. Rabinovich, "Going deeper with convolutions," in Proc. IEEE
Conf. Computer Vision and Pattern Recognition, 2015.
[17] O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A.
Karpathy, A. Khosla, M. Bernstein, A. Berg, and L. Fei-Fei, "Imagenet large
scale visual recognition challenge," Int. J. Computer Vision, vol. 115, no. 3, pp.
211-252, 2015.
[18] A Fawzi, S. Moosavi-Dezfooli, and P. Frossard, "Robustness of classifiers:
from adversarial to random noise," in Proc. Neural Information Processing
Systems Conf., 2016, pp. 1632-1640.

62

[37] T. B. Trafalis and R. C. Gilbert, "Robust support vector machines for classification
and computational issues," Optim. Methods Software, vol. 22, no. 1, pp. 187-198, 2007.
[38] N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, "Distillation as a defense
to adversarial perturbations against deep neural networks," in Proc. 2016 IEEE Symp.
Security and Privacy, 2016, pp. 582-597.
[39] G. Hinton, O. Vinyals, and J. Dean, "Distilling the knowledge in a neural network," arXiv Preprint, arXiv:1503.02531, 2015.
[40] N. Carlini and D. Wagner, "Defensive distillation is not robust to adversarial
examples," arXiv Preprint, arXiv:1607.04311, 2016.
[41] A. A. Alemi, I. Fischer, J. V. Dillon, and K. Murphy, "Deep variational information bottleneck," arXiv Preprint, arXiv:1612.00410, 2016.
[42] J. H. Metzen, T. Genewein, V. Fischer, and B. Bischoff, "On detecting adversarial
perturbations," arXiv Preprint, arXiv:1702.04267, 2017.
[43] R. Feinman, R. R. Curtin, S. Shintre, and A. B. Gardner, "Detecting adversarial
samples from artifacts," arXiv Preprint, arXiv:1703.00410, 2017.
[44] J. Lu, T. Issaranon, and D. Forsyth, "Safetynet: Detecting and rejecting adversarial
examples robustly," arXiv Preprint, arXiv:1704.00103, 2017.
[45] M. Jaderberg, K. Simonyan, and A. Zisserman, "Spatial transformer networks," in
Proc. Advances in Neural Information Processing Systems Conf., 2015, pp. 2017-2025.
[46] A. Nayebi and S. Ganguli, "Biologically inspired protection of deep networks
from adversarial attacks," arXiv Preprint, arXiv:1703.09202, 2017.
[47] M. Cisse, A Courville, P. Bojanowski, and E. Grave, Y. Dauphin, and N. Usunier
"Parseval networks: Improving robustness to adversarial examples," in Proc. Int. Conf.
Machine Learning, 2017, pp. 854-863.

SP



IEEE SIGNAL PROCESSING MAGAZINE

|

November 2017

|
https://www.doi.org/10.1007/s10994-017-5663-3
Table of Contents for the Digital Edition of Signal Processing - November 2017
