2019 IEEE 31st International Conference on Tools with Artificial Intelligence (ICTAI)

High-speed Rail Operating Environment
Recognition Based on Neural Network andAdversarial Training
Xiaoxue Hou∗ , Jie An∗ , Miaomiao Zhang∗§ , Bowen Du†§ , Jing Liu‡§∗ School of Software Engineering, Tongji University, Shanghai, China† Department of Computer Science, University of Warwick, Coventry, England‡ School of Software Engineering, East China Normal University, Shanghai, China

orous development, which is particularly important to thediagnosis and treatment of high-speed rail failures. However,different high-speed rail faults have different discriminationand treatment methods in different operating environments [4].
Take the arc detection in pantograph-catenary system as an
example [5]. The light brightness has obvious affect on thearc detection, and in many arc detecting methods, we always
have to distinguish the operating environemnt before detecting
the magnitudes of arc. At present, only a few high-speed railsystems are equipped with environmental sensors to monitor
the operating environment, most of them do not have sensor
devices [6]. And environmental sensors often fail. In actual
work, this task is mainly fulﬁlled by the staff playing back themonitoring video to manually recognize the environment basedon their observations and experiences. This kind of diagnosis
is not rigorous since it is not continuous in time and space, andthere are some hidden dangers to make mistakes. Therefore,
creating a non-contact method to recognize the high-speed rail
operating environment automatically is of vital importance.
Here is the structure of this paper. In section II, we summarize the related researches of convolutional neural networks,
adversarial examples and their defense methods, to lead ourapproach. And then in section III, we build dataset from monitoring videos of the high-speed rail operating environment tosupport the task. Next in section IV, we train several neuralnetwork models and choose one with best prediction accuracy
to do the recognition. In section V, to improve the security ofthe model we obtained before, we perform adversarial attacks
and adversarial training. In section VI, we give summary,limitations and future work of our research, and ﬁnally wegive conclusion in section VII.

Abstract—Neural network is one of the key technologies fordeep learning. Experiments on some standard test datasets showthat their recognition ability has reached the level of humanbeings. However, they are extremely vulnerable to adversarial
examples, that is, adding some subtle perturbations to the input
example can cause the model to give a wrong output with highconﬁdence. In this paper, we propose a non-contact approachbased on neural network and adversarial training to recognize
the high-speed rail operating environment. We ﬁrst built theenvironment dataset and trained neural network models to do
the recognition. We found that our model had high prediction
accuracy, but with poor security since it was easy to attack
our model using Basic Iterative Methods (BIM). To improve
its security, we performed adversarial training based on theadversarial training dataset we built. The evaluation experiments
indicated that this approach could improve the security of ourmodel at the same time ensuring the prediction accuracy on theoriginal test dataset.
Index Terms—Recognition, Neural network, Adversarial attack, Defense

I. I NTRODUCTION
Neural network is one of the deep learning algorithms [1]. It
mimics the structure and operation mechanism of biologicalneural network. In the past ten years, the research work ofneural networks has been deepened, and great progress has
been made. Neural network has successfully solved many
practical problems in the areas of pattern recognition, intelligent robotics, automatic control, predictive estimation,
biology, medicine and economy [2].
However, when neural network distinguishes adversarial
examples, the effect is extremely unstable. Just deliberately
adding some subtle perturbations to the input example thatis undetectable by humans can cause the model to give awrong output with high conﬁdence [3]. Therefore, it is of greatsigniﬁcance to further study the reasons for the adversarial
examples and defense methods of them.
In this paper, we focus on the task of high-speed rail
operating environment recognition. Nowadays, Chinese highspeed rail construction industry has entered a period of vig-

II. S TATE O F T HE A RT
Deep learning [7] is a method based on characterizing
and learning data which uses unsupervised or semi-supervised
feature learning and hierarchical feature extraction algorithms
instead of manual extraction to get features. The goal of characterization learning is to ﬁnd better representations and create
better models to learn these representations from large-scale
unlabeled data. The expression is similar with the advancement

Supported by NSFC 61472279, 61972284, 61972150, 61572195.
§ Corresponding authors: miaomiao@tongji.edu.cn, B.Du@warwick.ac.uk,
jliu@sei.ecnu.edu.cn

2375-0197/19/$31.00 ©2019 IEEE
DOI 10.1109/ICTAI.2019.00120

840

of neuroscience [8]. So far there have been several deep learning frameworks, such as deep neural networks, convolutional
neural networks and deep belief networks as well as recurrent
neural networks, which have been successfully applied in theﬁelds of computer vision, speech recognition, natural language
processing, audio recognition and bioinformatics [9]–[12].
The concept of adversarial examples was ﬁrst proposed by
Christian Szegedy et al. in 2013 [3], he pointed out that whendeliberately adding some subtle perturbations on the input
example which were noticed by humans could cause the model
to give a wrong output with high conﬁdence.
Goodfellow et al. [13] explained that the reason why it is
difﬁcult for neural networks to resist against disturbances isthe linear characteristics of neural networks, and they designed
Fast Gradient Sign Method (FGSM) to quickly generate adversarial examples, which conﬁrms the high-dimensional linearityof the design of modern deep neural networks. FGSM is acommon white-box attack method with a very simple idea.
It mainly uses the loss function of the model to obtain theadversarial perturbation for the input gradient, and then adds
it to the input to generate adversarial examples. We deﬁne anadversarial example x̃ of an input x as x̃ = x + η, where η isdeﬁned as:  η ∞ ≤ , and  is required to be small enoughto be discarded by the neural network model. We consider
the dot product between a weight vector ω and an adversarial
example x̃ as:ω T x̃ = ω T x + ω T η

Adversarial training is a way to deal with adversarial
examples. The network’s robustness is gradually improved bycontinuously entering new types of adversarial examples andperforming adversarial training. In order to ensure effectiveness, this method requires the use of high-intensity adversarial
examples, and the network architecture must have sufﬁcient
expressive power. This method requires a large amount oftraining data and thus it is called brute force adversarial
training. This brute force adversarial training can regularize
the network to reduce overﬁtting [15].
Image denoising [16] is a way to remove the noise exists in
the image and restore the image to make the classiﬁer give a
correct prediction output. There are some traditional denoising
methods include median ﬁlter and BM3D, and also we can use
neural networks to denoise.
Image compression is used to reduce the redundant information of the image while maintaining the signiﬁcant
information, since there is a strong similarity and correlation
between adjacent pixels in the local structure of image. Dziugaite et al. [17] used JPG image compression to reduce theimpact of adversarial perturbations to improve the prediction
accuracy. This method is effective for some part of the attack
methods, but also reduces the accuracy of original inputs while
compressing images.
There are also some other defense methods, and the research
direction of defense methods is full of controversy and changes
with each passing day.

(1)

III. DATASET B UILDING AND DATA P REPROCESSING

As can be seen from equation 1, a small adversarial perturbation can signiﬁcantly increase the output of neurons.
Goodfellow pointed out that if the amount of change in theadversarial perturbation was exactly the same as the directionof the gradient, then there would be a maximal change inthe classiﬁcation results. We assume that the dimension of theweight vector is n and the mean of the weight vector is m, thenthe maximum value of ω T η is mn. And now η = sign(ω),
in which sign function guarantees the amount of change in
the adversarial perturbation is the same as the direction of thegradient.
We consider that θ is the parameter of a model, y is thetarget with input x, and J(θ, x, y) is the loss of the neuralnetwork, so the max-norm perturbation is given as equation 2,
which is also the deﬁnition of the fast gradient sign method:η = sign(∇x J(θ, x, y))

Our original data source is the monitoring video of the highspeed rail operating environment in the areas of Chinese Jinan
and Chongqing. This video covers a variety of topographicalfeatures, shooting angles, vehicle types, time periods andweather conditions. We transferred the video into images with
224×224 pixels. Through the analysis of the video and the
key factors in the recognition of the high-speed rail operating
environment, we divided the original dataset into 6 categories
according to four indicators, as indicated in table I, which arewhether daytime, whether foggy, whether rainy and whether
in the tunnel with the labels of 0, 1, 2, 3, 4 and 5.
TABLE I: Classiﬁcation Basis(2)

The one-step method performs image perturbation by increasing the loss function of the classiﬁer by a large-scale
operation [14], and it can be directly extended to increase thevariation of the loss function through multiple small steps, sothat we get Basic Iterative Methods (BIM).
Recently more and more researchers start to study the defense of adversarial examples. Although people’s understanding of adversarial examples has been improved, the related
defense methods also have been improved, but so far, there isno universal and complete solution.

Indicator

Daytime

Foggy

Rainy

In the Tunnel

0

Y

Y

N

N

1

Y

N

N

N

2

Y

N

Y

N

3

N

N

N

N

4

N

N

Y

N

5

N

N

N

Y

Actually in the monitoring videos there are also many otherindicators, for example, the vehicle types include 380A and
380D. However, these kinds of indicators are less important to
the recognition since we can take similar actions to deal withdifferent problems happened with different vehicle types. The

841

indicators we choose are based on weather recognition, time
period recognition and speciﬁc cases recognition.
The weather conditions our videos include are foggy, rainy
and sunny, which will affect the air humindity, light intensity
and whether to enable the emergency mode [18]. Environmental sensor is another choice to recognize them, while it is veryfragile in harsh environments, and also expensive to install. In
this case the weather recognition is an important part of highspeed rail operating environment recognition. The time periods
in our videos include daytime, dusk and night. Consideringthat in the daytime and dusk the light is much brighter than
it is at night, we only take daytime and night to category
images, so the images in the dusk are also categoried as in
the daytime. As for speciﬁc cases, we only consider whether
it is in the tunnel, since the monitoring screen overexposureswhen the rail enters and leaves the tunnel, which should be
excluded from the normal analysis.
According to the analysis above, we get the dataset with
30,000 images belonging to 6 categories. Figure 1 shows apart of images belonging to each of the six categories.
The division of the dataset plays a key role in neural network
training. It is a way to divide the dataset into training dataset
and test dataset [19], training dataset is for the training of
the model and test dataset is for the model evaluation ofgeneralization ability. However, there are also many hyperparameters inside the neural network that needs to be selectedmanually, such as the number of layers of the model and thenumber of neurons in each layer of the model. We have toadjust those hyper-parameters to get the model with better
generalization ability, and this is why we introduce validation
dataset. Goodfellow in his book [20] pointed out the training
dataset, validation dataset and test dataset could be divided ina ratio of 6:2:2 if the amount of the data was about 10,000,
since we have totally 30,000 images in our dataset, we gettraining dataset, validation dataset and test dataset separately
with 21600, 7200 and 7200 images.
The recognition task is regarded as a multi-classiﬁcation
problem. In this task, features are not continuous values,
but categorical values. Here we use numbers of (0, 1, 2, 3,4, 5) to separately represent the six categories, which will
greatly improve the computing efﬁciency. However, even afterconverting them to digital representations, the integer feature
representation cannot be directly used in the classiﬁer. Because
for such continuous input, the classiﬁer considers the classes
to be ordered, but actually they are unordered. We binarize theinteger labels so that they are regarded by the classiﬁer as avector from the euclidean space.
Normalization is another important part when we preprocess
the data. It is mainly for the speed of data processing,and it transfers dimensioned expressions into dimensionlessexpressions so that indicators of different units or magnitudes
can be compared and weighted. Since the range of image
pixels is between 0 and 255, we divide the image pixels by
255 to realize normalization.
Till now the dataset for the neural network model training
is ﬁnely prepared.

(a) Daytime Foggy(b) Daytime Sunny(c) Daytime Rainy(d) Night Sunny(e) Night Rainy(f) In the Tunnel

Fig. 1: Examples of Six Categories

IV. N EURAL N ETWORK M ODEL T RAINING
After building the dataset, we begin to train neural networkmodels to solve the recognition task. Convolutional neuralnetwork [21] is a kind of feedforward neural networks withconvolutional computation and deep structure. It is one of therepresentative algorithms of deep learning and has achievedvery good results in the ﬁelds of computer vision. So far there
has been many popular convolutional neural network models,such as LeNet, AlexNet, ZFNet, VGG-16 and ResNet [22].
LeNet [23], born in 1994, is one of the classic structuresof convolutional neural networks. It uses features such as

842

(a) Train Accuracy(c) Validation Accuracy(b) Train Loss(a) Train Accuracy(b) Train Loss(c) Validation Accuracy(d) Validation Loss(d) Validation Loss

Fig. 2: Results of LeNet Model

Fig. 3: Results of AlexNet Modelconvolution, parameter sharing and pooling to extract features,
avoiding a large amount of computational cost, and ﬁnally
applys fully connected neural networks for classiﬁcation andidentiﬁcation.
In 2012, Krizhevsky [24] used the convolutional neuralnetwork to win the ILSVRC 2012 image classiﬁcation contest
and proposed the AlexNet model, which spurred the wave ofneural network research with many innovative methods.
In this paper, we tried both LeNet model and AlexNet model
to train. We adopted Keras framework [25] with the versionof 2.2.4 to build our neural network models. Keras is a highly
modular neural network library supported by Google, whosebackend is based on Tensorﬂow and Theano. It is written in
Python and supports both GPU and CPU. The ﬁrst release of
Keras was in March 2015, and it is favored for the ease ofuse and simple syntax, making development faster [26].
After 20 epochs training, the precision accuracy and the loss
function of training and validation of LeNet model are shownon the Tensorboard in Figure 2. It shows that the prediction
accuracy of training and validation are both rising gradually,
and they ﬁnally close to 1, the loss function of training andvalidation are tending to convergence, which indicates that thetraining effect is stable.
And after 20 epochs training, the precision accuracy and theloss function of training and validation of AlexNet model are
shown on the Tensorboard in Figure 3.
In our experiments, we found that AlexNet model was overﬁtting on our dataset, since both the loss function curve andaccuracy function curve of validation have severe concussion,
which shows that the model has very poor stability. So in
this case, we choose LeNet model to solve the task. We
applied LeNet model for the prediction on the test dataset,and obtained the prediction accuracy of 0.9837, which showsthat the ﬁtting degree of the model is acceptable.
The LeNet model consists of two convolutional layers, two
maxpooling layers and two fully-connected layers. Figure 4
is the structure of our model, which shows the architecture,
input and output of layers.

Fig. 4: Structure of LeNet Model

843

The conv2d_1_input is the input layer, which provides theoriginal images with the input shape of 224×224×3 for themodel, that is, the pixels of the images are 224×224, and they
are color images with channel number of 3. The conv2d_1 isthe convolutional layer, and it has 32 kernels with the sizeof 5×5 and stride size of 1. Since the it does not use fullzero complement, the output size of this layer is 224-5+1=220,
with the depth of 32, that is 220×220×32. The total numberof parameters of this layer is 5×5×1×32×3+32=2432. The
maxpooling2d_1 is the down-sampling layer with pool sizeof 2×2 and the stride size of 2, so the output size of thislayer is 110×110×32. This layer uses the image principleof local correlation to subsample the images, which could
reduce the amount of data processing while retaining useful
information. The conv2d_2 is the convolutional layer with64 kernels, the size of them is 5×5 and the stride sizeis 1. It does not use full zero complement, neither. The
output size of this layer is 110-5+1=106, with depth of64, that is 106×106×64. The total number of parametersof this layer is 5×5×1×64×32+64=51264, 32 is the depthof the input. The layer maxpooling2d_2 is also the downsampling layer with pool size of 2×2 and stride of 2, so the
output size of this layer is 53×53×64. The ﬂatten_1 layer
ﬂattens all the nodes, so the output is 53×53×64=179776.
The ﬁrst fully-connected layer dense_1 has 100 nodes, so
the output size is 100 and the total number of parameters of
this layer is 179776×100+100=17977700. The output layer
dense_2 is also the fully-connected layer with 6 nodes, so
the output size is 6, and the total number of parameters of
this layer is 100×6+6=606. Total number of parameters is2432+51264+17977700+606=18032002.

TABLE II: Original images and their corresponding adversarial examples generated by FGSM and BIM method.

V. A DVERSARIAL ATTACKS AND A DVERSARIAL T RAINING

Fig. 5: Number of Adversarial Examples Compared With
Number of Original Images

NumberIn order to check the security of the LeNet model weobtained in the previous section, we apply adversarial attack
methods to attack the model. Actually there are many attack
methods, while considering the complexity of algorithms andour hardware devices, we take both BIM method and FGSM
method to attack the model, which are introduced in thesection I before.
There are two types of adversarial attack methods, that are
untargeted adversarial attacks and targeted adversarial attacks.
Untargeted adversarial attacks just want to confuse the model
to give a wrong output, while targeted adversarial attacks want
the model to give a wrong desired output. In this section, we
implement untargeted adversarial attacks since we just wantto confuse the model.
We set the iteration number as 50, and epsilon as 0.1,
which is the allowable ﬂuctuation range of the sample. We
conducted the experiments for many time and ﬁnally foundthese appropriate values, that is, we regarded the adversarial
examples and original images as the same category whenepsilon is 0.1.
As can be seen in table II, we take 12 sets of examples toshow in the paper, and each set contains the original image and

FGSM

Original ClassNew ClassConﬁdenceBIM
New ClassConﬁdence1030.62005836

3

0.9932944

2

1

50.6902759

50.7287956

31

00.63797605

00.7664373

41

50.39251974

50.44168004

5

1

5

0.8008037

50.8255589

62

00.6066581

00.8976936

7300.7571429

00.85842884

8

3

4

0.5396405

10.5554841

93

40.9026469

40.78059787

10

4

3

0.87523174

30.82832044

11

5

3

0.886363

30.831025

12

5

30.74626285

3

0.944448

adversarial examples generated by BIM method and FGSM
method. Speciﬁc images can be found in Appendix A.
The attack experiments on the test dataset show that almost
all of the adversarial examples created by BIM look very similar to the original examples, while there are some differences
between original examples and adversarial examples createdby FGSM, which proves that our model is vulnerable to theBIM method, and BIM method is more effective than FGSM
method on our model.
Figure 5 shows the number of adversarial examples generated by BIM in each category compared with the number oforiginal images. The attack success rate of BIM on our test
dataset is 5351/6000=0.89.
To improve the security of our model, we perform adversarial training.
Firstly, we built the adversarial example dataset, which ismade up of both original images and adversarial examples
generated by BIM method. We got 5351 adversarial examples
after using BIM method to attack our test dataset, with thenumber of each class as 705, 1147, 400, 904, 1200 and 995.

844

(a) Train Accuracy(b) Train Loss(c) Validation Accuracy(d) Validation Loss

under BIM attack. To improve the security of our model,
we applied adversarial training.
Since we already know that the deep learning models
are extremely vulnerable to adversarial examples, we want
to improve the security of our model. Security problem ofdeep learning is a hot topic, and there are many adversarial
attack methods which have very good effect to attack the
deep learning models, and then defense methods come behind.
However, there is no universal and complete solution. We
tried some experiments, and want to make a small researchcontribution to the defense of adversarial attacks.
There are mainly two aspects that restrict our experiments,and for each one we give future work.
1) Our hardware devices are not ideal enough. All of theexperiments in this paper were performed on the MacBook Pro with the processor of 2.9 GHz Intel Core i5,which limited the training speed of the neural network
to some extent. If we could apply GPU processor totrain neural network models, we would be able to train
far more than 20 epochs, maybe 500 epochs, so as toachieve higher prediction accuracy. In addition, better
processor makes it possible for us to do adversarial
training more times to continually improve the securityof our model.
2) Our dataset could be more abundant. The types ofenvironmental conditions that currently contained in ourdataset are relatively rich, but they are not enoughto cover all the weather and geographical conditions.
Especially in our dataset, the images in the categoryof daytime rainy are much simpler compared with theimages in other categories. In the future, if it is possible,
we will try for more monitoring videos of high-speed
rail operating environment, and then we could adjust theclassiﬁcation of the current dataset to get our research
approach applied.

Fig. 6: Results After Adversarial Training

We picked the original images with the same number in eachclass, and mixed them up, so in our adversarial example
dataset, we got 10702 images, with the ratio of orginal images
and adversarial examples as 1:1. The reason why we dont
directly use the adversarial examples, but adding original
images into the adversarial training dataset is that we want toimprove the security of the model at the same time ensuringthat the prediction accuracy of the model would not decline.
We split the adversarial dataset into adversarial training
dataset, adversarial validation dataset and adversarial test
dataset in a ratio of 6:2:2, the same as the model training
before, and performed adversarial training.
The predicion accuracy and the loss function of the adversarial training dataset and adversarial validation dataset are
shown on the Tensorboard in Figure 6. For the prediction
accuracy of the retained model, the value is 0.9992 on theoriginal test dataset, and is 0.9977 on the adversarial test
dataset. It shows that the retrained model has better security
without reducing the prediction accuracy on the original test
dataset compared with the previous model.

VII. C ONCLUSION
In this paper, we built a neural network model with highprediction accuracy and high security to deal with the taskof high-speed rail operating environment recognition. Firstly,
we established the dataset based on the monitoring video
during high-speed rail operation, and then we trained neuralnetwork models to solve the task. Secondly, we tried both
FGSM method and BIM method to attack the model wetrained before. The results of experiments indicated that BIM
method had better attacking effect on our model, so wecollected adversarial examples attacked by BIM method andbuilt dataset for adversarial training. Finally, we retrained
the model based on the adversarial training. The evaluation
experiment proves that the retrained model has higher security
without reducing the prediction accuracy on the original test
dataset compared with the previous model.
To sum up, this kind of non-contact approach based onneural network and adversarial training can be applied torecognize the high-speed rail operating environment. It isalso possible to extend our research results to more neural

VI. D ISCUSSION
In this paper, we build a neural network model with highprediction accuracy and high security to deal with the task ofhigh-speed rail operating environment recognition. Here wesummarize our work as follows:
1) Dataset Building
We built dataset containing 30,000 images within six
categories, and split the dataset into training dataset,validation dataset and test dataset.
2) Neural Network Model Training
We obtained a neural network model with high prediction accuracy to solve the task.
3) Adversarial Attacks and Adversarial Training
We applied adversarial attacks to check the securityof the model we trained before, and the results ofexperiments indicated that our model has poor security845

network systems that have higher security requirements, suchas automatic car driving, face recognition and medical health.

[22] Jiuxiang Gu, Zhenhua Wang, Jason Kuen, Lianyang Ma, Amir
Shahroudy, Bing Shuai, Ting Liu, Xingxing Wang, Gang Wang, Jianfei
Cai, et al. Recent advances in convolutional neural networks. Pattern
Recognition, 77:354–377, 2018.
[23] Yann LeCun et al. Lenet-5, convolutional neural networks. URL:
http://yann. lecun. com/exdb/lenet, 20, 2015.
[24] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet
classiﬁcation with deep convolutional neural networks. In Advancesin neural information processing systems, pages 1097–1105, 2012.
[25] Antonio Gulli and Sujit Pal. Deep Learning with Keras. Packt Publishing
Ltd, 2017.
[26] Nikhil Ketkar. Introduction to keras. In Deep Learning with Python,
pages 97–111. Springer, 2017.

R EFERENCES[1] Stuart J Russell and Peter Norvig. Artiﬁcial intelligence: a modern
approach. Malaysia; Pearson Education Limited„ 2016.
[2] Abidha Pandey, Manish Puri, and Aparna Varde. Object detection withneural models, deep learning and common sense to aid smart mobility.
In 2018 IEEE 30th International Conference on Tools with Artiﬁcial
Intelligence (ICTAI), pages 859–863. IEEE, 2018.
[3] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna,
Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing propertiesof neural networks. arXiv preprint arXiv:1312.6199, 2013.
[4] Zhiwei Han, Zhigang Liu, Guinan Zhang, and Hong-mei Yang.
Overview of non-contact image detection technology for pantographcatenary monitoring. Journal of the China Railway Society, 35(6):40–47,
2013.
[5] Shize Huang, Yachan Zhai, Miaomiao Zhang, and Xiaoxue Hou. Arc
detection and recognition in pantographcatenary system based on convolutional neural network. Information Sciences, 501:363 – 376, 2019.
[6] Ilhan Aydin, Selahattin B Celebi, Sami Barmada, and Mauro Tucci.
Fuzzy integral-based multi-sensor fusion for arc detection in the
pantograph-catenary system. Proceedings of the Institution of Mechanical Engineers, Part F: Journal of Rail and Rapid Transit, 232(1):159–
170, 2018.
[7] Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning.
nature, 521(7553):436, 2015.
[8] Frank Rosenblatt. The perceptron: a probabilistic model for information
storage and organization in the brain. Psychological review, 65(6):386,
1958.
[9] Geoffrey E Hinton, Simon Osindero, and Yee-Whye Teh. A fast learningalgorithm for deep belief nets. Neural computation, 18(7):1527–1554,
2006.
[10] Sholom M Weiss and Casimir A Kulikowski. Computer systems thatlearn: classiﬁcation and prediction methods from statistics, neural nets,
machine learning, and expert systems, volume 123. Morgan Kaufmann
San Mateo, CA, 1991.
[11] Priya Persaud, Aparna S Varde, and Stefan Robila. Enhancing autonomous vehicles with commonsense: Smart mobility in smart cities.
In 2017 IEEE 29th International Conference on Tools with Artiﬁcial
Intelligence (ICTAI), pages 1008–1012. IEEE, 2017.
[12] Salvatore Sorce, Vito Gentile, and Antonio Gentile. Real-time hand pose
recognition based on a neural network using microsoft kinect. In 2013
Eighth International Conference on Broadband and Wireless Computing,Communication and Applications, pages 344–350. IEEE, 2013.
[13] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining
and harnessing adversarial examples. arXiv preprint arXiv:1412.6572,
2014.
[14] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial
examples in the physical world. arXiv preprint arXiv:1607.02533, 2016.
[15] Yaroslav Ganin, Evgeniya Ustinova, Hana Ajakan, Pascal Germain,
Hugo Larochelle, François Laviolette, Mario Marchand, and Victor
Lempitsky. Domain-adversarial training of neural networks. The Journalof Machine Learning Research, 17(1):2096–2030, 2016.
[16] Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deeplearning in computer vision: A survey. IEEE Access, 6:14410–14430,
2018.
[17] Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M Roy. A
study of the effect of jpg compression on adversarial images. arXiv
preprint arXiv:1608.00853, 2016.
[18] Regina Ruby Lee Clewlow. The climate impacts of high-speed rail
and air transportation: a global comparative analysis. PhD thesis,
Massachusetts Institute of Technology, 2012.
[19] Aurélien Géron. Hands-on machine learning with Scikit-Learn andTensorFlow: concepts, tools, and techniques to build intelligent systems.
" O’Reilly Media, Inc.", 2017.
[20] Ian Goodfellow, Yoshua Bengio, and Aaron Courville. Deep learning.
MIT press, 2016.
[21] Yann LeCun, Yoshua Bengio, et al. Convolutional networks for images,
speech, and time series. The handbook of brain theory and neuralnetworks, 3361(10):1995, 1995.

846

A PPENDIX A
A DVERSARIAL EXAMPLES GENERATED BY BIM, FGSM AND THEIR ORIGINAL IMAGES

847