# Review of Artificial Intelligence Adversarial Attack and Defense Technologies
## 4 Adversarial Attack Applications
### Computer Vision
#### 4.1.2 Semantic Image Segmentation and Object Detection
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Articles** & **Methods** & **Main Ideas** \\ \hline [PERSON] et al. [6] & L-BFGS & using L-BFGS algorithm to optimize the objective equation \(\arg\min f\left(x+r\right)=l\ s.t.\ \ \ \left(x+r\right)\in D\). \\ [PERSON] et al. [15] & FGSM & FGSM is used to calculate the gradient of the cost function relative to the input of the neural network, calculate Formula (4) to get adversarial samples and lead the target model to achieve 89.4\% misclassification on the MNIST dataset. \\ [PERSON] et al. [16] & One-Step Target Class & Calculating the Formula (5) to get adversarial samples. \\ [PERSON] et al. [16] & BIM & The adversarial samples generated by FGSM are used in each iteration to generate final adversarial samples by small step length iteration. \\ [PERSON] et al. [16] & ILCM & Replacing the target label in the BIM method with the most unlikely labels predicted by the classifier. \\ [PERSON] et al. [17] & JSMA & Directly providing the gradient of the output component to each input component, and the resulted knowledge is used in complex saliency map methods to generate adversarial samples. \\ [PERSON] et al. [18] & One Pixel & Only modifying one pixel per image to generate adversarial samples. \\ [PERSON] et al. [24] & [PERSON] \& [PERSON] & Limiting the \(l_{0}\) norm, \(l_{2}\) norm and \(l_{\infty}\) norm of the perturbations. \\ [PERSON] et al. [19] & DeepFool & Calculating the minimum norm adversarial perturbation iterative method. \\ [PERSON] et al. [64] & Universal perturbation & Generating image independent general adversarial perturbation for many different models. \\ [PERSON] et al. [65] & UPSET & Universal Perturbations for Steering to Exact Targets (UPSET) introduced residual generation network, whose input is target class \(t\) and output is image unknown disturbance \(R(t)\). \\ [PERSON] et al. [65] & ANGRI & Antagonistic Network for Generating Rogue Images (ANGRI) calculated image detail perturbation in a closely related way. \\ [PERSON] et al. [20] & HOUDINI & Deveiving the gradient-based learning machine by generating adversarial samples that can be customized for task loss. \\ [PERSON] et al. [66] & ANTs & The Adversarial Transformation Networks (ATNs) used a feed-forward neural network to generate adversarial samples. \\ [PERSON] et al. [25] & ZOO & Using the zero-order (ZOO) random coordinate descent method combined with dimensionality reduction, hierarchical attack, and importance sampling technique to carry out black-box attacks effectively. \\ [PERSON] et al. [67] & variant of NES & The variant of Natural Evolution Strategies (NES) Proposing the adversarial sample generation method under query limit setting, partial information setting and label only setting respectively. \\ [PERSON] et al. [68] & Active learning & Using the white-box attack method to generate samples for queries, and introducing an active learning strategy to significantly reduce the number of queries required. \\ [PERSON] et al. [69] & GAN-based & Using GAN to generate adversarial noise and classify the individual image. \\ [PERSON] et al. [26] & Momentum & Proposing an iterative algorithm based on momentum to enhance the success rate of adversarial attack. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Applications of adversarial attack in image classification field. [PERSON] et al. [27] proposed a method to characterize adversarial samples based on spatial background information in semantic segmentation. They pointed out that semantic segmentation requires additional components, such as extended convolution and multiscale processing. They observed that, even though powerful adaptive adversaries can access models and detection strategies, we can use spatial consistency information to effectively detect adversarial samples. The authors demonstrated that the adversarial samples based on the attacks considered in this article [27] hardly move from model to model. [PERSON] et al.