# Review of Artificial Intelligence Adversarial Attack and Defense Technologies
## 1 Introduction  
The applications of artificial intelligence technologies in various fields have been rapidly developed recently. Due to high performance, high availability and high intelligence, artificial intelligence technologies have been applied in image classification, object detection, voice control, machine translation and more advanced fields, such as drug composition analysis [1], brain circuit reconstruction [2], particle accelerator data analysis [3, 4], and DNA mutation impact analysis [5]. Since [PERSON] et al. [6] proposed that neural networks are vulnerable to adversarial attacks, the research on artificial intelligence adversarial technologies has gradually become a hotspot, and researchers have constantly proposed new adversarial attack methods and defense methods. According to the different stages of the target model, the adversarial attacks can be divided into three categories: attacks in the training stage, attacks in the testing stage and attacks in the model deployment stage. Since the attack methods in the model deployment stage are very similar to the methods in the testing stage, for the sake of simplicity, this paper only discusses the attacks in the training stage and attacks in the testing stage. The training stage adversarial attacks refer to the fact that, in the training stage of the target model, the adversaries carry out attacks by modifying the training dataset, manipulating input features or data labels. [PERSON] et al. [7] changed the original distribution of the training dataset by modifying or deleting training data, which belongs to modifying the training dataset. The method of manipulating labels is shown in the work of [PERSON] et al. [8], and they reduced the performance of the Support VectorMachine (SVM) classifier by randomly flipping 40% of training labels. In the works of [PERSON] et al. [9; 10], [PERSON] et al. [11; 12] and [PERSON] et al. [13], the adversaries injected malicious data generated carefully into the training dataset to change the decision boundary, which can be divided into manipulating input features. The testing stage adversarial attacks can be divided into white-box attacks and black-box attacks. In white-box scenarios, the adversaries have access to the parameter, algorithms, and structure of the target model. Adversaries can construct adversarial samples to carry out attacks by utilizing this knowledge. [PERSON] et al. [14] introduced an adversarial crafting framework, which can be divided into the direction sensitivity estimation step and perturbation selection step. On this basis, the researchers have proposed a variety of different attack methods. [PERSON] et al. [6] proposed a method called Large-BFGS (here, BFGS is the initial of four people names: [PERSON], [PERSON], [PERSON], [PERSON], [PERSON], [PERSON], and [PERSON]), to search for adversarial samples. [PERSON] et al. [15] proposed a Fast Gradient Sign method (FGSM) which calculates the gradient of the cost function relative to the inputs. [PERSON] et al. [16] proposed three variants of FGSM, named One-step Target Class method, Basic Iterative method, and Iterative Least-likely Class method, respectively. [PERSON] et al. [17] proposed a method to find a sensitivity direction by using the Jacobian matrix of the model. [PERSON] et al. [18] showed an attack method, which only changes one pixel in the image. [PERSON] et al. [19] proposed to compute a minimal norm adversarial perturbation for a given image in an iterative manner, to find the decision boundary closest to the normal sample and find the minimal adversarial samples across the boundary. [PERSON] et al. [20] proposed a method called HOUDINI, which deceives gradient-based machine learning algorithms. Instead, in the black-box scenarios, the adversaries cannot obtain information about the target model, but they can train a local substitute model by querying the target model, utilizing the transferability of adversarial samples or using a model inversion method. [PERSON] et al.