# data[].attributes.body
1. Further investigation for the mechanism about the malicious examples. Although previous researches [1], [2] and [3] indicated the linear perturbation can mislead deep learning models, but there is not yet a certain relationship between adversarial examples and specific models has been discovered.

2. Make deep learning models explainable. This kind of research may help explaining why a malicious example can gained some important weights to be misclassified. Some methods such as LIME[6] , DeepLIFT[7] and SHAP[8] has been proposed.

3. Apply Immune-inspired algorithms. Theoretically Immune-inspired algorithms can more likely reach the global optimum than traditional gradient descent. But it is suffered by huge searching space. Improve those kind of algorithms or invent variants may improve model's robustness.

# data[].attributes.attachment_link.title
Lessons Learned from Evaluating the Robustness of Defenses to Adversarial Examples

# data[].attributes.attachment_link.title
Attacking Machine Learning: On the Security and Privacy of Neural Networks

# data[].attributes.body
1. Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013.

2. Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014.

3. Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation , 23(5):828–841, 2019.

4. Dhillon, G.S., Azizzadenesheli, K., Lipton, Z.C., Bernstein, J., Kossaifi, J., Khanna, A. and Anandkumar, A., 2018. Stochastic activation pruning for robust adversarial defense. arXiv preprint arXiv:1803.01442.

5. Buckman, J., Roy, A., Raffel, C. and Goodfellow, I., 2018, February. Thermometer encoding: One hot way to resist adversarial examples. In International Conference on Learning Representations.

6. Ribeiro, M.T., Singh, S. and Guestrin, C., 2016, August. " Why should i trust you?" Explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining (pp. 1135-1144).

7. Shrikumar, A., Greenside, P. and Kundaje, A., 2017, July. Learning important features through propagating activation differences. In International Conference on Machine Learning (pp. 3145-3153). PMLR.

8. Lundberg, S.M. and Lee, S.I., 2017, December. A unified approach to interpreting model predictions. In Proceedings of the 31st international conference on neural information processing systems (pp. 4768-4777).

# data[].attributes.headline
How and why can adversarial examples attack deep learning models? 

# data[].attributes.subject
How and why can adversarial examples attack deep learning models? 

# data[].attributes.body
Szegedy et al. [1] demonstrated two counter-intuitive
properties of the deep convolutional neural network(CNN) that can cause misclassification.

Ian J. Goodfellow et al. [2] made a further discussion and gave hypotheses to explain why the adversarial example can fool the model and indicated that rubbish class examples are ubiquitous and easily generated.

JiaWei Su et al. [3]  proposed their novel method to generate one-pixel adversarial perturbations based on differential evolution (DE).

# data[].attributes.body
The widespread applications of machine learning based artificial intelligence reach all the corners around our life. Helping us, affecting us in diverse domains such as Autonomous Driving, Healthcare etc.

Are they trustworthy, robust enough? Consider auto-pilot only, let’s trace back to 01/07/2015, a Google auto-pilot caused a rear-end collision. On 14/02/2016, also google, its auto-pilot smashed to a bus. Further more, on 18/03/2018, An Uber auto-pilot knocked a women down in Arizona, it was the first auto-pilot road kill accident.

I believe AI will be more widely applied in the future. Our posterity may have to face messy situation if the robustness of machine learning,  the core technique of AI hasn't been improved. As a father and a research, I strongly wish to contribute myself into this area.

# data[].attributes.body
Dhillon et al. [4] proposed Stochastic Activation Pruning(SAP) to improve model's robustness against attacks.

Jacob Buckman et al. [5] proposed a simple modification to standard neural network architectures, thermometer encoding, which significantly increases the robustness
of the network to adversarial examples in 2018.

# data[].attributes.attachment_link.title
Artificial Immune Systems - Computerphile