NIPS 2017: Adversarial Learning Development Set (ImageNet-NIPS)

Most existing machine learning classifiers are highly vulnerable to adversarial examples. An adversarial example is a sample of input data which has been modified very slightly in a way that is intended to cause a machine learning classifier to misclassify it. In many cases, these modifications can be so subtle that a human observer does not even notice the modification at all, yet the classifier still makes a mistake.Adversarial examples pose security concerns because they could be used to perform an attack on machine learning systems, even if the adversary has no access to the underlying model.To accelerate research on adversarial examples, Google Brain is organizing Competition on Adversarial Examples and Defenses within the NIPS 2017 competition track. This dataset contains the development images for this competition.The competition on Adversarial Examples and Defenses consist of three sub-competitions:Non-targeted Adversarial Attack. The goal of the non-targeted attack is to slightly modify source image in a way that image will be classified incorrectly by generally unknown machine learning classifier.Targeted Adversarial Attack. The goal of the targeted attack is to slightly modify source image in a way that image will be classified as specified target class by generally unknown machine learning classifier.Defense Against Adversarial Attack. The goal of the defense is to build machine learning classifier which is robust to adversarial example, i.e. can classify adversarial images correctly.In each of the sub-competitions you're invited to make and submit a program which solves the corresponding task. In the end of the competition we will run all attacks against all defenses to evaluate how each of the attacks performs against each of the defenses.

当前绝大多数机器学习分类器均极易受对抗样本（adversarial examples）的影响。对抗样本指经过微小修改的输入数据样本，其修改目的是诱使机器学习分类器对其做出错误分类。在多数场景下，这类修改极为细微，人类观察者甚至完全无法察觉，但分类器仍会产生分类错误。对抗样本存在安全风险：即便攻击者无法访问目标机器学习系统的底层模型，仍可利用其发起针对该系统的攻击。

为推动对抗样本领域的研究发展，谷歌大脑（Google Brain）在2017年神经信息处理系统大会（NIPS 2017）的竞赛赛道中，举办了对抗样本与防御竞赛（Competition on Adversarial Examples and Defenses）。本数据集即为该竞赛的开发集图像。

本次对抗样本与防御竞赛共设三项子竞赛：
1. 非目标对抗攻击（Non-targeted Adversarial Attack）：该任务的目标为对源图像进行微小修改，使未知的通用机器学习分类器将修改后的图像错误分类。
2. 目标对抗攻击（Targeted Adversarial Attack）：该任务的目标为对源图像进行微小修改，使未知的通用机器学习分类器将修改后的图像归类至指定的目标类别。
3. 对抗攻击防御（Defense Against Adversarial Attack）：该任务的目标为构建具备对抗样本鲁棒性的机器学习分类器，即能够对对抗图像做出正确分类的分类器。

各子竞赛均邀请参赛者开发并提交可完成对应任务的程序。竞赛尾声阶段，组委会将使用所有攻击方案对所有防御方案进行测试，以评估各攻击方案针对各防御方案的实际攻击效果。

搜集汇总

背景与挑战

背景概述

该数据集是NIPS 2017竞赛中用于对抗学习研究的开发集，专注于对抗样本的生成与防御。它包含三个子任务：非定向对抗攻击、定向对抗攻击和对抗攻击防御，旨在评估机器学习模型在对抗性环境下的脆弱性和鲁棒性。数据集由Google Brain组织，适用于计算机视觉领域的研究，但需通过IEEE DataPort订阅访问。