Skip to Content

AI Fight Club Could Help Save Us from a Future of Super-Smart Cyberattacks

The best defense against malicious AI is AI.
July 20, 2017
John Malta

A new competition heralds what is likely to become the future of cybersecurity and cyberwarfare, with offensive and defensive AI algorithms doing battle.

The contest, which will play out over the next five months, is run by Kaggle, a platform for data science competitions. It will pit researchers’ algorithms against one another in attempts to confuse and trick each other, the hope being that this combat will yield insights into how to harden machine-learning systems against future attacks.

“It’s a brilliant idea to catalyze research into both fooling deep neural networks and designing deep neural networks that cannot be fooled,” says Jeff Clune, an assistant professor at the University of Wyoming who studies the limits of machine learning.

The contest will have three components. One challenge will involve simply trying to confuse a machine-learning system so that it doesn’t work properly. Another will involve trying to force a system to classify something incorrectly. And a third will involve developing the most robust defenses. The results will be presented at a major AI conference later this year.

Machine learning, and deep learning in particular, is rapidly becoming an indispensable tool in many industries. The technology involves feeding data into a special kind of computer program, specifying a particular outcome, and having a machine develop its own algorithm to achieve the outcome. Deep learning does this by tweaking the parameters of a huge, interconnected web of mathematically simulated neurons.

It’s long been known that machine-learning systems can be tricked. Spammers can, for instance, evade modern spam filters by figuring out what patterns the filter’s algorithm has been trained to identify.

In recent years, however, researchers have shown that even the smartest algorithms can sometimes be misled in surprising ways. For example, deep-learning algorithms with near-human skill at recognizing objects in images can be fooled by seemingly abstract or random images that exploit the low-level patterns these algorithms look for (see “The Dark Secret at the Heart of AI”).

“Adversarial machine learning is more difficult to study than conventional machine learning—it’s hard to tell if your attack is strong or if your defense is actually weak,” says Ian Goodfellow, a researcher at Google Brain, a division of Google dedicated to researching and applying machine learning, who organized the contest.

As machine learning becomes pervasive, the fear is that such attacks could be used for profit or pure mischief. It could be possible for hackers to evade security measures in order to install malware, for instance.

“Computer security is definitely moving toward machine learning,” Goodfellow says. “The bad guys will be using machine learning to automate their attacks, and we will be using machine learning to defend.”

In theory, criminals might also bamboozle voice- and face-recognition systems, or even put up posters to fool the vision systems in self-driving cars, causing them to crash.

Kaggle has become an invaluable breeding ground for algorithm development, and a hotbed for talented data scientists. The company was acquired by Google in March and is now part of the Google Cloud platform. Goodfellow and another Google Brain researcher, Alexey Kurakin, submitted the idea for the challenge before the acquisition.

Benjamin Hamner, Kaggle’s cofounder and CTO, says he hopes the contest will draw attention to a looming problem. “As machine learning becomes more widely used, understanding the issues and risks from adversarial learning becomes increasingly important,” he says.

The benefits of the open contest outweigh any risks associated with publicizing new kinds of attacks, he adds: “We believe that this research is best created and shared openly, instead of behind closed doors.”

Clune, meanwhile, says he is keen for the contest to test algorithms that supposedly can withstand attack. “My money is on the networks continuing to be fooled for the foreseeable future,” he says.

Keep Reading

Most Popular

still from Embodied Intelligence video
still from Embodied Intelligence video

These weird virtual creatures evolve their bodies to solve problems

They show how intelligence and body plans are closely linked—and could unlock AI for robots.

conceptual illustration showing various women's faces being scanned
conceptual illustration showing various women's faces being scanned

A horrifying new AI app swaps women into porn videos with a click

Deepfake researchers have long feared the day this would arrive.

protein structures
protein structures

DeepMind says it will release the structure of every protein known to science

The company has already used its protein-folding AI, AlphaFold, to generate structures for the human proteome, as well as yeast, fruit flies, mice, and more.

Stay connected

Illustration by Rose WongIllustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at with a list of newsletters you’d like to receive.