Recent works have identified a gap between research and practice in
artificial intelligence security: threats studied in academia do not always
reflect the practical use and security risks of AI. For example, while models
are often studied in isolation, they form part of larger ML pipelines in
practice. Recent works also brought forward that adversarial manipulations
introduced by academic attacks are impractical. We take a first step towards
describing the full extent of this disparity. To this end, we revisit the
threat models of the six most studied attacks in AI security research and match
them to AI usage in practice via a survey with \textbf{271} industrial
practitioners. On the one hand, we find that all existing threat models are
indeed applicable. On the other hand, there are significant mismatches:
research is often too generous with the attacker, assuming access to
information not frequently available in real-world settings. Our paper is thus
a call for action to study more practical threat models in artificial
intelligence security.

最近的研究发现了人工智能安全领域研究与实践之间存在的差距：学术界研究的威胁并不总是反映了人工智能的实际使用和安全风险。我们的研究是为了描述这种差异的完整程度，并将六种最常研究的人工智能安全攻击威胁模型与实际使用中的人工智能进行匹配。我们发现所有的现有威胁模型确实是适用的，但也存在重大差异：研究常常太宽容于攻击者，并假设实际环境中很少可用的信息。因此，我们的论文呼吁在人工智能安全领域研究更多实用的威胁模型。