Evasion Attack

The defining characteristic of an evasion attack is that it occurs after model training is complete. The attacker does not require access to the training pipeline, poisoned data, or model weights. Instead, they craft a malicious input—often an adversarial example—that exploits the model's learned decision boundaries during prediction. This distinguishes evasion from data poisoning or backdoor attacks, which compromise the model before deployment. The model's parameters remain frozen; only the input is perturbed.

Evasion attacks typically rely on perturbations that are imperceptible or semantically meaningless to humans but catastrophic for model logic. In the visual domain, this involves adding a carefully calculated noise vector constrained by an Lp-norm budget (often L∞ or L2) so the image appears unchanged. For agent systems, this extends to acoustic adversarial examples that sound like normal audio, or subtle typographical changes in text prompts that bypass content filters. The core principle is exploiting the misalignment between human perception and model feature extraction.

Evasion is not limited to the digital domain. Physical adversarial attacks manifest as tangible objects designed to fool real-world perception systems. Examples include:

• Adversarial patches: Printed stickers placed on stop signs that cause an autonomous vehicle's detector to classify them as speed limit signs.
• LiDAR spoofing: Firing precisely timed laser pulses to inject phantom 3D points or delete real obstacles from a point cloud.
• Camouflage textures: 3D-printed objects with specific surface patterns that cause object detectors to fail under varying lighting and angles. These attacks leverage Expectation Over Transformation (EOT) to remain robust across viewpoint shifts.

In multimodal agent systems, evasion attacks can exploit inconsistencies across sensing modalities. A multimodal adversarial example is crafted to simultaneously fool vision, audio, and depth sensors, or to attack the fusion mechanism itself. For instance, an attacker might generate a visual perturbation that causes a Vision-Language-Action (VLA) model to misinterpret a scene, leading to an incorrect physical action. The attack surface expands dramatically when an agent's decision depends on the alignment of heterogeneous input streams.

The fundamental output of an evasion attack: an input sample intentionally perturbed in a way imperceptible to humans that causes a model to make a high-confidence misclassification. The perturbation is typically constrained by an Lp-norm budget (e.g., L∞ ≤ ε) to ensure the modification remains invisible. These examples expose the fragility of neural network decision boundaries and transfer surprisingly well between different model architectures.

The gold-standard white-box iterative attack for evaluating adversarial robustness. PGD repeatedly takes a small step in the direction of the loss gradient and projects the result back onto an epsilon-ball around the original input. It is widely considered the strongest first-order adversary and serves as the benchmark for adversarial training defenses. The multi-step nature makes it significantly more powerful than single-step methods like the Fast Gradient Sign Method.

An attack executed without access to model internals—no gradients, architecture, or training data. The adversary relies solely on query access to observe input-output pairs. Key strategies include:

• Transfer attacks: Crafting adversarial examples on a surrogate model and hoping they transfer to the target.
• Score-based attacks: Using output probabilities to estimate gradients via finite differences.
• Decision-based attacks: Walking the decision boundary using only hard-label predictions.

The most empirically robust defense against evasion attacks. The training dataset is augmented with adversarially perturbed examples labeled with their ground-truth class, forcing the model to learn smooth decision boundaries. This is formulated as a min-max optimization problem: the inner maximization generates the strongest possible attack, while the outer minimization trains the model to resist it. PGD-based adversarial training remains the standard for state-of-the-art robustness.

A false sense of security where a defense produces non-useful or zero gradients, preventing gradient-based attacks from optimizing. This is not true robustness—the model remains vulnerable to black-box transfer attacks or attacks that use a differentiable surrogate. Gradient masking often arises unintentionally from non-differentiable preprocessing layers, stochastic defenses, or shattered gradients. Proper evaluation always includes testing against adaptive attackers who circumvent the mask.

An attack that creates adversarial perturbations in the physical world—such as stickers on stop signs, 3D-printed objects, or altered textures on clothing. These must remain effective under varying lighting, angles, and distances. The Expectation Over Transformation (EOT) technique optimizes the perturbation over a distribution of real-world transformations to ensure robustness. Physical attacks pose a direct threat to autonomous vehicles, surveillance systems, and embodied agents.