Evasion Attack

Unlike data poisoning or backdoor attacks, evasion attacks occur strictly during model inference. The attacker crafts an adversarial example by solving an optimization problem: finding the minimal perturbation δ that changes the model's prediction while keeping the input visually or semantically identical to a human observer. This temporal distinction is critical for security planning—defenses like adversarial training must harden the model's decision surface, not just filter training data.

Attack strength is bounded by a perturbation budget (ε), typically measured using Lp norms:

• L∞ (Chebyshev): Limits the maximum change to any single pixel or feature, producing uniform noise across the input
• L2 (Euclidean): Constrains the total magnitude of the perturbation vector, often yielding more natural-looking distortions
• L1 (Manhattan): Encourages sparse perturbations that modify only a few input dimensions
• L0: Restricts the number of altered features, simulating real-world constraints like physical sticker attacks

White-box attacks assume full access to model architecture, parameters, and gradients. The Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) exploit gradient information directly. Black-box attacks operate with only query access, using techniques like:

• Score-based: Leveraging output probabilities to estimate gradients via finite differences
• Decision-based: Walking the decision boundary using only hard-label predictions
• Transfer attacks: Generating adversarial examples on a surrogate model and exploiting cross-model transferability

Untargeted attacks simply aim to cause any incorrect prediction—the adversary succeeds if the model outputs any class other than the ground truth. Targeted attacks force the model to output a specific attacker-chosen class. Targeted attacks are significantly harder to execute because they require navigating the model's decision boundary toward a precise region. In medical imaging, a targeted attack could force a diagnostic model to classify a malignant tumor as benign, representing a direct patient safety threat.

Evasion attacks extend beyond digital pixels into the physical domain. Researchers have demonstrated:

• Adversarial patches: Printed patterns that cause object detectors to ignore stop signs or misidentify persons
• Adversarial clothing: Specially designed textile patterns that evade person-detection models
• Sensor-domain attacks: Perturbations in LiDAR point clouds or audio waveforms Physical attacks must account for viewpoint variation, lighting, and sensor noise, making them more challenging but demonstrating real-world security implications for autonomous systems and surveillance.

No single defense provides complete immunity. Key strategies include:

• Adversarial training: Augmenting training data with adversarial examples, particularly using PGD-based attacks
• Gradient masking: Obscuring model gradients through non-differentiable operations, though often defeated by Backward Pass Differentiable Approximation (BPDA)
• Certified defenses: Techniques like randomized smoothing provide mathematical guarantees of robustness within a specified L2 radius
• Feature squeezing: Reducing input dimensionality to remove adversarial perturbation space The field exhibits a persistent cat-and-mouse dynamic between attack and defense research.