Summary

In this chapter, we covered evasion attacks against deployed models aiming to degrade the model’s integrity. We covered targeted and untargeted attacks, white- and black-box approaches, and reconnaissance techniques aiding evasion attacks.

We discussed various approaches to creating adversarial payloads for evasion attacks, such as perturbations and patches in the digital and physical worlds. We delved into image and textual inputs and discussed mitigations such as input preprocessing, adversarial training, model hardening techniques, and certified defenses.

We mentioned model extraction attacks, which attackers can use to help them stage evasion attacks. Model extraction is part of attacks targeting the privacy of the model. In the next chapter, we will cover these attacks in more detail.