Related Work {#sec:Lit}
============

The first publication that hints at adversarial machine learning dates back to the early $2000$’s. In $2004$, Dalvi et al. [@10.1145/1014052.1014066] managed to fool classifiers for spam detection by adding intentional changes to the body of an email. In $2005$, Lowd and Meek [@Lowd_2005] introduced the adversarial classifier reverse engineering (ACRE) learning problem, the task of learning sufficient information about a classifier to construct adversarial attacks. They presented efficient algorithms for reverse engineering linear classifiers with either continuous or Boolean features and demonstrated their effectiveness using real data from the domain of spam filtering.

A taxonomy for attacks and defenses in adversarial setting was first established by Barreno et al. in [@Barreno_2006] and later refined in [@Barreno_2010]. This taxonomy clearly defines threat models and includes the concept of adversarial examples without any mentioning of the term. The first time this term was coined was in $2013$ when Szegedy et al. [@szegedy2013intriguing] investigated properties of deep neural networks and found that by applying a certain imperceptible perturbation to an image, these networks misclassified it with high confidence. Moreover, they showed that the specific nature of these perturbations is not a random artifact of learning: the same perturbation 