that is specific to the adversarial examples field. This taxonomy is meant to properly structure the methods in AML and help future researchers to position their work in comparison to other publications.

Most of the adversarial machine learning research so far has focused on unconstrained domains (e.g., image and object recognition). This is mainly due to the following assumption: the adversary is always able to fully exploit each feature or pixel of a given image. Several attack algorithms currently exist in the literature and many variations to their models are widely implemented. These models include the Fast Gradient Sign Method (FGSM) [@goodfellow2014explaining], the Jacobian-based saliency map attack (JSMA) [@Papernot_2016], Deepfool [@Moosavi_Dezfooli_2016], and the Carlini Wagner attack (CW) [@Carlini_2017].

Goodfellow et al. [@goodfellow2014explaining] proposed the FGSM to generate adversarial perturbations based on the gradient of the loss function relative to the input image and, thus, enable computational efficiency through backpropagation. Papernot et al. [@Papernot_2016] created adversarial saliency maps by computing forward derivatives, which are used to identify the input feature to be perturbed towards the target class. Moosavi-Dezfooli et al. [@Moosavi_Dezfooli_2016] proposed an approach to find the closest distance from original input to the decision boundary of adversarial examples. Carlini and 