can cause a different network, that was trained on a different subset of the data set, to misclassify the same input.

The last decade has witnessed a large body of publications in the realm of adversarial machine learning in several domains and it is impossible to summarize it all in a paragraph or two. We point the curious reader to a couple of excellent recent articles that attempt to survey the field of AML. Liu et al. [@Liu_2018] investigate security threats and give a systematic survey on them from two aspects, the training phase and the testing/inferring phase. They also categorize existing defensive techniques of machine learning into four groups: security assessment mechanisms, countermeasures in the training phase, those in the testing or inferring phase, data security, and privacy. Further, Akhtar and Mian [@Akhtar_2018] focus on adversarial attacks on deep learning in computer vision. They emphasize that adversarial attacks are possible in practical conditions and review the contributions that evaluate such attacks in real-world scenarios.

A more detailed survey is provided by Serban et al. in [@alex2018adversarial]. The authors introduce an exhaustive list of attacks/defenses and thoroughly discuss the property of transferability. They provide a taxonomy of attacks and defenses 