open questions and future research directions.

Prerequisites {#sec:Pre}
=============

Machine learning encompasses a vast field of techniques that extract patterns from data, as well as the theory and analysis relating to these algorithms. A computer program is said to learn from experience $E$ with respect to some class of tasks $T$ and performance measure $P$, if its performance at tasks in $T$, as measured by $P$, improves with experience $E$ [@mitchell1997machine].

In this section, we review the basic concepts of machine learning, broadly divided into three major areas: supervised learning, unsupervised learning, and reinforcement learning. We then introduce the notion of adversarial machine learning and categorize the types of attacks along three dimensions: timing, information, and goals. We adopt a simplistic approach for the sake of exposition, the reader interested in the technical definitions and details is referred to the books [@joseph2019adversarial; @vorobeychik2018adversarial; @mitchell1997machine].

Supervised Learning
-------------------

Consider a data set $D=\{(x_i,y_i):i=1,\dots,n\}$ which lies in a product space $Z=X \times Y$, where $\times$ denotes the cartesian product. We call $X$ the input space or feature space and $Y$ the label space or the output space. In general, $D$ is assumed to be drawn from an unknown distribution.

For a model 