the sole focus of machine learning researchers was improving the performance of machine learning systems (true positive rate, accuracy, etc.). Nowadays, the robustness of these systems can no longer be ignored; many of them have been shown to be highly vulnerable to intentional adversarial attacks. This fact renders them inadequate for real-world applications, especially mission-critical ones. Adversarial machine learning is classified by that National Institute of Standards and Technology (NIST) into four categories of attacks: evasion, extraction, poisoning, and inference. In this work, we examine adversarial examples, which is a type of evasion attacks.

An adversarial example is an input to a machine learning model that an attacker has intentionally designed to cause the model to make a mistake. In general, the attacker may have no access to the architecture of the machine learning system being attacked, which is known as a black-box attack. Attackers can approximate a white-box attack by using the notion of “transferability”, which means that an input designed to confuse a certain machine learning model is able to trigger a similar behavior within a different model. In this work, we model a white-box attack by evaluating our examples against a variety of machine learning models, thus 