are executed at decision time: they assume that the model has already been trained, so the attacker aims at changing its behavior to cause the model to make incorrect predictions. The latter ones, in contrast, take place before the model is trained. They aim at modifying a part of the data used for training purposes to corrupt the final model.

Second, we highlight the nature of information the attacker has about the learning algorithm. This allows us to compare white-box attacks and black-box attacks. Namely, white-box attacks assume that the model is known to the adversary, whereas in black-box attacks the adversary has limited or no information about the model, although may obtain some of the information indirectly, for example, through queries and captured responses.

Third, attackers may have different reasons for attacking, such as evading detection or reducing confidence in the algorithm. We differentiate between two broad classes of attack goals: targeted attacks and reliability attacks. In a targeted attack, the attacker’s goal is to cause a misclassification into a specific label or target. In contrast, a reliability attack aims to degrade the perceived reliability of the machine learning system by maximizing prediction error without any particular target label.

