Adversarial Machine Learning: Taxonomy, Threat Models, and Mitigation Strategies in Deep Neural Networks

Abstract

Machine learning models, and deep neural networks in particular, have achieved remarkable performance across a wide spectrum of tasks from image classification and natural language processing to autonomous navigation and medical diagnostics. However, alongside their successes, these models have exhibited a deep vulnerability: their susceptibility to adversarial examples, carefully crafted inputs designed to deceive a model into producing incorrect outputs. This paper presents a comprehensive survey and taxonomy of adversarial machine learning attacks and defenses, examining both the theoretical underpinnings and practical implications for real-world systems. We systematically classify attacks along four primary dimensions: knowledge of the target model (white-box versus black-box), the attack stage (training-time or inference-time), the attacker’s goal (targeted versus untargeted), and the perturbation modality (pixel-level, semantic, or physical). For each category, we review representative algorithms, analyze their strengths and limitations, and discuss the threat models they inhabit. On the defense side, we evaluate adversarial training, certified robustness methods, detection-based approaches, and input preprocessing techniques. We conduct a critical assessment of the arms race dynamic between attackers and defenders and propose a unified evaluation framework for comparing defense mechanisms across attack types. We also discuss open research challenges, including the transferability problem, robustness-accuracy trade-offs, and adversarial robustness in the physical world. Our goal is to provide a rigorous, accessible foundation for researchers and practitioners working at the intersection of machine learning, security, and systems design.