mlsanityData to 7 Oct 2026

Evasion Attacks against Machine Learning at Test Time

arXiv 1708.06131 ↗First posted 21 Aug 2017cs.CR cs.LGcited by 686

Not on the map. Why?

Cited by 48 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

In security-sensitive applications, the success of machine learning depends on a thorough vetting of their resistance to adversarial data. In one pertinent, well-motivated attack scenario, an adversary may attempt to evade a deployed system at test time by carefully manipulating attack samples. In this work, we present a simple but effective gradient-based approach that can be exploited to systematically assess the security of several, widely-used classification algorithms against evasion attacks. Following a recently proposed framework for security evaluation, we simulate attack scenarios that exhibit different risk levels for the classifier by increasing the attacker's knowledge of the system and her ability to manipulate attack samples. This gives the classifier designer a better picture of the classifier performance under evasion attacks, and allows him to perform a more informed model selection (or parameter setting). We evaluate our approach on the relevant security task of malware detection in PDF files, and show that such systems can be easily evaded. We also sketch some countermeasures suggested by our analysis.

Key facts. Cited by 686 papers in the map (data through 7 Oct 2026). First posted on arXiv 21 Aug 2017.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 163; 2022: 152; 2023: 147; 2024: 115; 2025: 67; 2026: 42.

686 papers.

Sort:

By area:

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  2. 2021Robust fine-tuning of zero-shot modelscited by 785
  3. 2021Just Train Twice: Improving Group Robustness without Training Group Informationcited by 522
  4. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  5. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  6. 2023Are aligned neural networks adversarially aligned?cited by 305
  7. 2021Unsolved Problems in ML Safetycited by 291
  8. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
  9. 2021Accuracy on the Line: On the Strong Correlation Between Out-of-Distribution and In-Distribution Generalizationcited by 248
  10. 2023Certifying LLM Safety against Adversarial Promptingcited by 248
  11. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  12. 2021Improving Robustness using Generated Datacited by 233
38 more
  1. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  2. 2023Cross-Entropy Loss Functions: Theoretical Analysis and Applicationscited by 206
  3. 2023Data-centric Artificial Intelligence: A Surveycited by 202
  4. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 189
  5. 2023Raising the Cost of Malicious AI-Powered Image Editingcited by 160
  6. 2022(Certified!!) Adversarial Robustness for Free!cited by 130
  7. 2021Graph Unlearningcited by 129
  8. 2023Open Sesame! Universal Black Box Jailbreaking of Large Language Modelscited by 128
  9. 2024Dissecting Adversarial Robustness of Multimodal LM Agentscited by 118
  10. 2021Data Collection and Quality Challenges in Deep Learning: A Data-Centric AI Perspectivecited by 116
  11. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  12. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  13. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 108
  14. 2021Robustness Gym: Unifying the NLP Evaluation Landscapecited by 107
  15. 2021Model-Based Domain Generalizationcited by 103
  16. 2022Quality Not Quantity: On the Interaction between Dataset Design and Robustness of CLIPcited by 97
  17. 2021Trustworthy AI: A Computational Perspectivecited by 93
  18. 2024ChatScene: Knowledge-Enabled Safety-Critical Scenario Generation for Autonomous Vehiclescited by 92
  19. 2024Coercing LLMs to do and reveal (almost) anythingcited by 88
  20. 2024Fast Adversarial Attacks on Language Models In One GPU Minutecited by 85
  21. 2021Proof-of-Learning: Definitions and Practicecited by 81
  22. 2022Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challengescited by 81
  23. 2024Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplificationcited by 80
  24. 2024Prover-Verifier Games improve legibility of LLM outputscited by 79
  25. 2024Does Refusal Training in LLMs Generalize to the Past Tense?cited by 74
  26. 2021Manipulating SGD with Data Ordering Attackscited by 73
  27. 2021Bad Characters: Imperceptible NLP Attackscited by 69
  28. 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
  29. 2022A Light Recipe to Train Robust Vision Transformerscited by 64
  30. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 63
  31. 2023Black Box Adversarial Prompting for Foundation Modelscited by 62
  32. 2021A Dynamical System Perspective for Lipschitz Neural Networkscited by 59
  33. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
  34. 2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 55
  35. 2024Query-Based Adversarial Prompt Generationcited by 55
  36. 2021Membership Inference Attacks Against Recommender Systemscited by 52
  37. 2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 51
  38. 2022Certified Training: Small Boxes are All You Needcited by 51

50 most cited of 686 All 686 (JSON)