# Security Evaluation of Pattern Classifiers under Attack

arXiv: https://arxiv.org/abs/1709.00609 · HTML: https://mlsanity.com/paper/1709.00609/

## Key facts

- Cited by 39 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Sep 2017.

## Built on by (most cited first, 30 of 39)

- [Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples](https://mlsanity.com/paper/2106.09947/) (2021)
- [Support Vector Machines under Adversarial Label Contamination](https://mlsanity.com/paper/2206.00352/) (2022)
- [SPADE: A Spectral Method for Black-Box Adversarial Robustness Evaluation](https://mlsanity.com/paper/2102.03716/) (2021)
- [Security and Privacy for Artificial Intelligence: Opportunities and Challenges](https://mlsanity.com/paper/2102.04661/) (2021)
- [AttackBench: Evaluating Gradient-based Attacks for Adversarial Examples](https://mlsanity.com/paper/2404.19460/) (2024)
- [EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box Android Malware Detection](https://mlsanity.com/paper/2110.03301/) (2021)
- [Towards Adversarial Realism and Robust Learning for IoT Intrusion Detection and Classification](https://mlsanity.com/paper/2301.13122/) (2023)
- [SoK: Realistic Adversarial Attacks and Defenses for Intelligent Network Intrusion Detection](https://mlsanity.com/paper/2308.06819/) (2023)
- [Towards a Robust and Trustworthy Machine Learning System Development: An Engineering Perspective](https://mlsanity.com/paper/2101.03042/) (2021)
- [Federated Learning with Unreliable Clients: Performance Analysis and Mechanism Design](https://mlsanity.com/paper/2105.06256/) (2021)
- [Practical Region-level Attack against Segment Anything Models](https://mlsanity.com/paper/2404.08255/) (2024)
- [Adversarial Transfer Attacks With Unknown Data and Class Overlap](https://mlsanity.com/paper/2109.11125/) (2021)
- [The Cross-evaluation of Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2203.04686/) (2022)
- [Deploying Convolutional Networks on Untrusted Platforms Using 2D Holographic Reduced Representations](https://mlsanity.com/paper/2206.05893/) (2022)
- [Adversarially Robust Spiking Neural Networks Through Conversion](https://mlsanity.com/paper/2311.09266/) (2023)
- [Covert Model Poisoning Against Federated Learning: Algorithm Design and Optimization](https://mlsanity.com/paper/2101.11799/) (2021)
- [We Can Always Catch You: Detecting Adversarial Patched Objects WITH or WITHOUT Signature](https://mlsanity.com/paper/2106.05261/) (2021)
- [Enhancing the Antidote: Improved Pointwise Certifications against Poisoning Attacks](https://mlsanity.com/paper/2308.07553/) (2023)
- [Adversarial Training for Defense Against Label Poisoning Attacks](https://mlsanity.com/paper/2502.17121/) (2025)
- [Mitigating Adversarial Gray-Box Attacks Against Phishing Detectors](https://mlsanity.com/paper/2212.05380/) (2022)
- [Adversarially Regularized Graph Attention Networks for Inductive Learning on Partially Labeled Graphs](https://mlsanity.com/paper/2106.03393/) (2021)
- [Single-Shot Black-Box Adversarial Attacks Against Malware Detectors: A Causal Language Model Approach](https://mlsanity.com/paper/2112.01724/) (2021)
- [A Red Teaming Framework for Securing AI in Maritime Autonomous Systems](https://mlsanity.com/paper/2312.11500/) (2023)
- [Generating Black-Box Adversarial Examples in Sparse Domain](https://mlsanity.com/paper/2101.09324/) (2021)
- [Testing robustness of predictions of trained classifiers against naturally occurring perturbations](https://mlsanity.com/paper/2204.10046/) (2022)
- [Graphfool: Targeted Label Adversarial Attack on Graph Embedding](https://mlsanity.com/paper/2102.12284/) (2021)
- [Classification Auto-Encoder based Detector against Diverse Data Poisoning Attacks](https://mlsanity.com/paper/2108.04206/) (2021)
- [Breaking Boundaries: Balancing Performance and Robustness in Deep Wireless Traffic Forecasting](https://mlsanity.com/paper/2311.09790/) (2023)
- [CyberNFTs: Conceptualizing a decentralized and reward-driven intrusion detection system with ML](https://mlsanity.com/paper/2409.11409/) (2024)
- [Adversarial Machine Learning Attacks on Financial Reporting via Maximum Violated Multi-Objective Attack](https://mlsanity.com/paper/2507.05441/) (2025)

## Abstract (arXiv)

Pattern classification systems are commonly used in adversarial applications, like biometric authentication, network intrusion detection, and spam filtering, in which data can be purposely manipulated by humans to undermine their operation. As this adversarial scenario is not taken into account by classical design methods, pattern classification systems may exhibit vulnerabilities, whose exploitation may severely affect their performance, and consequently limit their practical utility. Extending pattern classification theory and design methods to adversarial settings is thus a novel and very relevant research direction, which has not yet been pursued in a systematic way. In this paper, we address one of the main open issues: evaluating at design phase the security of pattern classifiers, namely, the performance degradation under potential attacks they may incur during operation. We propose a framework for empirical evaluation of classifier security that formalizes and generalizes the main ideas proposed in the literature, and give examples of its use in three real applications. Reported results show that security evaluation can provide a more complete understanding of the classifier's behavior in adversarial environments, and lead to better design choices.