# Attack Strength vs. Detectability Dilemma in Adversarial Machine Learning

arXiv: https://arxiv.org/abs/1802.07295 · HTML: https://mlsanity.com/paper/1802.07295/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Feb 2018.

## Built on by (most cited first, 14 of 14)

- [Adversarial Targeted Forgetting in Regularization and Generative Based Continual Learning Models](https://mlsanity.com/paper/2102.08355/) (2021)
- [The Hammer and the Nut: Is Bilevel Optimization Really Needed to Poison Linear Classifiers?](https://mlsanity.com/paper/2103.12399/) (2021)
- [Universal Backdoor Attacks](https://mlsanity.com/paper/2312.00157/) (2023)
- [Backdoor Learning Curves: Explaining Backdoor Poisoning Beyond Influence Functions](https://mlsanity.com/paper/2106.07214/) (2021)
- [A Red Teaming Framework for Securing AI in Maritime Autonomous Systems](https://mlsanity.com/paper/2312.11500/) (2023)
- [On the Robustness of Random Forest Against Untargeted Data Poisoning: An Ensemble-Based Approach](https://mlsanity.com/paper/2209.14013/) (2022)
- [Avoid Adversarial Adaption in Federated Learning by Multi-Metric Investigations](https://mlsanity.com/paper/2306.03600/) (2023)
- [PACOL: Poisoning Attacks Against Continual Learners](https://mlsanity.com/paper/2311.10919/) (2023)
- [Timber! Poisoning Decision Trees](https://mlsanity.com/paper/2410.00862/) (2024)
- [Preventing Adversarial AI Attacks Against Autonomous Situational Awareness: A Maritime Case Study](https://mlsanity.com/paper/2505.21609/) (2025)
- [Addressing The Devastating Effects Of Single-Task Data Poisoning In Exemplar-Free Continual Learning](https://mlsanity.com/paper/2507.04106/) (2025)
- [Defending Against Beta Poisoning Attacks in Machine Learning Models](https://mlsanity.com/paper/2508.01276/) (2025)
- [Theory of Continual Learning Against Data Poisoning Attacks](https://mlsanity.com/paper/2606.29841/) (2026)
- [Stealth Is a Relation, Not a Property: How Event Representations Create Blind Spots for Timing Attacks in Event-Based Perception](https://mlsanity.com/paper/2609.36386/) (2026)

## Abstract (arXiv)

As the prevalence and everyday use of machine learning algorithms, along with our reliance on these algorithms grow dramatically, so do the efforts to attack and undermine these algorithms with malicious intent, resulting in a growing interest in adversarial machine learning. A number of approaches have been developed that can render a machine learning algorithm ineffective through poisoning or other types of attacks. Most attack algorithms typically use sophisticated optimization approaches, whose objective function is designed to cause maximum damage with respect to accuracy and performance of the algorithm with respect to some task. In this effort, we show that while such an objective function is indeed brutally effective in causing maximum damage on an embedded feature selection task, it often results in an attack mechanism that can be easily detected with an embarrassingly simple novelty or outlier detection algorithm. We then propose an equally simple yet elegant solution by adding a regularization term to the attacker's objective function that penalizes outlying attack points.