mlsanityData to 7 Oct 2026

Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspective

arXiv 2302.09457 ↗First posted 19 Feb 2023cs.LG cs.CRcited by 19

Not on the map. Why?

Abstract (arXiv)

Adversarial machine learning (AML) studies the adversarial phenomenon of machine learning, which may make inconsistent or unexpected predictions with humans. Some paradigms have been recently developed to explore this adversarial phenomenon occurring at different stages of a machine learning system, such as backdoor attack occurring at the pre-training, in-training and inference stage; weight attack occurring at the post-training, deployment and inference stage; adversarial attack occurring at the inference stage. However, although these adversarial paradigms share a common goal, their developments are almost independent, and there is still no big picture of AML. In this work, we aim to provide a unified perspective to the AML community to systematically review the overall progress of this field. We firstly provide a general definition about AML, and then propose a unified mathematical framework to covering existing attack paradigms. According to the proposed unified framework, we build a full taxonomy to systematically categorize and review existing representative methods for each paradigm. Besides, using this unified framework, it is easy to figure out the connections and differences among different attack paradigms, which may inspire future researchers to develop more advanced attack paradigms. Finally, to facilitate the viewing of the built taxonomy and the related literature in adversarial machine learning, we further provide a website, ie, urlhttp://adversarial-ml.com, where the taxonomies and literature will be continuously updated.

Key facts. Cited by 19 papers in the map (data through 7 Oct 2026). Builds on 200 of its 308 references that are in the map. First posted on arXiv 19 Feb 2023.

Builds on

200 of 308 references.

References · 200

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  5. 2016Adversarial examples in the physical worldcited by 1,762
  6. 2016Federated Learning: Strategies for Improving Communication Efficiencycited by 1,461
  7. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  8. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  9. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  10. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  11. 2016Universal adversarial perturbationscited by 774
  12. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
38 more
  1. 2018How To Backdoor Federated Learningcited by 745
  2. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  3. 2018An Empirical Study of Example Forgetting during Deep Neural Network Learningcited by 669
  4. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  5. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  6. 2017One pixel attack for fooling deep neural networkscited by 579
  7. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  8. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  9. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  10. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 459
  11. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  12. 2019Hidden Trigger Backdoor Attackscited by 359
  13. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  14. 2018Analyzing Federated Learning through an Adversarial Lenscited by 346
  15. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  16. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  17. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  18. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  19. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  20. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  21. 2019Label-Consistent Backdoor Attackscited by 285
  22. 2018Audio Adversarial Examples: Targeted Attacks on Speech-to-Textcited by 268
  23. 2018Generating Adversarial Examples with Adversarial Networkscited by 256
  24. 2019StegaStamp: Invisible Hyperlinks in Physical Photographscited by 256
  25. 2019Simple Black-box Adversarial Attackscited by 249
  26. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  27. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  28. 2018Bi-Real Net: Enhancing the Performance of 1-bit CNNs With Improved Representational Capability and Advanced Training Algorithmcited by 233
  29. 2021Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Modelscited by 227
  30. 2018Spatially Transformed Adversarial Examplescited by 195
  31. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  32. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
  33. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  34. 2018Physical Adversarial Examples for Object Detectorscited by 163
  35. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  36. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 161
  37. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  38. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155

50 most cited of 200 All 200 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 5; 2024: 7; 2025: 6; 2026: 1.

19 papers.

Sort:

By area:

  1. 2023A Comprehensive Survey on Segment Anything Model for Vision and Beyondcited by 64
  2. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 26
  3. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 17
  4. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  5. 2024BadCM: Invisible Backdoor Attack Against Cross-Modal Learningcited by 9
  6. 2023Versatile Backdoor Attack with Visible, Semantic, Sample-Specific, and Compatible Triggerscited by 8
  7. 2023Universal Backdoor Attackscited by 7
  8. 2023A Comprehensive Study on the Robustness of Image Classification and Object Detection in Remote Sensing: Surveying and Benchmarkingcited by 5
  9. 2025Adversarial Training for Defense Against Label Poisoning Attackscited by 5
  10. 2024On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMscited by 2
  11. 2025TrojanTO: Action-Level Backdoor Attacks against Trajectory Optimization Modelscited by 2
  12. 2024Feature compression is the root cause of adversarial fragility in neural network classifierscited by 1
7 more
  1. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 0
  2. 2024Trading Devil Final: Backdoor attack via Stock market and Bayesian Optimizationcited by 0
  3. 2025Gradient Norm-based Fine-Tuning for Backdoor Defense in Automatic Speech Recognitioncited by 0
  4. 2025Seeking Flat Minima over Diverse Surrogates for Improved Adversarial Transferability: A Theoretical Framework and Algorithmic Instantiationcited by 0
  5. 2025On the Adversarial Robustness of Learning-based Conformal Novelty Detectioncited by 0
  6. 2025MedFedPure: A Medical Federated Framework with MAE-based Detection and Diffusion Purification for Inference-Time Attackscited by 0
  7. 2026Theoretical Lower Bounds on the Robustness of Deep ReLU Networkscited by 0