mlsanityData to 14 Oct 2026

Signal-based Model Access Risk Analysis for AI System Operations Security

arXiv 2607.16414 ↗First posted 17 Jul 2026cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Artificial intelligence (AI) systems are now ubiquitous across domains such as security, finance, healthcare, consumer technology, and large-scale cloud services, where they process massive volumes of data and make consequential decisions daily. This widespread adoption has created a broad attack surface through which adversaries can manipulate, evade, extract information from, or otherwise subvert deployed models. Depending on system design and exposure, attackers may have very different forms of access: some observe only final decisions, while others receive confidence scores, intermediate representations, or even full model parameters. While previous surveys typically organize evasion attacks into white-box, gray-box, and black-box categories based on the attacker's knowledge of model internals (architecture, parameters, gradients), this taxonomy often conflates different deployment scenarios that provide vastly different output signals, all labeled as ``black-box'' despite enabling fundamentally different attack strategies. Understanding how evasion attack strategies adapt to the specific information signals returned by deployed systems is critical for organizations making procurement and deployment decisions. To address this gap, we introduce the Signal-based Model Access Risk Taxonomy (SMART), a deployment-oriented framework that classifies attacker access according to the nature and richness of the information signals available from deployed AI systems. Using this taxonomy, we provide a structured overview of evasion attacks across progressively richer levels of information exposure, highlighting how deployment interfaces influence attack capabilities and informing more secure AI deployment and procurement decisions.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 29 of its 38 references that are in the map. First posted on arXiv 17 Jul 2026.

Builds on

29 of 38 references.

References · 29

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  4. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  5. 2015The Limitations of Deep Learning in Adversarial Settingscited by 790
  6. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  7. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  8. 2017Adversarial Patchcited by 517
  9. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  10. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
  11. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 460
  12. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 414
17 more
  1. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
  2. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
  3. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 175
  4. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 163
  5. 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 146
  6. 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
  7. 2020Data-Free Model Extractioncited by 124
  8. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 104
  9. 2020RayS: A Ray Searching Method for Hard-label Adversarial Attackcited by 96
  10. 2020Towards Transferable Adversarial Attack against Deep Face Recognitioncited by 80
  11. 2018Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Datacited by 70
  12. 2017On the Reconstruction of Face Images from Deep Face Templatescited by 67
  13. 2019AdvFaces: Adversarial Face Synthesiscited by 60
  14. 2024Face Reconstruction from Face Embeddings using Adapter to a Face Foundation Modelcited by 9
  15. 2022Similarity-based Gray-box Adversarial Attack Against Deep Face Recognitioncited by 8
  16. 2024Rethinking Impersonation and Dodging Attacks on Face Recognition Systemscited by 8
  17. 2024A Survey on Physical Adversarial Attacks against Face Recognition Systemscited by 4

Built on by

Not cited yet.