Evasion Attacks: How Adversarial Noise Bypasses ML Classifiers

arXiv:2610.00136v1 Announce Type: cross Abstract: This paper presents a reproducible, educational study of evasion attacks in image classification and text classification. A compact convolutional network trained on MNIST reached 98.63% clean test accuracy and was evaluated under two white-box attacks. Under FGSM, accuracy fell to 60.20% at epsilon = 0.15 and 1.72% at epsilon = 0.30; under PGD it fell to 32.47% and 0.41%, and a bit-depth-reduction defense recovered only part of the loss. In the second experiment, DistilBERT fine-tuned on the SMS Spam Collection reached 98.75% accuracy and a 94.96% F1-score, but a controlled sequence of pre-defined perturbations (character substitutions, whitespace noise, and a benign suffix) produced only modest probability shifts in most displayed examples and no flip from spam to ham. Adversarial vulnerability is strongly modality-dependent: the MNIST experiment is a clear evasion demonstration, whereas the text experiment is a controlled robustness evaluation. Robustness must be tested empirically rather than inferred from clean accuracy.

Related

• Enhancing Adversarial Robustness in Network Intrusion Detection: A Layer-wise Adaptive Regularization Approach
• Property-Preserving Hashing for ell_1-Distance Predicates: Applications to Countering Adversarial Input Attacks
• MalPurifier: Enhancing Android Malware Detection with Adversarial Purification against Evasion Attacks
• On the Existence of Consistent Adversarial Attacks in High-Dimensional Linear Classification
• Towards Certified Malware Detection: Provable Guarantees Against Evasion Attacks

Source: arXiv cs.LG | 2026-10-02