Craft Adversarial Data
Description
Adversarial data are inputs to an AI model that have been modified such that they cause the adversary's desired effect in the target model.
Effects can range from misclassification, to missed detections, to maximizing energy consumption.
Typically, the modification is constrained in magnitude or location so that a human still perceives the data as if it were unmodified, but human perceptibility may not always be a concern depending on the adversary's intended effect.
For example, an adversarial input for an image classification task is an image the AI model would misclassify, but a human would still recognize as containing the correct class.
Depending on the adversary's knowledge of and access to the target model, the adversary may use different classes of algorithms to develop the adversarial example such as White-Box Optimization, Black-Box Optimization, Black-Box Transfer, or Manual Modification.
The adversary may perform Verify Attack to confirm that their approach works if they have white-box or inference API access to the model.
This allows the adversary to gain confidence their attack is effective in a live environment where their attack may be noticed.
They can then use the attack at a later time to accomplish their goals.
An adversary may optimize adversarial examples for Evade AI Model, or to Erode AI Model Integrity.
- ATLAS ID
- AML.T0043
- Maturity
- RealizedUsed by real adversaries against AI systems in the wild.
- Platforms
- Predictive AI
Sub-techniques
Mitigations
- AML.M0002Predictive AI Output Obfuscation
Obfuscating model outputs reduces an adversary's ability to generate effective adversarial data.
- AML.M0003Predictive AI Model Hardening
Hardened models are more robust to adversarial inputs.
- AML.M0004Limit AI Service Query Volume and Rate
Limit volume of model queries to prevent or slow an adversary's ability to create adversarial inputs.
- AML.M0006Predictive AI Ensembles
Using an ensemble of models increases the difficulty of crafting effective adversarial data and improves overall robustness.
- AML.M0008Validate AI Model
Validating an AI model against adversarial data can ensure the model is performing as intended and is robust to adversarial inputs.
- AML.M0010Predictive AI Input Restoration
Input restoration can help remediate adversarial inputs.
- AML.M0015Predictive AI Adversarial Input Detection
Incorporate adversarial input detection to block malicious inputs at inference time.
- AML.M0019Control Access to AI Models and Data in Production
Access controls on model APIs can restrict an adversary's access required to generate adversarial data.