What are the four types of adversarial attacks discussed in the context of AML, and how does each attack compromise the integrity of an AI model?

The four adversarial attack types discussed are evasion attacks, poisoning attacks, model extraction attacks, and model inversion attacks. Evasion attacks add small perturbations to inputs during deployment to force misclassification. Poisoning attacks inject malicious data into the training set to degrade performance or bias predictions. Model extraction attacks recreate a stolen replica of the model by observing its outputs, while model inversion attacks infer sensitive training data by maximizing a model's confidence on synthesized inputs.

In the AML discussion, the authors identify evasion, poisoning, model extraction, and model inversion as the four adversarial attack types. Evasion attacks occur during inference or deployment: an attacker introduces a small perturbation delta to an input x, subject to a norm constraint, so the model f_theta misclassifies the modified input x + delta. This compromises integrity by undermining the model's classification reliability at the point of use. Poisoning attacks occur during data collection or training: malicious entries (xp, yp) are added to the training set D to form D', and the model is retrained to minimize loss on D'. This degrades overall model performance or biases the model toward attacker-chosen outcomes, corrupting the model's learned behavior. Model extraction attacks target the model's intellectual property and functionality: by querying the deployed model and observing its outputs, the attacker trains a replica model f_hat to minimize the squared difference between the original model's predictions and the replica's predictions. This compromises integrity by allowing unauthorized replication of the model's decision logic, which can facilitate further attacks or theft of the model. Model inversion attacks compromise privacy and integrity of training data: starting from an initial input, the attacker iteratively updates x to maximize the confidence score f_c_theta(x) for a particular class c, thereby reconstructing sensitive training examples or attributes. All four attacks exploit weaknesses in ML models and demonstrate that AI models face diverse threats that require robust protection such as adversarial training, input preprocessing, ensemble methods, and certified defenses.