## 3 Methodology
### Implementation
4
5...
6...
7
8:LiLife off:type attack-semex:Mitigation ;
9# extends base MITRE ATLAS mitigation: 'Input Restoration' (AML_M0010)
10 atlas-semex-procedure:extends atlas-semex:course-of-action.-off12e98-47a-4126-8512-f1573 cbf6 aa ;
11# extends base MITRE ATLAS mitigation: 'Adversarial Input Detection' (AML_M0015)
12 atlas-semex-procedure:extends atlas-semex:course-of-action.-37862c51-9780-435b-15a9-2 ced6b96a8 ff ;
13# title: 'Adversarial Examples Detection in Deep Networks with Convolutional Filter Statistics'
14 atlas-semex-procedure:scientific_ref atlas-semex-paper:1612.07767. 15
16[carlin3M7 rdf:type attack-semex:Technique ;
17# extends base MITRE ATLAS attack: 'Evade HL Model' (AML_M0015)
18 atlas-semex-procedure:extends atlas-semex:attack-pattern.-6025a74-6024-4639-9b2a28a47b70 ;
19# title: 'Adversarial Examples are Inf Lost Safety Detection' Byessing Ten Detection Methods'
20 atlas-semex-procedure:scientific_ref atlas-semex-paper:1705.07263 ;
21 atlas-semex-procedure:uses_dataset atlas-semex-procedure:minst ;
22
23 atlas-semex-procedure:uses_dataset atlas-semex-procedure:cifar10 ;
24
25 atlas-semex-procedure:has_threatmodet atlas-semex-procedure:perfect_knowledge_adversary ;
26
27
28...

We will illustrate the continuous arms race of adversarial attacks and defenses in an image classification context. One of the many mitigations against misclassification or evasion proposed in the ATLAS framework is 'Input Restoration' (AML.M0010). The objective is to preprocess the inference data, i.e., the input image, in order to eliminate or reverse any potential adversarial perturbations. The ATLAS knowledge base on this mitigation (see [[https://atlas.mitre.org/mitigations/AML.M0010](https://atlas.mitre.org/mitigations/AML.M0010)]([https://atlas.mitre.org/mitigations/AML.M0010](https://atlas.mitre.org/mitigations/AML.M0010)) (accessed on 23 January 2024)) offers no suggestions on how exactly to accomplish this. Similar observations can be made for other mitigation strategies, such as 'Adversarial Input Detection' (AML.M0015). Our goal is to offer a knowledge base that is more detailed by complementing these mitigations with semantic references to scientific works, including the relationships between them. For example, [PERSON] et al. (2020) introduced a method involving a straightforward \(3\times 3\) average filter for image blurring prior to classification. The concept behind this simple defense is to mitigate adversarial examples created through the fast gradient sign attack ([PERSON] et al., 2020). Numerous other defenses have been proposed in the literature. Nonetheless, as underscored by [PERSON] and [PERSON] (2019), the identification of adversarial examples proves to be a nontrivial task. They assessed 10 proposed defenses, revealing their susceptibility to white-box attacks. This was accomplished by formulating defense-specific loss functions, subsequently minimized using a strong iterative attack algorithm. Employing these methodologies on the CIFAR-10 dataset, they demonstrated an adversary's ability to generate imperceptible adversarial examples for every defense. Whereas the previous works focused on evasion attacks and defenses, a similar arms race is happening for other types of ML attacks. As inspiration, we explore the poisoning attack survey by [PERSON] et al. (2019). In this extensive survey, the authors offer a thorough systematization of poisoning attacks and defenses in ML, scrutinizing over 100 papers published in the field over the past 15 years. Their approach begins by categorizing prevailing threat models and attacks, followed by the systematic organization of existing defenses. Rather than explaining attacks and defenses in detail and how they were subsequently broken, our goal is to incorporate the knowledge about these attacks and defenses into our ontology-based cybersecurity framework with the following steps:

1. Semantically describe the ML pipeline, including the type of inputs and outputs. 2. Semantically describe the dataset artifacts used in the attack/defense experiments. 3.