# Resilience and Resilient Systems of Artificial Intelligence: Taxonomy, Models and Methods
## 3 Background, Taxonomy and Ontology
### Vulnerabilities and Threats of AISs
The output of neural networks is highly dependent on the biases in the output layer, so SBA is implemented by increasing only one value of the bias of the neuron associated with the target category. SBA is designed for cases where hiddenness of the attack is not required. For cases where hiddenness is important, GDA is used, where gradient descent searches for a set of parameters that need to be changed for the attack success. The authors of [2; 38] proposed to apply Alternating Direction Method of Multipliers (ADMM) to optimize the attack while ensuring that the data analysis other than the ones specified is unaffected and the modification in the parameters is minimum. The importance of protecting against adaptive fault and error injection algorithms is related to the trend of moving real-time intelligent computing to edge devices. These devices are more likely to be physically accessible to an attacker, which increases the possibility of misleading devices. Modern cyber-physical systems and the Internet of Things are typical platforms for deployment of intelligent algorithms that require protection against fault injection. An equally harmful destructive factor for machine learning systems is data corruption, missing values, and errors in training and test data. Missing values in features lead to loss of information, and errors in target data labels lead to misinformation and reduced learning efficiency. Missing values in data are often caused by software or hardware faults related to data collection, transmission, and storage. Researchers have found that neural network algorithms are sensitive to so-called adversarial attacks, which involve manipulating data or a model to reduce the effectiveness of AIS [2]. It was noted that adversarial attacks have the following properties:  
* imperceptibility, which consists in the existence of ways of such minimal (not visible to humans) modification of data that leads to inadequate functioning of AI;
* the possibility of Targeted Manipulation on the output of the neural network to manipulate the system for your own benefit and gain;
* transferability of adversarial examples obtained for one model in order to apply them to another model if the models perform a common task, which allows attackers to use a surrogate model (oracle) to generate attacks for the target model;
* the lack of generally accepted theoretical models to explain the effectiveness of adversarial attacks, making any of the developed defense mechanisms not universal. Machine learning model, deployment environment, and data generation source can be the target of attacks. Attacks can be divided into three main types according to the purpose:  
Figure 6: Diagram of the methodology for adaptive fault and error injection into a digital device on which an AI-model is deployed. * availability attacks, which leads to the inability of the end user to use the AIS;
* integrity attacks, which leads to incorrect AIS decisions;
* confidentiality attacks, where the attacker's goal is to intercept communication between two parties and obtain private information. According to strategy, adversarial attacks can be classified into: evasion attacks, poisoning attacks, and oracle attacks [40]. Evasion is an attack on AI under inference by looking for modification of input sample to confuse the machine learning model. The main component of a adversarial attack is a adversarial data sample \(\mathrm{x}^{\prime}\) with a small perturbation (adding a noise component) \(\mathrm{x}^{\prime}=\mathrm{x}+\varepsilon\), which leads to a significant change in the output of the network, described by the function \(\mathrm{f}(\mathrm{x})\), thus \(\mathrm{f}(\mathrm{x}^{\prime})\
eq\mathrm{f}(\mathrm{x})\). The neural network weights \(\mathrm{\theta}\) are treated as fixed and only the input test sample \(\mathrm{x}\) is subject to optimization in order to generate the adversarial sample \(\mathrm{x}^{\prime}=\mathrm{x}+\varepsilon\).