## 2 Related Work
### Adversarial Defenses  
Defenses against adversarial attacks can be divided into two groups: detection and preventive methods.  
The main detection methods reported in the literature include:  
* Statistical Tests: These involve conducting statistical analyses on model inputs to identify irregularities or anomalies indicative of adversarial manipulation. For instance, a technique based on the L1-norm to detect adversarial attacks was proposed by [PERSON] et al. [20; 21].  
Reconstruction-based Methods: These techniques rely on reconstructing the input and comparing it with the original input to identify adversarial perturbations. One approach is to use autoencoder-based methods for input reconstruction [22]. This technique can be part of a larger detection framework, such as [23].
* Feature Squeezing: This technique can be used both for the detection of adversarial examples and for increasing the innate robustness of machine learning models. Since it reduces the search space available to an adversary by compressing the amount of expressiveness in the input, it makes all adversarial modifications more apparent thanks to the simplification of model inputs [24].
* Classifier-based Methods: These approaches involve training a separate classifier to discern between adversarial and legitimate inputs, such as [PERSON] et al.'s method using a trained auxiliary neural network [21]. Another example is a MagNet framework, which consists of both detector and reformer networks. Detector networks are used to classify examples as either normal or adversarial, by approximating the manifold of normal examples. The reformer network is then used to move adversarial examples towards the manifold of normal examples--resulting in the correct classification of adversarial examples with small perturbation [23].  
Another stream of work is related to creating methods of implementing innate robustness against adversarial machine learning attacks into machine learning models themselves. These methods include:  
* Adversarial Training: This technique aims to improve the model's resilience against adversarial attacks by explicitly including adversarial examples in the training process. The underlying idea is to expose the model to these specially crafted deceptive inputs during training, forcing the model to learn from these examples and consequently enhancing its robustness. [PERSON] et al. proposed the concept in their pioneering work, thus adding a new dimension to the understanding of model generalization and resilience [12].
* Defensive Distillation: This technique involves training the model to provide softer output distributions rather than discrete class labels, thereby rendering the model's decision boundaries smoother and less prone to adversarial perturbations. The distillation process increases the model's resilience against adversarial attacks by reducing the effectiveness of small perturbations on the input. The technique was described in depth by [PERSON] et al. [25].
* Feature Squeezing: This technique aims to mitigate the risk of adversarial attacks by reducing the complexity of model inputs, effectively limiting the scope for adversarial manipulation. By squeezing or reducing the input data's expressiveness, the technique narrows down the available search space that an adversary could exploit [24].
* Certified Defenses: These methods provide mathematical guarantees of a model's robustness against adversarial attacks. Rather than solely relying on empirical assessments of model performance, these defenses offer a theoretical underpinning to ensure robustness, thus contributing to a more rigorous and reliable model defense. The core concept is to mathematically certify a region around each data point within which the model's prediction remains consistent, hence making it robust against adversarial perturbations [26].  
We strive to enhance this list by presenting a new method useful in black-box scenarios on tabular data.