## 3 The Rise of Adversarial Machine Learning (AML)
### Defenses against Adversarial Examples
#### 3.3.1 Data-Based Modification  
This category covers the techniques of modifying the data and its related features during either the training phase or the testing phase based on the attacker's capabilities. Such techniques include:  
1. Adversarial Training:  
Figure 5: Adversarial Goals. Figure 6: Taxonomy of the AML defense mechanisms is subdivided into three categories: (1) Data-based Modification, (2) Model-based Modification, and (3) Other Defense Techniques [26; 41; 42; 43; 44; 45; 46; 47; 48]. Adversarial training has been widely adopted in many research studies to enhance the robustness of ML solutions against adversarial attacks and show their defects [26; 41]. The main notion behind this technique is reducing the potential misclassification results when data perturbation is fed to the ML solutions. It works on adding adversarial examples to the training data alongside generating new adversarial examples during the training epochs. Through these epochs, the characteristics of adversarial examples are controlled by the loss function where the hyper-parameters are tuned accordingly. By equalizing the number of both original examples and adversarial examples during training, the models can give better adversarial training results. Adversarial training is used also to handle the regularization problems and thereby avoid overfitting. Since adversarial training is correlated to the training phase where white-box attacks take place, it is not robust to black-box attacks where new adversarial examples are presented [28; 32]. Therefore, a study investigated the use of the ensemble adversarial training concept where different training data of pre-trained models are combined and then allow the model to generalize well on unseen inputs [42]. Blocking the Transferability:  
Since transferability is a unique characteristic of adversarial examples, defenses in this context prevent the adversarial examples' transferability and thereby prevent black-box attacks. As mentioned previously, transferability can happen to models with different architectures or trained on different training datasets. A labeling method has been proposed to prevent the transferability between models [44]. It relies on adding a NULL label to the dataset to mitigate the adversarial examples effects where the model can detect them more efficiently. For this purpose, three steps are performed which start with training the target model as an initial step. It is followed by finding the NULL probabilities within the examined dataset and ends with adversarial training. A higher probability is assigned to the NULL label when there is more perturbation, and the probabilities of other labels are also increased for the original labeling. Thus, the method eases the detection of adversarial examples by annotating the perturbation as a NULL label instead of classifying it into one of the ranges of original labels. It also does not affect the model accuracy for the classification process of original datasets [35]. Input Transformation:  
Some research studies have found the data transformation technique useful for enhancing the model's robustness against adversarial attacks such as FGSM [26], DeepFool [79], and universal disturbance attacks [45; 46; 47]. Such transformation includes data compression, variance minimization, bit-depth reduction, and input reconstruction which are utilized to prevent adversarial perturbations. In terms of compression, JPEG and Display Compression Technology (DCT) compression methods are used in mitigating attacks by performing compression over different image data formats such as JPEG. After training the model on those inputs, the overall accuracy is enhanced, and the attack disturbance effect can be controlled. However, the compression techniques are not well effective against more powerful and advanced attacks like Carlini & Wagner attacks [80; 81].