## 5 Results
### Adversarial Example Attacks
#### 5.2.2 Adversarial Examples-Types of Attack
The use of adversarial examples with discrete data values is less well explored and remains an interesting avenue for further research. **Black-Box Attacks:** Researchers have also considered black-box attacks that do rely on gradient descent. Some black-box techniques commonly rely on the transferability of adversarial examples. Table 5 shows that few researchers employed the transferability of adversarial examples. Other common black-box techniques include GANS and genetic algorithms (GAs). [PERSON] et al. [104] proposed a method of attacking DNNs with a general framework to train an attack generator or generative adversarial network (GAN). GANs can be trained to produce new, robust, and inconspicuous adversarial examples. Attacks like [PERSON] et al. [77] are more suitable for the security domain, where assessing the security of algorithms and systems under worst-case attacks is needed [105, 106]. An important consideration in attacks against intrusion detection systems is that attackers cannot perform simple oracle queries against an intrusion detection system and must minimize the number of queries to decrease the likelihood of detection. [PERSON] et al. [28] further note that the output of the target model is not directly observable by the attacker; however, exceptions occur where detected malicious traffic is automatically stopped or dropped, or where the attacker gains access to/or knowledge of the system. **Gray-box** attacks consider scenarios where an adversary has only partial knowledge of the system. [PERSON] et al. [77] highlighted the threat from skilled adversaries with limited knowledge; more recently, gray-box attacks have received some attention: [PERSON] et al. [92] considered malicious users of the system with knowledge of the features and architecture of the system, recognizing that attackers may differ in their level of knowledge of the system. [PERSON] et al. [99] used universal adversarial perturbations, showing that unprotected systems remain vulnerable even under limited knowledge scenarios. [PERSON] et al. [101] considered limited knowledge attacks against cyber physical systems and successfully deployed universal adversarial perturbations where attackers have incomplete knowledge of measurements across all sensors. **Building on Simple Adversarial Examples:** Table 5 shows that much research considers simple adversarial examples, although less research considers sequences of adversarial examples or transferability. We chose to classify attacks as either a simple adversarial example, a sequence of adversarial examples, or a transferable adversarial example. A simple adversarial example is sufficient to alter the output of a simple classifier. [PERSON] et al. [82] suggested that using adversarial examples strategically could affect the specific critical outputs of a machine learning system. Sequences of adversarial examples consist of two or more adversarial examples. Sequences of adversarial examples are more challenging than simple adversarial examples. [PERSON] et al. [82] further suggested an _enchanting_ attack to lure a machine learning system to a target state through crafting a series of adversarial examples. Table 5 shows that most research considers simple adversarial examples. Researchers are starting to consider sequences of adversarial examples and consider the transferability of adversarial examples. We chose to classify attacks in this way to clarify the complexity level of attack types. Furthermore, the table shows that sequences of adversarial examples and the transferability of adversarial examples is under-represented, providing opportunities for further research.