# A Holistic Review of Machine Learning Adversarial Attacks in IoT Networks
## 3 Adversarial Attack Taxonomy
### Attacker's Capability  
Illustrates the impact of the adversary on the target ML system's operation. The efficiency of an adversarial attack is determined by the capability and strategy to manipulate the classes and features of the training data or test data gathered from various IoT networks. It is influenced by factors such as the quantity of malicious data introduced or altered and the specific portion of the training or testing data that the attacker targets. The categorization of attacks on ML models varies according to the stages within the ML model pipeline: training phase, testing phase, and deployment phase. * Training phase: In this phase, attacks on the ML model are more frequent than often realized. The attacker aims to mislead or disrupt the model's outcomes by directly modifying the training dataset. Those kinds of attacks are known as \"poisoning\" or \"contaminating\", and they require that an adversary has a degree of control over training data. The attacker's tactics during the training phase are shaped by their adversarial capabilities which can be classified into three distinct categories. * Data Injection: The attacker lacks access to the learning model's parameters and training dataset, yet possesses the capability to append new data to the training dataset, thereby inserting adversarial samples to fool or degrade the ML model's performance. * Data Modification: The adversary cannot access the learning algorithms but can manipulate the training data, contaminating it before it is used to train the target model. * Logic Corruption: The adversary can tamper with the learning algorithm of the target ML model. In other words, the learning algorithm is susceptible to interference from the opponent. Testing phase: In testing, adversarial attacks do not alter the training data or directly interfere with the model. Instead, they seek to make the model produce incorrect results by maliciously modifying input data. In addition to the level of information at the adversary's disposal and, the attacker's knowledge, the efficacy of these attacks depends on three main capabilities: adaptive attack, non-adaptive attack, and strict attack. * Adaptive Attack: The adversary is crafting an adaptive malicious input that exploits the weak points of the ML model to mistakenly classify the malicious samples as benign. The adaptiveness can be achieved either by meticulously designing a sequence of input queries and observing their outputs in a black-box scenario or through accessing the ML model information and altering adversarial example methods that maximize the error rate in case of a white-box scenario. * Non-adaptive attack: The adversary's access is restricted solely to the training data distribution of the target model. The attacker starts by building a local model, choosing a suitable training procedure, and training it using samples from data distribution to mimic the target classifier's learned model. Leveraging this local model, the adversary creates adversarial examples and subsequently applies these manipulated inputs against the target model to induce misclassifications. * Strick Attack: The attacker lacks access to the training dataset and is unable to dynamically alter the input request to monitor the model's response. If the attacker attempts to request valid input samples and introduces slight perturbations to observe the output label, this activity most probably will be flagged by the target ML model as a malicious attack. Hence, the attacker is constrained to perform a restricted number of closely observed queries, presuming that the target ML system will only detect the malicious attacks after a specific number of attempts. * Deployment phase: Adversarial attacks during the deployment or production phase represent the most realistic scenario where the attacker's knowledge of the target model is limited to its outputs, which correspond to a black-box scenario.