## 2 Background
### Adversarial Attacks in ML
In evasion attacks, an adversary introduces a minor perturbation (manifested as noise) into the input of an ML model to induce incorrect classifications (example of an adversary) [51; 52]. These attacks bear similarity to poisoning attacks; however, their principal distinction lies in the fact that evasion attacks endeavor to exploit vulnerabilities within the model during the inference phase, rather than during the training phase. The adversary's comprehension of the target system is crucial. The more comprehensive their understanding of the target model and its underlying architecture, the more feasible it becomes to orchestrate an attack against it. An evasion attack transpires when the model is presented with an \"adversarial example\"--a meticulously altered input that remains visually indistinguishable from its unaltered counterpart to a human observer--but which significantly disrupts the model's functionality. Defenses include training with adversarial examples to enhance model robustness, transforming inputs to the model (input sanitization) and implementing gradient regularization [52]. Adversarial scenarios involve methodologies that exploit these ML models' vulnerabilities through maliciously crafted inputs known as adversarial examples. This field encompasses various attacks in artificial neural network methods and defense strategies aimed at extending model robustness. Common techniques for notable adversarial attacks include the fast gradient sign method (FGSM), DeepFool, and Carlini and Wagner (C&W), each with unique strengths and weaknesses [53]. The robustness of adversarial attack generation methods against defensive mechanisms varies significantly among FGSM, DeepFool, PGD, and GA. Among these, PGD is often regarded as the most robust due to its iterative nature, which allows for more precise perturbation adjustments compared to other methods. FGSM is quick and efficient but less effective against strong defenses due to its single-step approach. DeepFool is more sophisticated than FGSM, as it iteratively refines perturbations, making it harder for defenses to counteract. PGD can exploit model weaknesses more effectively, often bypassing defenses that are effective against FGSM. GA is judged as innovative based on its inherent bio-inspired characteristics; although, GA may not consistently outperform gradient-based methods in robustness against defenses, it is suitable for practical application. This trade-off between robustness and efficiency remains a critical consideration in adversarial attack research with its practical application [54]. Specific systems, such as license plate recognition (LPR), are particularly susceptible to adversarial examples, which can significantly impair their functionality [55]. A defense strategy is training models with (labeled) adversarial examples to improve resilience. Defenses such as layered defenses, combining techniques like adversarial training with defensive distillation, have shown promising results, enhancing accuracy significantly [56]. While adversarial attacks pose significant challenges, ongoing research into layered defenses and alternative strategies is crucial for developing robust ML systems. However, the dynamic nature of adversarial threats necessitates continuous adaptation and innovation in defense mechanisms. Existing state-of-the-art tools for model training and evaluation are the adversarial robustness toolbox (ART) [57], Counterfit [58], CleverHans [59], DeepRobust [60], Foolbox [61], and SecML [62]. Some prominent adversarial example methods are presented in Table 1.