## 1 Introduction  
Machine learning (ML) has become widely adopted as a strategy for dealing with a variety of cybersecurity issues. Cybersecurity domains particularly suited to ML include: intrusion detection and prevention [1], network traffic analysis [2], malware analysis [3, 4], user behaviour analytics [5], insider threat detection [6], social engineering detection [7], spam detection [8], detection of malicious social media usage [9], health misinformation [10], climate misinformation [11], and more generally \"Fake News\" [12]. These are essentially classification problems. [PERSON] et al. [13] stated that most ML models can be described mathematically as functions \(h_{0}(x)\) with an input \(x\) and parameterized by a vector \(\theta\in\Theta\), although some models such as K nearest neighbor are non-paremetric. The output of the the function \(h_{0}(x)\) is the model's prediction of some property of interest for the given input \(x\). The input \(x\) is usually represented as a vector of values called features. The space of functions \(h=x\mapsto h_{0}(x)|\theta\in\Theta\) defines the set of candidate hypotheses. In supervised learning, the parameters are adjusted to align model predictions \(h_{0}(x)\) with the expected output \(y\). This is achieved by minimizing a loss function that captures the dissimilarity of \(h_{0}(x)\) and the corresponding \(y\). Model performance must be validated against a separate training dataset to confirm if the model also generalizes well for unseen data. Classification ML systems find a function (\(f\)) that matches a vector (\(\vec{x}\)) to its corresponding class (\(y\)). [PERSON] et al. [14] noted that few studies analyzed the complexity of models and associated trade-offs between accuracy and complexity. The complexity of an algorithm is often expressed in _Big-O notation_. They reviewed models, stating the number of features and activations have an effect on memory usage and computational complexity. Moreover, they argued that accuracy alone cannot justify the choice of model type, particularly in regard to DNN; however, we consider the risks involved for inaccurate predictions will vary across domains. In security domains, greater accuracy may be considered critical, possibly assuaging concerns regarding computational complexity of models. Critically, ML systems are increasingly trusted within cyber physical systems [15], such as power stations, factories, and oil and gas industries. In such complex physical environments, the potential damage that could be caused by a vulnerable system might even be life threatening [16]. Despite our reliance and trust in ML systems, the inherent nature of machine learning--learning to identify patterns--is in itself a potential attack vector for adversaries wishing to circumvent ML-based system detection processes. Adversarial examples are problematic for many ML algorithms and models including random forests (RF) and naive Bayes (NB) classifiers; however, we focus on artificial neural networks and particularly deep neural networks. Artificial neural networks (ANN) are inspired by the network of neurons in the human brain. ANNs are useful because they can generalize from a finite set of examples, essentially mapping a large input space (infinite for continuous inputs) to a range of discrete outputs. Unfortunately, in common with other ML algorithms, neural networks are vulnerable to attacks using carefully crafted perturbations to inputs, including evasion and poisoning attacks. In recent work, carefully crafted inputs described as \"adversarial examples\" are considered possible in ANN because of these inherent properties that exist within neural networks [17], such as:  
1. The semantic information of the model is held across the model and not localised to specific neurons;
2. Neural networks learn input-output mappings that are discontinuous (and discontinuous). These properties mean that even extremely small perturbations of an input could cause a neural network to provide a misclassified output.