## 6 Discussion and Conclusions  
ML systems are deployed in complex environments, including cybersecurity and critical national infrastructure. Such systems attract the interest of powerful advanced persistent threats that may target them. Crucially, we must address robustness against functionality-preserving adversarial examples before novel attack strategies exploit inherent weaknesses in critical ML models. Machine learning and adversarial learning are becoming increasingly recognised by the research community, given the rapid uptake of ML models in a whole host of application domains. To put this in context, 2975 papers were published on arXiv in the last 12 months (October 2020-September 2021) related to machine learning and adversarial learning. Over recent years, the number of papers being published on this topic has grown substantially. According to [PERSON], who maintains a blog post \"A Complete List of All (arXiv) Adversarial Example Papers\" [148], the cumulative number of adversarial example papers neared 4000 in the year 2021. It is therefore evident that there is a lot of interest and many researchers active in this area. Not all papers in this list are useful or relevant; we pass no judgement of their quality but merely aim to clarify the research landscape and draw important research to the fore. The majority of prior research has been applied to the visual domain. Seminal contributions have been made by [PERSON] et al. [17], [PERSON] et al. [63], [PERSON] et al. [64], and [PERSON] [79]. It is clear that the visual domain continues to be well researched. We conducted an extensive survey of the academic literature in relation to functionality-preservation in adversarial machine learning. We derived a classification based on both attack and defense. We consider edposible robustness metrics. Moreover, we considered model training and data-level techniques that could help improve robustness through tackling biased datasets. Analysis of functionality-preservation methods finds gradient-based methods may be less suitable for functionality-preservation and other constraints. Methods modifying large numbers of features are less likely to preserve functionality. We found that GANS and genetic algorithms are suitable for functionality-preserving attacks. We subsequently discussed defense strategies against functionality-preserving adversarial examples. We found that functionality-preserving adversarial machine learning is an open research topic. Finally, we will identify some key future directions and research challenges in functionality-preserving machine learning. Future Directions and Research ChallengesWe now discuss future research challenges. Few researchers address the problem of transferability, which remains a key area of concern because hard-to-attack models are nevertheless susceptible to _transferable_ adversarial examples generated against easy-to-attack models. Breaking the transferability of adversarial examples is a key challenge for the research community. Currently, defensive dropout [134] at test time is a promising defense. Adversarial example detection is a useful area of research. We consider the area of functionality-preserving adversarial examples under-explored. Research into improving robustness against such adversarial examples is an area requiring urgent research. We suggest that adapting defenses used in the visual domain and CNN models to other model types such as RNNs could offer potential solutions. Caution should be exercised when adapting defenses in the visual domain to other domains. For example, denoising defenses may not apply directly to discrete or noncontinuous data. Constraints on adversarial examples are not limited to preserving the functionality of malware or IDS attacks. CPSs model the real world, where linear and other physical constraints must be respected. Adversarial examples that do not respect domain constraints risk marking themselves as obvious anomalies. Concept-drift is a real concern for cybersecurity [1], as new attacks and techniques are discovered daily.