Adversarial Examples

Adversarial examples were first demonstrated in 2013 by Szegedy et al. on image classifiers: a perturbation imperceptible to a human can flip a model's prediction from "panda" to "gibbon" with high confidence. The phenomenon generalises far beyond vision — speech recognition models can be tricked with engineered audio, text classifiers with character-level edits, and code models with semantically equivalent but syntactically odd inputs. The standard attack families are FGSM, PGD, and Carlini-Wagner; for black-box settings, transfer attacks exploit the observation that adversarial examples generalise across architectures. In production, adversarial examples threaten malware classifiers, fraud detection, content moderation, and any model used as a security control. Defenses include adversarial training, certified robustness (randomised smoothing), input preprocessing, and — crucially for security uses — ensuring the model is not the sole layer of defense.