Editing Adversarial Machine Learning (section)

== <span style="color: #FFFFFF;">Analyzing</span> ==
{| class="wikitable"
|+ Defense Method Effectiveness
! Defense !! vs. White-box !! vs. Black-box !! Clean Accuracy Cost
|-
| No defense || 0% || Low || None
|-
| Input preprocessing (JPEG, smoothing) || Low (bypassed) || Moderate || Low
|-
| Adversarial training (PGD) || High || High || ~3-5%
|-
| Certified defenses (randomized smoothing) || Certified guarantee || High || High (10%+)
|-
| Ensemble methods || Moderate || Moderate || Medium
|}

'''Failure modes''': Gradient masking — defenses that hide gradients (e.g., preprocessing) fail against gradient-free black-box attacks. Adaptive attacks — researchers always find ways around new defenses by adapting the attack to the specific defense. Security through obscurity — keeping model weights secret helps only until the attacker can query the model and train a surrogate. False sense of security from defenses not evaluated against strong adaptive attacks.
</div>

<div style="background-color: #483D8B; color: #FFFFFF; padding: 20px; border-radius: 8px; margin-bottom: 15px;">