Aug 2026· Journal of Cybersecurity and Privacy· 0 citations· 181 references
TL;DR
A systematic analysis of 207 studies selected from 4447 records following the PRISMA 2020 guidelines, covering work published between 2020 and 2026 across cybersecurity and computer vision finds systems that are robust against adaptive adversaries, interpretable under operational constraints, and auditable in environments where AI accountability is a legal requirement.
Abstract
Adversarial machine learning (AML), reinforcement learning (RL), and explainable artificial intelligence (XAI) are increasingly studied as separate problems, yet their interactions under realistic threat conditions remain poorly understood. This review addresses that gap through a systematic analysis of 207 studies selected from 4447 records following the PRISMA 2020 guidelines, covering work published between 2020 and 2026 across cybersecurity and computer vision. A taxonomy of adversarial attacks is constructed across training and inference phases, defense mechanisms are examined with attention to their documented failure modes, and robustness evaluation practices are assessed across the surveyed literature. RL is analyzed in both offensive and defensive roles. Attack agents using RL achieve evasion rates of 74–97% against ML-based detectors, while RL-based defenses report robustness gains of up to 3× over static baselines under comparable threat conditions. XAI receives particular attention because the field treats it almost exclusively as a transparency mechanism, whereas the reviewed evidence shows that it also functions as an attack surface. Attribution methods such as LIME, SHAP, and Grad-CAM produce unreliable explanations under adversarial perturbation, and no system in the reviewed literature certifies that attribution properties are maintained when inputs are manipulated. The review concludes with an analysis of open problems and research directions for building systems that are robust against adaptive adversaries, interpretable under operational constraints, and auditable in environments where AI accountability is a legal requirement.
A detailed overview of the security risks associated with adversarial attacks is offered, including evasion attacks carried out at inference time, data poisoning that corrupts the training process, backdoor insertion that hides dormant triggers inside a model, and model inversion that leaks private information back out of a trained system.
Harsh Verma· International Journal of Sci...· 0 citations
The growing deployment of deep learning models in safety-critical domains has exposed the artificial intelligence
landscape to a widening array of adversarial threats, where imperceptible input perturbations reliably induce severe
misclassifications. This survey provides a comprehensive synthesis of adversarial attacks and defense mechanisms in modern
AI security. It introduces a structured taxonomy categorizing attacks into evasion, poisoning, and model inversion strategies,
evaluated across varying levels of attacker knowledge. Correspondingly, current defense techniques—including adversarial
training, anomaly detection, and gradient masking—are critically reviewed for their resilience against adaptive, real-world
adversaries. The survey further examines robustness benchmarking and success rate analysis frameworks, emphasizing the
gap between theoretical guarantees and practical deployment. By consolidating recent advances and persistent limitations,
this work identifies open research challenges and outlines emerging directions toward provably secure and trustworthy AI
systems for real-world applications.
P. Mahalakshmi, D. Jayalakshmi· International Journal of Inn...· 0 citations
Adversarial attacks pose a significant threat to the reliability and security of Artificial Intelligence (AI) systems, especially as AI integrates into critical fields like healthcare and finance. This work specifically addresses adversarial evasion attacks conducted during the testing phase. In this study, attacks are designed to be untargeted (misleading the model to any wrong class) and white-box (attacker has access to the model), using small perturbations to cause incorrect classifications. To counter these threats, this research investigates adversarial training, a defense mechanism where models are trained using data generated by attacks. The study systematically compares two distinct adversarial training strategies: ‘pre-train’, where adversarial examples are generated beforehand, and ‘in-train’, where perturbations are introduced dynamically during the training process. This comparison aims to understand the advantages and limitations of each approach in enhancing model robustness. Using a Fully Connected Neural Network (FCNN) and the MNIST dataset, experiments were conducted with attacks like FGSM and BIM at varying perturbation strengths $\epsilon $ . The results provide a controlled comparison of adversarial training strategies, highlighting key trade-offs between robustness and generalization. We observe that the ‘in-train’ strategy provides superior robustness in the evaluated setting against white-box, untargeted attacks compared to the ‘pre-train’ method. However, the findings are derived from experiments on the MNIST dataset using FCNNs, and therefore should be interpreted as foundational insights. Extending the analysis to more complex datasets and architectures remains an important direction for future work.
José María Jorquera Valero, Ibon Bengoechea Cazorla, Manuel Gil Pérez· IEEE Access· 0 citations
Modern Industrial Internet of Things (IIoT) integrates machine learning models for monitoring and control. However, they remain vulnerable to adversarial machine learning (AML) attacks, where an adversary adds small changes to the input data. These small changes degrade model quality, reduce accuracy, and can ultimately compromise the safety and security of the entire system. AML research in IIoT often focuses on individual attack types, defense methods, and datasets. Existing reviews lack a unified quantitative and system-level perspective. Therefore, a systematic literature review (SLR) is needed to provide a holistic analysis of existing attacks, defenses, and databases. This SLR analyzes 50 research articles to provide a holistic view of AML threats in IIoT systems and identifies seven distinct attack types: gradient-based perturbations, GAN-generated samples, poisoning attacks, reinforcement learning-based (RL) strategies, saliency-based feature manipulation, false data injection, and hybrid approaches. To illustrate the range of observed impacts, selected studies report the following degradation examples: saliency-based attacks cause accuracy reductions of 6–11 percentage points; iterative gradient attacks reduce accuracy from 95–99% to 30–40% in SIEM systems; and RL-based attacks reduce detection rates from 100% to 0% in rule-based IDS settings. In addition to the analysis of attack types, this SLR also evaluates current defense methods to protect IIoT systems. It has been observed that existing defense mechanisms lack generalization and require high computational resources. Moreover, the testing is performed under simplified threat models. The analysis of datasets further shows a clear gap between realistic industrial benchmarks (such as SWaT, WADI, and NSL-KDD) and synthetic datasets used for controlled experiments. By connecting attack behavior, defense performance, dataset characteristics, and system-level effects, this SLR identifies the key research gaps that must be addressed in future work.
Abeer Alsaidlani, Muhammad Rashid, M. Aljabri· Italian National Conference...· 0 citations
The review explores the key adversarial attack classes: poisoning, evasion, model extraction, model extraction, model inversion, and membership inference and also white-box, black-box, and grey-box threat models.
Ujjwal Deshmukh· International Journal of Inn...· 0 citations
The rapid adoption of artificial intelligence and machine learning across critical sectors has introduced cybersecurity challenges that traditional security frameworks were never designed to address. As machine learning models increasingly shape decision-making in finance, healthcare, autonomous systems, and national security, they have become attractive targets for sophisticated adversaries. This paper examines the evolving threat landscape surrounding AI systems, with particular attention to vulnerabilities that arise at each stage of the machine learning lifecycle, including data poisoning, adversarial manipulation, model extraction, and inference-based privacy attacks. It explores how attackers exploit weaknesses in training data, model architectures, and deployment pipelines to manipulate model behavior or exfiltrate sensitive information, and it reviews the defense strategies that have emerged in response, from adversarial training and robust model design to secure deployment practices and privacy-preserving techniques such as differential privacy, federated learning, and homomorphic encryption. The discussion also situates these technical measures within the broader governance frameworks and secure-by-design principles that organizations are beginning to adopt across the AI development lifecycle. By synthesizing current research and practical defense approaches, this paper provides a comprehensive overview of how machine learning systems can be safeguarded against a threat landscape that continues to evolve as quickly as the technology itself. The overarching conclusion is that securing AI systems is not a task any single discipline can accomplish alone; it requires sustained collaboration between machine learning researchers, cybersecurity professionals, and policymakers if AI technologies are to remain reliable, trustworthy, and resilient in adversarial environments.
Harsh Verma· International Journal of Sci...· 0 citations