Evasion Attack

Craft inputs that fall on the benign side of a deployed classifier's learned decision boundary while preserving their malicious payload — exploiting the gap between the boundary and the true concept it was meant to represent, so near-perfect test accuracy coexists with near-zero robustness under attack.

Core Idea

An evasion attack is the adversarial-ML pattern in which an adversary crafts inputs that land on the non-detection side of a deployed classifier's decision boundary while preserving their malicious payload. The classifier is not malfunctioning — the crafted input genuinely occupies the region learned as "benign." The attack exploits the gap between the learned boundary and the true concept the defender wanted it to represent, a gap present in every finite-sample, feature-constrained model that a persistent adversary can probe.

Scope of Application

The evasion attack lives across AI security and adversarial machine learning — every setting with a deployed classifier whose boundary an adaptive opponent can probe.

• Image-classifier perturbations — imperceptible pixel changes that flip a confident classification.
• Malware classifier evasion — polymorphic obfuscation preserving payload past detectors.
• Spam-filter evasion — leetspeak, homoglyphs, and benign-content padding.
• Content-moderation evasion — emoji and homoglyph substitution the classifier ignores.
• Biometric presentation attacks — printed photos and replays clearing liveness classifiers.
• Fraud-detection structuring — transactions shaped below detector thresholds.

Clarity

Naming the evasion attack forces apart two evaluation registers that "is the classifier good?" merges: correctness against the training distribution and robustness against an adaptive adversary. A crafted input is no ordinary misclassification — the model behaves exactly as trained — so the bug is in the question, not the fit. The concept's sharper work is to name the classifier-versus-concept gap as a first-class object the adversary searches, reframing a static classification task into a defender-attacker game played on the boundary.

Manages Complexity

An open-ended menagerie of attack vectors — pixel perturbations, obfuscation, homoglyphs, presentation attacks, structuring — compresses onto three structural prerequisites: a fixed, boundary-discoverable rule; an adaptive adversary; and the classifier-versus-concept gap. Every vector becomes the same gap probed through a different channel. The load-bearing collapse is one scalar relationship — in-distribution accuracy is nearly orthogonal to robustness — which recasts a high-dimensional classification problem as a low-dimensional game tracked with a handful of parameters, with one uniform defense family.

Abstract Reasoning

Every move proceeds from the classifier-versus-concept gap. A diagnostic move reads a slipped-through input not as a bug but as the gap being occupied; a boundary-drawing move over evaluation registers separates correctness from robustness and flags reporting test accuracy against an adversary as a category error; a game-on-the-boundary reframing makes the joint game the unit of analysis; and an interventionist move reasons forward to a uniform defense family, fixing the hard limit that a motivated adversary defeats any single classifier.

Knowledge Transfer

Within AI security the concept transfers as mechanism, because the three prerequisites hold identically across the field's vectors, and the diagnostic, the register split, the game reframing, and the defense family all carry intact — along with the adversarial-example, defence-in-depth, and adaptive-attacker-model formalisms. Beyond it the pattern is deeply substrate-independent: any classifier-with-knowable-boundary facing an adaptive opponent produces the same dynamic, filed as the parent adversarial_boundary_navigation (with regulatory_arbitrage its legal instance, plus money-laundering structuring and predator camouflage as genuine co-instances). The gradient-and-perturbation cargo stays home; carry the parent, of which the evasion attack is the adversarial-ML instance.

Relationships to Other Abstractions

Current abstraction Evasion Attack Domain-specific

Parents (1) — more general patterns this builds on

• Evasion Attack is a kind of Input Manipulation Attack Domain-specific

  Evasion attack is the input-manipulation subtype whose preferred output is specifically non-detection by a learned classifier while the malicious payload remains intact.

Hierarchy path (1) — routes to 1 parentless root

• Evasion Attack → Input Manipulation Attack → Adversarial Boundary Navigation

Neighborhood in Abstraction Space

Evasion Attack sits in a moderately populated region (55^th percentile for distinctiveness): it has near-neighbors but no dense thicket of look-alikes.

Family — Adversarial Exploits & Structural Boundaries (12 abstractions)

Nearest neighbors

• Input Manipulation Attack — 0.90
• Data Extraction Through Prompting — 0.86
• Model Skewing — 0.85
• Model Inversion Attack — 0.83
• Model Theft — 0.82

Computed from structural-signature embeddings · 2026-07-12