Adversarial Attacks on Artificial Intelligence Models: Defence Strategies, Datasets, Evaluation Metrics, and Future Research Directions

In the modern digital world, banks, hospitals, and power grids rely heavily on artificial intelligence to make sense of vast amounts of data. These systems, built on machine learning and deep learning, act as tireless sentinels. They scan network traffic to spot intruders, analyze files to find hidden malware, and verify identities to keep unauthorized users out. For years, these tools have been celebrated for their ability to learn complex patterns and adapt to new threats, often catching up to ninety-five percent of dangers under normal conditions. However, a hidden vulnerability has emerged. Just as a human can be tricked by a clever illusion, these intelligent systems can be fooled by inputs that look almost identical to the real thing but contain tiny, carefully crafted distortions. These distortions, known as adversarial attacks, are designed to confuse the computer's logic, causing it to misclassify a dangerous virus as harmless or to grant access to an imposter. The stakes are high: a single successful trick could allow a hacker to steal millions, shut down a critical infrastructure, or bypass security at a national level.

A team of researchers from universities in Iraq and Malaysia has taken a comprehensive look at this growing threat. They did not just study one type of attack or one specific defense; instead, they gathered and analyzed one thousand research papers published between 2017 and 2025 to map the entire landscape of the problem. Their goal was to understand how these attacks work, how well current defenses hold up, and where the gaps remain. By sorting through this massive amount of literature, they identified twelve new types of adversarial attacks that had not been previously grouped together in a single framework. They found that attackers can operate with different levels of knowledge: some know the entire inner workings of the system they are attacking, while others only see the final output, and some fall somewhere in between. The researchers also discovered that attacks can happen at different stages, either by poisoning the data while the system is learning or by sneaking in tricky inputs after the system is already running.

The study reveals a stark reality about the current state of security. While researchers have developed many ways to detect and block these tricks, the defenses are often unbalanced. The authors found that nearly seventy percent of existing research focuses on detecting the attack after it has happened, while only about twenty-three percent focuses on making the models stronger during their training phase. This imbalance leaves systems vulnerable because attackers can exploit weaknesses in how the model was built in the first place. Furthermore, the team highlighted a significant disconnect between laboratory experiments and real-world application. In controlled settings, defenses might look perfect, but when moved to the messy, unpredictable environment of the real world, their success rate can drop by as much as sixty percent. This drop happens because real-world systems face challenges like limited computing power, the need for instant decisions, and the sheer variety of attack methods that are constantly evolving.

To address these issues, the researchers proposed a new, three-level framework to organize how we think about these attacks and defenses. This structure helps security experts categorize threats based on what the attacker knows, what they want to achieve, and how they change the data. They also reviewed the tools and datasets used to test these systems, noting that while many standard tests exist, there is no single, agreed-upon standard for measuring success across all different types of AI. This lack of standardization makes it difficult for organizations to choose the right protection for their specific needs. The paper suggests that future progress will depend on combining different strategies, such as using blockchain to secure data sharing, integrating artificial intelligence with decision support systems to help humans make better choices, and developing defenses that work efficiently on small, edge devices like sensors and cameras.

Ultimately, this survey serves as a crucial guide for the next generation of cybersecurity. It confirms that while artificial intelligence has revolutionized how we protect our digital infrastructure, it has also introduced a new kind of vulnerability that requires constant vigilance. The researchers emphasize that there is no single magic bullet to stop these attacks. Instead, building secure systems will require a multi-layered approach that combines better training methods, real-time detection, and a global effort to create standard rules for testing and validating these technologies. As the technology continues to advance, the race between those who build the defenses and those who try to break them will only intensify, making the work of understanding and categorizing these threats more important than ever.