Evasion Attacks—Tricking AI Models at Inference

This chapter explores one of the most immediate threats to deployed machine learning systems: evasion attacks at inference time. Rather than compromising training data or model parameters, evasion attacks work by subtly altering inputs so that models produce incorrect outputs—without any visible sign of tampering. From image perturbations to textual manipulations and sequential data distortions, the chapter provides a structured look at how adversaries deceive artificial intelligence (AI) models across different modalities using minimal, carefully crafted changes. Readers are guided through the mechanics of evasion, including white-box and black-box gradient-based techniques, universal perturbations, paraphrasing, token interference, and time-series manipulations. The chapter explains how these attacks exploit decision boundaries, tokenization artifacts, temporal sensitivity, and attention weights in models ranging from convolutional neural networks to transformers and recurrent architectures. It also examines how adversaries leverage transferability, physical-world deception, and adaptive optimization to refine their methods and avoid detection in real-world systems. By the end of the chapter, security professionals and engineers will gain a clear understanding of the evasion threat landscape and how these attacks challenge assumptions of model reliability. Practical insights are provided to help readers reason about system vulnerabilities, structure adversarial testing strategies, and approach robustness as a design priority. This chapter is essential for anyone deploying AI systems in high-stakes environments where trust, accuracy, and adversarial resilience must coexist.