Evasion attack: a trained classifier separates two classes in feature space with a decision boundary. Adding a small, carefully-directed perturbation δ to an already-correctly-classified input vector — instead of random noise — moves it just far enough across that boundary to flip the predicted label, while the change to the raw input stays visually negligible (the classic case: a panda image perturbed just enough to be classified as a gibbon).
Data poisoning: instead of attacking a trained model, the attacker injects mislabeled points into the training set itself. As those poisoned samples are absorbed into training, the recomputed decision boundary shifts toward them — degrading or backdooring the model before it ever sees a real attack input.
- Attack strength — evasion: perturbation magnitude relative to the margin. Poisoning: how many and how deep the injected points sit inside the opposing class region.
- Run attack — animates the perturbation crossing the boundary (evasion) or the boundary shifting to accommodate poisoned points (poisoning).