In recent years, artificial intelligence (AI) and machine learning (ML) systems have become embedded in critical processes such as fraud detection, medical diagnostics, autonomous driving, and financial decision-making. As these technologies gain ground, questions about their reliability and resistance to adversaries exploiting them also grow. The field of AI security addresses these risks, and within it, adversarial machine learning (AML) studies how attackers can alter model behavior through manipulated inputs or malicious processes, as well as strategies to defend against such attacks.

This article examines the main attack vectors, documented cases, defenses in use, practical implications for organizations —including in the Latin American context— and the challenges that lie ahead.

Types of adversarial attacks

Adversarial attacks can be classified by when they occur and the objective they pursue. One of the most well-known is evasion, or inference-phase attack. In this case, the adversary introduces small perturbations into a legitimate input, imperceptible to humans but sufficient to induce misclassification by the model. A classic example is an image of a cat subtly altered so that the system mistakenly classifies it as a squirrel.

Another relevant type is data poisoning, where the attacker injects malicious examples into the training or validation set. This can distort the model to the point of inserting backdoors that only activate under specific triggers. Model extraction attacks also exist, consisting of repeatedly querying a publicly accessible model to reconstruct its internal functioning, whether for espionage, intellectual property theft, or preparation of more complex attacks.

Privacy is another dimension at risk. Attacks such as membership inference attempt to deduce whether a particular individual was present in the training data, while model inversion aims to reconstruct sensitive information directly from model outputs. Finally, in the realm of explainability, attacks have emerged that manipulate model explanations, generating misleading interpretations that hide biases or vulnerabilities, a phenomenon known as adversarial explanations.

Real cases and current trends

In practice, these risks are not mere hypotheses. Recent research has demonstrated AI-powered malware capable of evading traditional antivirus systems, showing how attackers also leverage ML to enhance their techniques. At the same time, institutions such as NIST have developed standardized taxonomies that provide a common language to classify and mitigate these threats.

The cost of robust defenses is another concern. Industrial studies indicate that training models with robustness techniques can multiply the resources required compared to conventional training, creating practical dilemmas for organizations. In sectors like manufacturing and industrial control, where AI is applied to monitoring and predictive maintenance, vulnerabilities have been documented that reveal the tangible impact of adversarial attacks in critical environments.

Defense strategies and robustness techniques

Adversarial training is among the most widely used defenses. It consists of exposing the model during training to dynamically generated adversarial examples so it learns to resist them. Although effective, this technique often requires high computational cost. Another approach is randomized smoothing, which adds noise to inputs to evaluate prediction stability and certify robustness against small perturbations.

Other approaches aim to detect adversarial examples rather than making the model itself immune. These methods employ autoencoders, secondary verifiers, or statistical techniques to flag suspicious inputs. Techniques such as defensive distillation and feature squeezing reduce the sensitivity of models to small alterations. Beyond these, certified methods and robust optimization offer theoretical guarantees within specific perturbation bounds, while hybrid techniques and meta-learning approaches aim at more adaptive defenses against novel attacks.

Practical relevance for companies

The adoption of defenses against adversarial attacks cannot be done indiscriminately. Companies need to assess risks based on their threat model, prioritizing AI systems that make critical decisions such as financial fraud detection or authentication. They must also weigh cost-benefit tradeoffs, since many defenses involve greater resource consumption.

Moreover, AI security requires continuous auditing. Red teaming applied to AI models is emerging as an essential practice to evaluate defenses against new attacks. In parallel, regulatory pressure is increasing, as new norms demand more auditable and transparent models. To meet these requirements, organizations must invest not only in technology but also in training, ensuring that data science and cybersecurity teams understand and address ML-related vulnerabilities.

In Latin America, where many companies are still in early phases of AI adoption, security can become a differentiating factor. Organizations that demonstrate robust and trustworthy models will have a competitive advantage over those that prioritize only functionality.

Open challenges and future trends

The future of adversarial machine learning presents significant challenges. These include ensuring scalable robustness for large language models and multimodal architectures, addressing dynamic evasion attacks that adapt in real time, and developing explainability methods that cannot be manipulated. Security in federated and distributed learning, where multiple actors contribute data or partial models, is another sensitive area.

Likewise, a consolidation of international standards certifying model robustness is expected, along with the need to integrate defenses in ecosystems of autonomous AI agents. The outlook makes it clear that AML will remain a central area of research and practice in the coming years.

Conclusion

AI security and adversarial learning represent a critical front in modern cybersecurity. Models must aspire not only to accuracy but also to resilience against increasingly sophisticated adversaries. For professionals and organizations, understanding and anticipating these attacks is not optional but a strategic necessity. Those who act today will be better prepared for a future in which artificial intelligence is ubiquitous —and therefore an inevitable target.

References

Vassilev, A., Oprea, A., Fordyce, A., Anderson, H., Davies, X., & Hamin, M. (2025). Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. NIST Trustworthy and Responsible AI.

Wu, B., Zhu, Z., Liu, L., Liu, Q., He, Z., & Lyu, S. (2023). Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspective. arXiv preprint arXiv:2302.09457.

IBM Research. (2023, January 20). Improving the efficiency of adversarial robustness defenses. IBM Research Blog.

Jedrzejewski, F. V. (2024). Adversarial Machine Learning in Industry: A Systematic Review. Computers & Security, 136, 103715.

Kotyan, S. (2023). A reading survey on adversarial machine learning: Adversarial attacks and their understanding. arXiv preprint arXiv:2308.03363.

Soremekun, E., et al. (2023). Towards Backdoor Attacks and Defense in Robust Models. Computers & Security, 129, 103296.

Baniecki, H., & Biecek, P. (2023). Adversarial attacks and defenses in explainable artificial intelligence: A survey. arXiv preprint arXiv:2306.06123.