An adversarial-robustness toolkit such as the Adversarial Robustness Toolbox groups its attack classes under headings like evasion, poisoning, extraction and inference. Your engagement grants only query access to a deployed model and explicitly forbids touching its training data or pipeline. Which headings are off the table, and what must you check before picking any class?

### The catalogue is a list of attacker positions, not a difficulty ladder An adversarial-robustness toolkit — the Adversarial Robustness Toolbox (ART) is the canonical example — ships its attacks grouped under headings: evasion, poisoning, extraction, inference. A *heading* here is not a measure of how hard or how strong the attack is. It is a statement about **where in the model's lifecycle the attacker is standing** when the attack happens, and therefore about what the attacker must already be able to do. Read it that way and class selection stops being a matter of taste. | Heading | Attacker position | Hard precondition | What the run costs | What it emits | |---|---|---|---|---| | Evasion | Inference time, on the input | Submit an input, observe some output | Queries (black-box) or local compute (white-box) | Perturbed inputs + a success rate | | Poisoning / backdoor | Upstream, in the data or training path | A **write path** into training data *and* a retrain that actually occurs | The retrain — GPU hours and wall-clock the client controls, not you | A model whose behaviour changed | | Extraction | Query budget, rebuilding an approximation | A large query allowance and explicit permission | Often tens of thousands of metered queries; real money on a paid endpoint | **A surrogate model** — a derived copy of the client's asset | | Inference / membership | Query budget plus candidate records | Queries *and* records you are permitted to hold and test | Queries, plus reference data you may have to obtain | Claims about specific records, often personal data | ### Applying it to the stated scope Query access to a deployed model, training data and pipeline explicitly out of bounds: - **Evasion** fits. It is the heading whose precondition your grant actually satisfies. - **Poisoning and backdoor** are off the table. Both preconditions fail: no write path, and no retrain you can cause. A retrain is not something you can substitute for — it is the mechanism by which a poisoned row becomes a poisoned model. - **Extraction and inference** are *technically* runnable from queries, but their preconditions include a permission, not just an access. Both emit an artefact with legal weight — a copy of the model, or an assertion that a named person's record was in the training set. ### Where the number misleads The dangerous move is not refusing an out-of-scope heading; it is **substituting a lab**. A tester who cannot poison the client's pipeline trains a comparable model locally, poisons that, and reports a backdoor success rate. Every number in that run is real and every number is about the tester's own laptop. The client's deployed model differs in architecture details, training data, data-cleaning steps, canary checks, and whatever review sits between a contributed row and a shipped checkpoint — and it is exactly those differences the finding claims to have tested. The report says "backdoor achieved, 98%"; the honest sentence is "a model I built was backdoorable, and I do not know whether yours is." The second misleading reading is **silence**. A report that lists evasion results and says nothing about poisoning is read by a client as *tested and clean* across the board. Absence of a heading is absence of evidence, and only an explicit coverage statement makes that visible. ### What you check before picking any class For the class you intend to run, write down four things and the line of the rules of engagement that grants each: 1. **Access level required** — weights and gradients, full confidence scores, or bare labels. 2. **Data type accepted** — dense continuous tensors, tabular rows with constraints, or text. 3. **Artefact emitted** — perturbed inputs, a surrogate model, membership claims — and its retention and disposal rules. 4. **Cost shape and ceiling** — queries against a rate cap and a per-call price, or GPU hours against a wall-clock deadline. If any of the four has no grant behind it, either the run is out of scope or its result is unactionable: it describes an attacker position nobody has, and the client cannot reproduce it or remediate against it. When a heading is blocked, the correct output is a named coverage gap in the report — "poisoning and backdoor risk not assessed; no training-data write path was in scope" — not a lab-only run whose framing lets a reader assume the deployed system was tested.