Adversarial attacks most commonly work on a trial and error system. Where an input, say an image of a panda, has nearly imperceptible noise added to it in order to trick the classifier into thinking the image is actually something else, like a penguin. This process of adding noise is repeated until the arrangement of noise is so precise, that it causes the classifier to think that the original panda is in fact, a penguin.

This exploits the fact that classifiers typically use a complex series of numeric vectors and their transformations to understand what it is looking at. So any slight alterations made to an input can lead to exponentially larger consequences and even false categorisations.
spam fails_task lang_mismatch pii not_appropriate hate_speech sexual_content quality toxicity humor helpfulness creativity violence