Enabling Adversarial Robustness in AI Models through Kubeflow MLOps Stavros Bouras1 , Ioannis Korontanis2 , Antonios Makris1 , Konstantinos Tserpes1
arXiv:2605.15249v1 [cs.CR] 14 May 2026
1
School of Electrical and Computer Engineering, National Technical University of Athens, Greece 2 Department of Informatics and Telematics, Harokopio University of Athens, Greece {stavros_bouras, antoniosmakris, tserpes}@mail.ntua.gr, [email protected]
Abstract—AI models are increasingly deployed in cloud-native environments to support scalable and automated services. However, while platforms such as Kubernetes provide strong infrastructure orchestration, security mechanisms specifically designed to protect deployed AI models remain limited. This paper presents security measures for AI models deployed in Kubernetes clusters. The proposed architecture integrates Kubeflow-based MLOps to automatically detect adversarial attacks during the inference phase and trigger defense mechanisms that preserve the models accuracy and reliability. Specifically, a Fast Gradient Sign Method (FGSM) attack is applied at inference time, and a Projected Gradient Descent (PGD)-based adversarial training defense is automatically deployed when a degradation in accuracy is detected. The experimental results indicate that the deployed defense robustifies the model, significantly recovering accuracy relative to the degradation caused by the attack. Index Terms—Adversarial Robustness, Adversarial Machine Learning, Adversarial Attacks, Security, MLOps
I. I NTRODUCTION The use of containerization and orchestration technologies offers numerous benefits for deploying cloud-native applications. Kubernetes is currently the leading container orchestration platform to deploy and scale multi-component applications, deploying them as a set of pods. In Kubernetes, the main built-in security mechanisms are RBAC (Role-Based Access Control) and network policies. RBAC restricts what actions users and applications within the cluster can perform, enforcing the principle of least privilege and helping prevent unauthorized access or privilege escalation. Network policies control the flow of network traffic between pods and namespaces, limiting communication paths and reducing the attack surface. These mechanisms are defined and configured by the cluster administrator, who establishes the appropriate roles, bindings, and network rules to enforce security policies. Both [1], [2] emphasize that proper configuration of the underlying infrastructure in Kubernetes is essential to prevent security breaches. Their studies highlight that common security issues may arise from unverified container images, vulnerabilities in the Kubelet API, poor cluster configuration, insufficiently secure network policies, use of default Kubernetes settings, improperly configured RBAC (Role-Based Access Control) policies, and insecure storage of Kubernetes Secrets. These misconfigurations can lead to multiple types of attacks, including container compromise, privilege escalation, unauthorized access to cluster resources, lateral movement
across nodes, data exfiltration, and denial-of-service (DoS) attacks, posing significant risks to both the integrity and availability of the system. Kubernetes itself is not designed to defend against emerging attack vectors targeting Machine Learning (ML) deployed models, and the platform alone lacks mechanisms to fully mitigate such threats. Instead as it was previously mentioned, the security level of Kubernetes is primarily focused on infrastructure-level concerns such as network and node security. Prior work [3] highlighted the importance of deploying ML models as components of interconnected systems rather than in isolation. A representative example of such an interconnected system is the integration of MLOps tools with Kubernetes to enable automated pipelines that manage the complete lifecycle of ML models and deploy them to production-ready environments for inference. In such environments, models may be susceptible to adversarial attacks and exhibit vulnerabilities during both the training and inference phases, making the need for defensive methods that enhance their robustness evident. Based on this motivation, our paper presents a method for incorporating adversarial robustness into AI models through the MLOps tool Kubeflow1 . Kubeflow is an open-source platform used to build, train, and deploy ML models on Kubernetes. Our approach demonstrates how Kubeflow can be used to automate adversarial attack tracking during the inference phase and apply automated defense pipelines. The remainder of this paper is organized as follows. Section II presents a literature review on Kubernetes attacks and defenses. Section III provides background on both Kubeflow and the adversarial techniques used in the proposed approach. Section IV introduces the proposed architecture and thoroughly examines how adversarial techniques are integrated into Kubeflow. This section also presents the results of our experiments and the experimental. Finally, Section VI discusses the impact of the proposed Kubeflow MLOps architecture on securing models in a Kubernetes environment and explores potential future improvements. II. R ELATED W ORK A review of the existing literature indicates that most research on Kubernetes security primarily focuses on protecting the cluster’s physical or virtual machines, stored data, and 1 https://www.kubeflow.org/
network quality of service. To the best of our knowledge, there is currently limited research on defense techniques specifically designed to protect AI models deployed within Kubernetes. Therefore, existing research primarily focuses on defending against node-level attacks, network-level attacks, and insider threats. Based on [4], the kind of above mentioned threats, should be defended in different phases. The authors propose a conceptual framework that is able to perform vulnerability assessment, identifying weaknesses through container image scanning, Kubernetes analysis, and dependency checks. Next is risk analysis, which prioritizes vulnerabilities using Common Vulnerability Scoring System (CVSS) based on their severity and impact. The third phase focuses on mitigation, including image hardening, runtime monitoring, and strengthened Kubernetes configurations (e.g., RBAC and network policies). This is followed by continuous monitoring for real-time threat detection, updates, and compliance. Finally, incident response defines procedures for handling and reviewing security incidents to improve the overall security of Kubernetes. Center for Internet Security (CIS) benchmark, a widely recognized set of security guidelines for strengthening Kubernetes nodes, is the standard approach for defending against node-level attacks. Rodriguez et al. A framework combining AI-driven certificate management with CIS-benchmarked configurations is proposed in [5], achieving 98.7% certificate rotation accuracy, a 92.4% reduction in configuration drift, and 99.96% cluster availability. This approach is extended in [6] through automated CIS enforcement, AI-driven secrets management, and ML-based autonomous recovery, forming a closed-loop system that ensures compliance and cluster resilience. Similarly, [7] present an AI-driven framework integrating continuous CIS enforcement, predictive certificate and secrets management, and ML-based cluster healing, with prototypes demonstrating a 92% reduction in configuration drift, 99.9% prevention of certificate expiry incidents, and an 85% decrease in Mean Time to Recovery (MTTR). Network-level attacks are among the most prevalent threats in Kubernetes environments, and numerous studies have proposed defenses against them. In [8], GrassHopper, a dynamic cross-layer enforcement system, is presented, aligning VM-level Security Group rules with container-level network policies and scheduling decisions. By automatically updating firewall configurations, GrassHopper ensures consistency across layers. Experimental evaluation on a Kubernetes cluster deployed on OpenStack demonstrates that GrassHopper reduces the network attack surface between VMs by 78-99% without incurring noticeable latency or throughput overhead, effectively mitigating lateral movement while preserving application performance. There are tools designed to protect Kubernetes from multiple classes of attacks. For example, in [9], a framework to enhance security is proposed. The framework integrates KServe2 2 https://kserve.github.io/website/
to deploy scalable ML-based threat detection, CICFlowMeter3 for network traffic feature extraction, and KubeDeceive [10] for dynamically deploying decoys when suspicious activity is detected. These components operate within a MAPE-K loop, enabling continuous monitoring and adaptation. In this approach, ML serves as the core defense mechanism, allowing the system to detect and classify various attack types, including reconnaissance, privilege escalation, and denial-of-service attacks. Experimental results show detection accuracy of up to 91% and decoy success rates reaching 93%, demonstrating the framework’s effectiveness in mitigating threats and improving overall system resilience. A comparable multilayered defense tool is Kubehound, introduced in [11], which is designed to automatically identify security weaknesses in microservice applications deployed on Kubernetes. The tool combines static analysis, examining source code, OpenAPI specifications, and configuration files, with dynamic analysis that scans live clusters, enabling comprehensive detection of security issues. These issues include insufficient access control, exposed services and open ports, overprivileged pods, misconfigured network policies, hardcoded secrets or unencrypted sensitive data, and authentication flaws including token mismanagement. By systematically detecting these vulnerabilities, Kubehound enables organizations to proactively mitigate microservice security risks before they can be exploited. All the aforementioned works focus on protecting the Kubernetes infrastructure at the node and network levels, but they do not address the security of the AI models themselves. This paper addresses this gap by incorporating the adversarial robustness of the deployed AI models as an automated capability within the Kubeflow environment. III. BACKGROUND A. Kubeflow and MLOps Pipelines Kubeflow enables automated, end-to-end orchestration of ML workflows on Kubernetes, supporting distributed model training and deployment as APIs or batch jobs. Its Pipelines Domain Specific Language (DSL) allows developers to define workflows in Python, specifying Docker images through component decorators and defining the execution sequence with a pipeline decorator, including any external dependencies beyond the application code. By leveraging Kubernetes’ orchestration capabilities, Kubeflow Pipelines ensures automation, scalability and reproducibility, while enabling seamless integration of data processing, model evaluation, deployment, and monitoring. The trained model is produced as the final output of the workflow. B. Adversarial Machine Learning ML models are widely deployed in AI applications, yet they remain vulnerable to adversarial attacks. Adversarial Machine Learning (AML) [12] is a subfield of ML that focuses on identifying vulnerabilities in model behavior and studying both the 3 https://github.com/ahlashkari/CICFlowMeter
design of adversarial attacks that exploit these weaknesses and the development of defenses to enhance model robustness and security. The ML life-cycle consists of two major phases, the training phase and the inference phase. Unlike traditional ML, which assumes trusted training and inference, AML considers scenarios in which an adversary deliberately manipulates data or inputs to compromise model behavior. Both phases may be targeted by adversarial attacks, with defenses deployed at each stage to improve model robustness. 1) Adversarial Attacks: A thorough description of adversarial attacks requires the clear definition of three key dimensions [13]: Adversary’s Goal: Depending on the objective of the adversary, the attacks can be broadly grouped into poisoning, evasion and privacy/inference attacks. These attacks occur at different phases of the AI life-cycle, with poisoning attacks targeting the training phase, while evasion and privacy/inference attacks occur during the inference-phase. In poisoning attacks, adversaries have access and can modify the training data in order to influence the behavior of the model during inference [14], [15]. In evasion attacks, attackers target trained ML models without altering their training data or parameters, crafting inputs to mislead the model [16], [17]. Finally, in privacy/inference attacks, adversaries aim to extract information about the model, such as features of training data [18], model parameters [19], [20] and sensitive attributes [21]. • Adversarial Specificity: Depending on whether the attacker aims to induce a specific incorrect model output or simply any incorrect output, adversarial attacks can be further categorized into targeted and untargeted respectively [13]. In a targeted attack, the adversary seeks to force the model to produce a specific, pre-defined incorrect output. For example, in a classification setting, this may correspond to misclassifying an input as a chosen target class. In contrast, an untargeted attack aims only to cause an incorrect output, without constraining the model to any particular outcome. • Adversary’s Knowledge/Capabilities: Based on the information and resources available to the attacker, adversarial attacks are grouped into white-box, gray-box and blackbox [22]. In the white-box setting, the adversary has complete access to the target model along with its architecture, training dataset and parameters. In the gray-box setting, the adversary has partial knowledge and access of the victim model. Finally, in the black-box setting the adversary has no knowledge regarding the victim model and its training data, architecture and parameters. •
2) Adversarial Defenses: To mitigate adversarial threats, defense mechanisms have been developed to enhance the robustness of ML models. Similar to adversarial attacks, these defenses can be applied either during the training phase or at inference phase. Training-time defense mechanisms aim to improve the model resilience during training by exposing
it to adversarial knowledge in its learning process, whereas inference-time defenses aim to protect the deployed model from adversarial inputs during deployment. A well-established example of a training-time defense is adversarial training [17], [23], which involves generating adversarial examples during training to improve model robustness. At the inference stage, a commonly used defense is input reconstruction/purification, where potentially adversarial inputs are transformed before being processed by the model [24], [25]. IV. M ETHODOLOGY A. System Architecture The main methodology of this paper involves integrating AML into an architecture built on Kubeflow. The proposed setup builds on our previous work, which is based on the training architecture of Korontanis et. al [26]. In this design, Kubeflow serves as the core component responsible for orchestrating model training workflows, while also providing a dataset registry that allows users to store and manage datasets used during training. In addition, the setup leverages the Kubernetes NVIDIA plugin and Kyverno to enable temporary pods spawned by Kubeflow to access GPU resources. B. Normal usage - without Attack The normal usage of this architecture is illustrated in Figure 1. Initially, the user uploads a trusted dataset D to the registry and initiates model training through Kubeflow. This process spawns a temporary pod that trains a CNN classifier fA on D by minimizing a loss function L. Upon completion, the trained model fA and its clean baseline accuracy αA are stored in a Kubernetes persistent volume, where αA serves as the systems integrity baseline. The user then deploys an inference pod, which retrieves the model and initiates the inference process. User submits clean data
dataset registry
generates temporary pod for training
initialize training
kubeflow
training pod
deploys inference
retrieves model
inference
volume (trained models)
stores trained model and its accuracy
pod
Fig. 1. Kubeflow Normal Usage
C. Adversarial scenario - Adversarial Examples The adversarial scenario is illustrated in Figure 2 and represents an insider threat, where a malicious user has the ability to deploy a pod and retrieve the trained model fA from the volume (Figure 2). The adversary exploits fA in order to generate an adversarial dataset Dadv , consisting of adversarial examples that will be uploaded to the dataset registry and will deteriorate the accuracy of the deployed model. For the adversarial examples to be generated, the Fast Gradient Sign Method (FGSM) [17] adversarial attack is applied to the clean dataset D. As a result, FGSM crafts adversarial examples by perturbing the samples of D in the direction of the loss gradient, as shown in the following equation: xadv = x + ε · sign (∇x L(fA (x; θA ), y))
(1)
where x is a clean input sample, y is its ground truth label, θA are the parameters of the baseline model, and ε is the magnitude of the perturbation.
Malicious User
where θ refers to the model parameters, D to the data distribution over the inputs x and their corresponding labels y, L the loss function, and S defines the set of allowed perturbations from which δ is optimized. The inner optimization problem is solved using Projected Gradient Descent (PGD) as presented below: ( ( )) xt+1 = Πx+S xt + α sgn ∇x L(θ, xt , y) (3) where xt+1 is the updated adversarial sample at iteration t + 1 given xt , ∇x L(θ, xt , y) is the gradient of the loss with respect to the input, α is the step size and Πx+S is the projection onto the allowed perturbation set S. The allowed perturbation set S is the set of perturbations δ ∈ Rd such that ∥δ∥∞ ≤ ϵ. The parameter ϵ defines the perturbation budget, controlling the radius of the ℓ∞ -ball around each input sample and determining the maximum allowable perturbation of each sample during adversarial training. The defense scenario is shown in Figure 3 and is triggered during the inference phase. The inference pod monitors the accuracy of fA on incoming data and compares it against the stored baseline accuracy αA . If a deterioration of more than 5% in the reported accuracy is reported, the inference pod triggers the defender component, which instructs Kubeflow to initiate an adversarial training pipeline. A temporary pod is being spawned by Kubeflow that loads fA from the volume and performs the defense.
deploys
initiates defence defender
retrieves
attacker
generates temporary pod for robust training kubeflow
stores malicious data
training with defence pod
finds the attack and triggers
inference
volume (trained models)
dataset registry
pod
pod
retrieves model
volume (trained models)
Fig. 2. Kubeflow Adversarial Scenario
D. Defense scenario - Adversarial Training The defense mechanism implemented in this system architecture relies on adversarial training, as presented in [23]. This work frames adversarial training as a saddle point (min-max) optimization problem during which an inner maximization problem identifies perturbations that maximize a loss for a given input and an outer minimization problem finds parameters θ that minimize the loss with respect to θ. Formally this is described in the following equation: [ ] min E(x,y)∼D max L(θ, x + δ, y) (2) θ
δ∈S
Fig. 3. Kubeflow Defence Scenario
V. I MPLEMENTATION AND R ESULTS The adversarial robustness is evaluated under varying attack and defense scenarios. The baseline classifier fA is a Convolutional Neural Network (CNN) [27] trained on the MNIST handwritten digit classification dataset. In addition, the hardened model fA′ was initialized from the weights of fA and fine-tuned using adversarial training using PGDgenerated adversarial examples. Two scenarios were conducted for evaluation, a white-box attack where FGSM was applied
against fA′ , and a transfer attack where fA′ was evaluated with adversarial examples generated from fA , simulating a setting where the adversary does not have knowledge of the deployed hardened model and defense. The experimental setup consisted of both fixed and variable parameters. The fixed parameters that were kept constant across all experiments are shown in Table I. Parameter Epochs (fA ) Epochs (fA′ ) PGD steps (k) Step size (α) Learning rate (fA ) Learning rate (fA′ )
Value 10 20 20 0.01 0.001 0.0001
Description Baseline training Adversarial retraining Iterations per batch PGD step size Baseline training Fine-tuning
Attack ε 0.15 0.15 0.15
Defense ϵ 0.10 0.15 0.20
FGSM on A 64.36% 64.36% 64.36%
FGSM from A on A′ 91.77% 94.56% 95.09%
FGSM from A′ on A′ 89.66% 92.42% 92.66%
Clean A′ 99.37% 99.18% 98.96%
0.20 0.20 0.20
0.15 0.20 0.25
48.36% 48.36% 48.36%
90.98% 92.86% 92.84%
87.36% 88.57% 88.47%
99.22% 98.96% 98.74%
0.25 0.25 0.25
0.20 0.25 0.30
33.43% 33.43% 33.43%
88.15% 89.40% 89.81%
83.01% 83.27% 82.22%
99.00% 98.83% 98.55%
TABLE III C LASSIFICATION ACCURACY (%) ACROSS DIFFERENT ATTACK AND DEFENSE STRENGTHS .
TABLE I F IXED PARAMETERS ACROSS ALL EXPERIMENTS .
Parameter Attack: FGSM perturbation magnitude ε Defense: PGD perturbation budget ϵ
Values tested {0.15, 0.20, 0.25} {0.15, 0.20, 0.25, 0.30}
Transfer Attack: Clean Attack Defense Defense Recovery Attack
Accuracy (%)
Having the aforementioned variables fixed, the variables that varied across the different experiments was the magnitude of the perturbation ε in the FGSM attack and the perturbation budget ϵ of the PGD-adversarial training, as show in Table II.
100 Before 90 80 70 60 50 40 30 20 n Clea
Attack = 0.15 Attack = 0.2 Attack = 0.25 Attack
TABLE II
0
Def 0.1
5
Def 0.1
Stage
0
Def 0.2
5
Def 0.2
0
Def 0.3
VARIABLE PARAMETERS EXPLORED ACROSS EXPERIMENTS . Fig. 4. Accuracy evolution from clean inputs to adversarial attack and subsequent defense recovery in the transfer setting (FGSM from A on A′ ).
White-box Attack: Clean Attack Defense Defense Recovery Attack
100 Before 90 80 70 60 50 40 30 20 n
Accuracy (%)
The conducted experiments report white-box (FGSM from A′ on A′ ) and transfer (FGSM from A on A′ ) classification accuracies across different settings that simulate varying attack and defense strengths, characterized by the FGSM perturbation magnitude ϵ and the PGD perturbation budget ϵ. Specifically, three attacking scenarios were tested described with three different FGSM perturbation magnitudes. For each attacking scenario, the PGD perturbation budget used in the corresponding defense was varied around the attack perturbation magnitude, allowing the evaluation of defense configurations with smaller, equal, or larger perturbation budgets relative to the attack. In addition, the baseline accuracy (FGSM on A) is reported to show the degradation in performance under adversarial attack, while the clean accuracy of A′ is also reported, indicating that the robustified model maintains high performance on unperturbed inputs. All the results are presented in Table III, while Figures 4 and 5 illustrate the accuracy evolution from clean inputs through adversarial attack to defense recovery in the transfer and white-box settings, respectively. Our experiments demonstrate that when the defense budget is equal or slightly over the attack magnitude, the model achieves the highest robustness against both transfer and white-box attacks. When the defense budget is lower than the attack magnitude, the deployed defense performs worse, as it was not trained against perturbations as large as those encountered during inference. These results show that the defense should be calibrated, in this setting, to match the corresponding attack strength in order to achieve optimal performance.
Clea
Attack = 0.15 Attack = 0.2 Attack = 0.25 Attack
0
Def 0.1
5
Def 0.1
Stage
0
Def 0.2
5
Def 0.2
0
Def 0.3
Fig. 5. Accuracy evolution from clean inputs to adversarial attack and subsequent defense recovery in the white-box setting (FGSM from A′ on A′ ).
VI. C ONCLUSIONS & F UTURE WORK This paper presents an approach for integrating adversarial robustness capabilities into AI models deployed within a Kubeflow-based MLOps environment. The proposed architecture is based on an existing Kubeflow-based training setup and extends its capabilities in order to automatically detect and respond to adversarial threats. By integrating adversarial attack and defensive capabilities into the Kubeflow pipeline, the proposed architecture automatically detects and responds to adversarial threats, which in this case is an insider attacker that has white-box access and is able to craft perturbations
based on the deployed model. The experimental evaluation, using FGSM attacks and PGD-based adversarial training, demonstrates that the deployed defense robustifies the model, recovering accuracy significantly relative to the degradation caused by the attack under both white-box and transfer settings. The results further show that the defense achieves the highest robustness when its perturbation budget is calibrated to match or slightly exceed the attack magnitude, highlighting the importance of aligning defense strength with the anticipated threat. As future work, the proposed architecture will be extended to include additional adversarial attacks and defenses targeting both the training and inference phases, securing and evaluating the robustness of AI models across their entire lifecycle. Additionally, integrating node-level and network-level security mechanisms would provide a more holistic defense strategy, ensuring protection of both the underlying Kubernetes infrastructure and the deployed AI models. ACKNOWLEDGMENT This paper has received funding from the European Unions Horizon Europe research and innovation actions under grant agreement No 101168560 (CoEvolution). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the Commission. Neither the European Union nor the granting authority can be held responsible for them. R EFERENCES [1] S. Stanišić, M. Veskovi, O. Risti, and B. orevi, “Security aspects of container orchestration in kubernetes environments,” in 2025 24th International Symposium INFOTEH-JAHORINA (INFOTEH), 2025, pp. 1–5. [2] S. Kampa, “Navigating the landscape of kubernetes security threats and challenges,” Journal of Knowledge Learning and Science Technology ISSN: 2959-6386 (online), vol. 3, no. 4, p. 274281, Oct. 2024. [Online]. Available: https://jklst.org/index.php/home/article/view/266 [3] A. Makris, A. Fournaris, A. Aghaie, I. Arakas, A. M. Anaxagorou, I. Arapakis, D. Bacciu, B. Biggio, G. Bouloukakis, S. Bouras et al., “Coevolution: A comprehensive trustworthy framework for connected machine learning and secure interconnected ai solutions,” in 2025 IEEE International Conference on Cyber Security and Resilience (CSR). IEEE, 2025, pp. 838–845. [4] B. Gajbhiye and P. K. G. Pandian. (2024) Managing vulnerabilities in containerized and kubernetes environments. SSRN. [Online]. Available: https://ssrn.com/abstract=4982847 [5] E. Rodriguez, K. Tanaka, and M. A. Sterling, “Continuous trust and resilience in kubernetes: Ai-driven certificate governance combined with cis-aligned node security.” [6] A. Thorne, L. Chen, and M. Vance, “Towards self-securing kubernetes infrastructure: Integrating cis compliance, ai-driven secrets management, and ml-based recovery.” [7] A. Vance1 , M. Thorne, and L. Petrov, “A unified ai-driven security and resilience framework for kubernetes: Cis compliance, certificate governance, and autonomous healing.” [8] G. Budigiri, C. Baumann, E. Truyen, and W. Joosen, “Elastic crosslayer orchestration of network policies in the kubernetes stack,” IEEE Transactions on Network and Service Management, vol. 22, no. 2, pp. 2031–2058, 2025. [9] A. Aly, A. M. Hamad, M. Al-Qutt, and M. Fayez, “Real-time multi-class threat detection and adaptive deception in kubernetes environments,” Scientific Reports, vol. 15, no. 1, p. 8924, 2025.
[10] A. Ahmed, A. Hamad, M. Fayez, and M. Al-Qutt, “Kubedeceive: Unveiling deceptive approaches to protect kubernetes clusters,” International Journal of Computers and Their Applications, vol. 31, pp. 233–243, 12 2024. [11] G. DellImmagine, J. Soldani, and A. Brogi, “Kubehound: Detecting microservices security smells in kubernetes deployments,” Future Internet, vol. 15, no. 7, 2023. [Online]. Available: https://www.mdpi.com/1999-5903/15/7/228 [12] L. Huang, A. D. Joseph, B. Nelson, B. I. Rubinstein, and J. D. Tygar, “Adversarial machine learning,” in Proceedings of the 4th ACM workshop on Security and artificial intelligence, 2011, pp. 43–58. [13] S. Zhou, C. Liu, D. Ye, T. Zhu, W. Zhou, and P. S. Yu, “Adversarial attacks and defenses in deep learning: From a perspective of cybersecurity,” ACM Computing Surveys, vol. 55, no. 8, pp. 1–39, 2022. [14] B. Biggio, B. Nelson, and P. Laskov, “Poisoning attacks against support vector machines,” arXiv preprint arXiv:1206.6389, 2012. [15] M. Jagielski, A. Oprea, B. Biggio, C. Liu, C. Nita-Rotaru, and B. Li, “Manipulating machine learning: Poisoning attacks and countermeasures for regression learning,” arXiv preprint arXiv:1804.00308, 2018. [16] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013. [17] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572, 2014. [18] M. Fredrikson, E. Lantz, S. Jha, S. Lin, D. Page, and T. Ristenpart, “Privacy in pharmacogenetics: An {End-to-End} case study of personalized warfarin dosing,” in 23rd USENIX security symposium (USENIX Security 14), 2014, pp. 17–32. [19] F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing machine learning models via prediction {APIs},” in 25th USENIX security symposium (USENIX Security 16), 2016, pp. 601–618. [20] B. Wang and N. Z. Gong, “Stealing hyperparameters in machine learning,” in 2018 IEEE symposium on security and privacy (SP). IEEE, 2018, pp. 36–52. [21] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP). IEEE, 2017, pp. 3–18. [22] C. Zhang, L. Zhou, X. Xu, J. Wu, and Z. Liu, “Adversarial attacks of vision tasks in the past 10 years: A survey,” ACM Computing Surveys, vol. 58, no. 2, pp. 1–42, 2025. [23] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017. [24] P. Samangouei, M. Kabkab, and R. Chellappa, “Defense-gan: Protecting classifiers against adversarial attacks using generative models,” arXiv preprint arXiv:1805.06605, 2018. [25] W. Nie, B. Guo, Y. Huang, C. Xiao, A. Vahdat, and A. Anandkumar, “Diffusion models for adversarial purification,” arXiv preprint arXiv:2205.07460, 2022. [26] I. Korontanis, A. Zacharia, A. Makris, M. Pateraki, and K. Tserpes, “Streamlining ml training in kubernetes: An mlops architecture with kubeflow,” in Proceedings of the 15th International Conference on the Internet of Things, ser. IOT ’25. New York, NY, USA: Association for Computing Machinery, 2025, p. 267270. [Online]. Available: https://doi.org/10.1145/3770501.3771304 [27] Z. Li, F. Liu, W. Yang, S. Peng, and J. Zhou, “A survey of convolutional neural networks: analysis, applications, and prospects,” IEEE transactions on neural networks and learning systems, vol. 33, no. 12, pp. 6999–7019, 2021.