What adversarial ML methods are used to evade anti-spam machine learning classifiers?

1. Evasion by small, targeted perturbations — “trick the classifier, keep the content”

Adversaries craft minimal, often automated perturbations of input features so the classifier flips its decision while the message’s malicious intent remains; early empirical work showed PDFs and binaries could be modified with carefully designed adversarial perturbations to bypass ML malware detectors without using classic obfuscation like packing or encryption ^[1]. This same principle maps to spam: word‑level edits, benign token insertion, or paraphrasing produce test‑time “evasion attacks” that cause classifiers trained on content features to mislabel malicious messages as benign ^[2].

2. Poisoning the training set — “make the model learn the wrong boundary”

Literature summarized in review articles notes attackers can corrupt training data to bias models (poisoning), causing classifiers to misclassify future samples; spam‑focused reviews explicitly list poisoning as a major adversarial ML threat during both training and testing phases ^[2]. Spam filters that rely on crowdsourced or incremental labeling are especially vulnerable because attackers can inject many crafted examples to shift decision boundaries ^[2].

3. Surrogate/model‑stealing and transfer attacks — “learn the black box, then attack it”

Researchers describe attacks that first steal or approximate a deployed model (create a surrogate) under low false‑positive constraints, then craft adversarial inputs against that surrogate and transfer them to the target detector; this two‑stage approach has been demonstrated for malware/AV models and is explicitly framed as enabling effective evasion ^[3]. The same strategy applies to spam: if attackers can query or otherwise probe filters, they can build surrogates and then generate evasive spam that transfers to the real system ^[3].

4. Search, evolutionary algorithms and reinforcement learning — “automate variants that still work”

Evolutionary frameworks and RL agents have been used to automatically find variants that preserve malicious behavior yet evade classifiers. Projects like EvadeML use genetic/evolutionary searches to mutate samples while preserving functionality; similarly, RL has been used to perturb binaries to evade static malware detectors — methods transferable in concept to email/spam where content or structure is mutated ^{[4] [5]}. These approaches are valuable to attackers because they don’t require gradient access and can operate in black‑box settings ^{[5] [4]}.

5. Linguistic obfuscation and LLM‑assisted paraphrasing — “say the same thing differently”

Newer work highlights how large language models can paraphrase or linguistically obfuscate malicious scripts (vishing or phishing transcripts) to preserve semantic intent while evading ML detectors that rely on surface patterns; an arXiv study expressly tests LLM‑assisted transformations of vishing transcripts and finds they can circumvent trained classifiers while maintaining deceptive content ^[6]. This shows a growing threat: high‑quality paraphrase/formatting changes can defeat content‑based spam detectors ^[6].

6. Domain‑specific constraints and discrete‑domain attacks — “you can’t tweak pixels; you must change discrete tokens”

Security applications often operate in discrete domains (words, API calls, file structures) rather than continuous image spaces; researchers propose frameworks and provable techniques to craft minimal, feasible edits in these constrained spaces (e.g., for bot detection or website‑fingerprinting), and argue these are directly applicable to spam/bot evasion where each change has a nontrivial cost or side effect ^[7]. This literature cautions defenders that classic gradient attacks aren’t the only realistic threat in discrete, constrained settings ^[7].

7. What defenders and reviewers say — mixed remedies and gaps

Survey and review papers on email spam filtering note the evolving “tricks” spammers use to evade ML and discuss countermeasures (ensemble methods, anomaly detection, hardened classifiers), but they also emphasise limits: false‑positive costs are asymmetric and some defenses remain immature; reviews call for deeper adversarial evaluations in spam settings and note that many studies focus on feature‑based or word‑based classifiers—leaving gaps where LLM‑style obfuscation or surrogate‑based attacks can succeed ^{[8] [9] [2]}.

Limitations: available sources emphasize malware/PDF and general spam/adversarial ML literature rather than a single, comprehensive catalog for modern email/LLM‑assisted spam. If you want, I can use these categories to map concrete attack examples (word insertion, HTML/CSS tricks, URL obfuscation, paraphrasing scripts) and link them to specific papers from the list.