Security Evaluation of Classical Machine Learning Models Under Poisoning, Evasion, and Model Extraction Attacks

Abstract

Classical machine learning (ML) models, including Logistic Regression (LR), Support Vector Machines (SVM), Random Forests (RF), and XGBoost, remain widely used in practical applications because of their efficiency, interpretability, and relatively low computational costs. However, their security properties against different adversarial threats are often evaluated independently rather than within a unified comparative framework. This paper presents a unified empirical evaluation of Logistic Regression, Linear SVM, Random Forest, and XGBoost models across image (MNIST and CIFAR-10), text (AG News), and tabular (Adult, Spambase) classification domains. The models are evaluated under three adversarial scenarios: training-time poisoning, inference-time evasion, and black-box model extraction attacks. The empirical results reveal architecture- and attack-dependent security trade-offs. Random Forest demonstrated relatively greater resilience to random label noise in several configurations but remained vulnerable to targeted poisoning, particularly on AG News. In contrast, Logistic Regression and Linear SVM achieved high black-box extraction fidelity under some active-query configurations, reaching 96.08% and 94.02%, respectively, on MNIST with Q = 10,000. Their evasion results were comparatively interpretable under the evaluated attack procedures, although the observed performance depended on the perturbation budget and optimization configuration. In particular, the higher apparent accuracy of Linear SVM under PGD than under FGSM should be interpreted as a configuration-dependent observation rather than evidence of intrinsic robustness or confirmed gradient masking. Overall, the findings indicate that model robustness depends on the interaction between the attack strategy, data representation, and model architecture.