ISO/IEC 27090 Explained #2 · AI Security · 27 October 2026
What if a few stickers could trick a self-driving car? No hacking. No stolen passwords. Just manipulated input. That’s an evasion attack, the second AI attack type in my ISO/IEC 27090 Explained series.
AI isn’t the real problem. Ungoverned AI is. Standards like ISO/IEC 27090 exist to help organizations use AI safely, and evasion attacks show why that matters.
What is an evasion attack?
An evasion attack fools an AI system at the moment it makes a decision. The attacker doesn’t change the model’s code and doesn’t touch its training data. Instead, they change what the AI sees, often so slightly that a person wouldn’t notice.
Take a vision model trained to recognize traffic signs, lane markings and pedestrians. An attacker tests different visual patterns until they find one that confuses it, then places that pattern where a camera can see it. The camera captures the image and the AI processes it normally, but it now reads a few stickers as a lane boundary that isn’t there. If the driving system relies on that reading, it can make the wrong steering decision.
The model hasn’t changed. What it sees has.
Why it matters beyond cars
Self-driving cars make the risk easy to picture, but the same idea applies anywhere AI makes decisions from inputs:
| AI system | What an evasion attack could do |
|---|---|
| Facial recognition | A carefully designed pattern makes the system fail to recognize someone |
| Malware scanners | A malicious file is changed so it still works, but the AI labels it harmless |
| Fraud detection | Transactions are shaped so the model scores them as legitimate |
| Identity verification | Manipulated images or documents pass automated checks |
A private model isn’t automatically a safe model. Attackers don’t always need access to your exact model. They can develop an attack against a similar one, and it often still works against yours. This is known as attack transferability.
Why evasion attacks are hard to catch
The changes can be tiny. A person looks at the input and sees nothing suspicious, while the AI sees something completely different, and it can be very confident in its wrong answer. That’s what makes evasion so serious when AI is deciding whether a transaction is fraud, whether a file is malware, or whether a vehicle should change direction.
The point isn’t that AI is unreliable. It’s that AI needs the same security thinking we apply to everything else we trust with important decisions.
How to defend against evasion attacks
- Test your AI against manipulated inputs. Don’t only test with clean, normal data. Challenge the system with realistic adversarial inputs before deployment, and keep doing it throughout its life. AI red teaming is one way to do this.
- Add independent checks for high-risk decisions. If the AI affects safety, security or someone’s money, don’t rely on one prediction alone. Use other signals, extra controls, or human review when the risk justifies it.
- Monitor for suspicious behavior. Watch for unusual inputs, repeated attempts to probe the system, and sudden changes in accuracy. And have a response plan, because spotting an attack only helps if you know what to do next.
The goal isn’t to make AI impossible to fool. It’s to make attacks harder, catch problems earlier, and limit the damage when the AI gets something wrong. Govern it well, and AI becomes something you can trust and scale with confidence.
Where this fits in your AI governance program
Evasion is an AI-specific threat that traditional vulnerability scanning won’t find, so it belongs in your AI risk assessment (Step 5 of my 8 steps to build an AI governance program). Start by checking your AI inventory for systems that make decisions from images, documents, files or transactions. Those are the ones most exposed.
ISO/IEC 27090 Explained: the series
- Data poisoning (Clause 6.2)
- Evasion (Clause 6.3), you are here
- Membership inference (Clause 6.4), coming next
New to the standard? Start with the ISO/IEC 27090 overview, or subscribe on YouTube to follow the series.
This is my own explanation and examples. Evasion attacks are covered in ISO/IEC 27090:2026, Clause 6.3. For the full guidance, obtain the standard from ISO. The road sticker example refers to public research by Tencent Keen Security Lab (2019). General education, not legal advice.