I. Introduction  
A. General Definition and Formulation  
B. Three Attack Paradigms at Different Stages of AML  

III. Attack at the Pre-Training Stage  

IV. Attack at the Training Stage  
A. Formulation and Categorization  

V. Attack at the Post-Training Stage  
A. Formulation and Categorization  

VI. Attack at the Deployment Stage  
A. Formulation and Categorization  

VII. Attack at the Inference Stage  
A. Formulation and Categorization  

VIII. Adversarial Machine Learning in Other Scenarios  

IX. Applications  

X. Discussions  

XI. Summary