1 Introduction  
1.1 Contributions  
1.2 Related Work  
1.3 Plan of the Paper  
2 Preliminaries  
2.1 Supervised Machine Learning  
2.2 Machine Learning Based Systems  
2.3 Assets, Threats, Vulnerabilities, and Controls  
2.4 Security Risk Assessment  
3 Overview of ML-Specific Security  
3.1 Characteristics of ML-Specific Security  
3.2 Damage to ML-Based Systems  
3.3 ML-Specific Security  
4 Assets and Stakeholders in the Lifecycle of ML-Based Systems  
4.1 Assets in ML-Based Systems  
4.2 Stakeholders and Their Situations in ML-Based Systems  
5 Attacks Against ML-Based Systems  
5.1 Taxonomy of ML-Specific Threats  
5.2 Attack Surface and Attackers  
5.3 Information Available to Attackers  
6 ML-Specific Threats, Vulnerabilities, and Controls  
6.1 Outline  
6.2 Data Poisoning Attacks  
6.3 Model Poisoning Attacks  
6.4 Exploitation of Poisoned Models  
6.5 Model Extraction Attacks  
6.6 Evasion Attacks  
6.7 Sponge Attacks  
6.8 Information Leakage Attacks of Training Data  
6.9 System-Level Vulnerabilities and Controls to Malicious Input to Systems  
6.10 System-Level Vulnerabilities and Controls to Common in ML-Specific Threats  
7 Summary Tables and Conclusion