Adversarial attacks can be done 'easily' if you have access to the loss function, harder if not.

Two minute papers - 1 pixel attack:

https://www.youtube.com/watch?v=AOZw1tgD8dA

Decent papers:

https://arxiv.org/abs/1812.00181

https://arxiv.org/pdf/1807.00051