Editorial desk
Adversarial ML Editorial
Adversarial ML Editorial is the publishing identity for Adversarial ML. It is a desk, not a person: no named author, no biography, no professional certifications.
Articles published under this byline are researched from primary sources — vendor and project documentation, published standards and specifications, research papers, and measurements published by whoever took them — drafted with AI assistance, and edited against those cited sources before publication. Nothing here is based on first-hand testing in a private lab, and any figure that appears is attributed to the source it came from.
Corrections go to hello@adversarialml.dev. More detail is on the about page and the editorial disclosure.
Posts (28)
- defenses
Backdoor Attack on Neural Networks Detection: What Works
Backdoor detection splits into data, model and input checks. How spectral signatures, Neural Cleanse, STRIP and MNTD work, and where they fail.
- primer
How Adversarial Examples Fool Image Classifiers
Adversarial examples follow the model's own gradient: a 0.007 per-pixel nudge made GoogLeNet call a panda a gibbon at 99.3%. How and why it works.
- attacks
Fraise Agent Memory Is a Stored Prompt-Injection Surface
Fraise gives LLM agents ranked remember/recall memory over HTTP and MCP. Let untrusted text reach remember and one injection can steer later tool calls.
- defenses
Preprocessing Defenses Fail on Depthwise-Separable Edge CNNs
A new preprint: six preprocessing defenses recover a residual CNN but not depthwise-separable ones, inverting the signal squeeze detectors read.
- primer
How FGSM Adversarial Attacks Work: Fast Gradient Sign Method
FGSM adds one signed gradient step to every pixel to flip a classifier's prediction. The update rule, epsilon trade-offs, and why PGD replaced it.
- attacks
CLIP Adversarial Attacks: One Perturbation, Every Model
CLIP is the shared vision encoder under most multimodal systems, which is why one universal perturbation now transfers across encoders, tasks and domains.
- tooling
Adversarial Attack Libraries: ART, Foolbox, torchattacks
ART, Foolbox, torchattacks, CleverHans and TextAttack compared on scope, framework support, attack coverage, licence and repository maintenance.
- defenses
GraphRP Defense Against GNN Model Extraction
GraphRP repurposes model reprogramming as a proactive defense against GNN model extraction, avoiding the Euclidean bias that image-borne defenses import.
- tooling
Adversarial ML Testing Tools: ART, ModelScan, Giskard
Which tools red-team a classical ML model: ART for evasion and poisoning, ModelScan for model files, Giskard as a CI gate, mapped to the attack surface.
- defenses
Data Poisoning Attack Detection Methods That Actually Work
A practitioner's rundown of data poisoning attack detection methods: spectral signatures, activation clustering, and what OWASP and NIST recommend.
- defenses
Adversarial Training Best Practices That Survive Evaluation
A practitioner's guide to adversarial training: pick a threat model, run PGD-AT correctly, catch robust overfitting, and evaluate with AutoAttack.
- attacks
PLAA: A 92.78% NIDS Evasion Rate and Feature-Space Attacks
PLAA builds adversarial network traffic at the packet level instead of the flow level, reaching a 92.78% evasion rate against deep-learning NIDS.
- evaluation
Unforeseen Attack Robustness: How the UAR Metric Works
OpenAI's Unforeseen Attack Robustness metric scores classifiers against adversarial perturbations they never trained on. What it measures and misses.
- defenses
TRADES vs MART vs PGD-AT: Robust Training Losses
PGD-AT, TRADES, and MART are the three main adversarial-training losses. How each trades clean accuracy for robustness, and when to reach for which.
- evaluation
Evaluating Adversarial Robustness Without Fooling Yourself
Most defenses that claim robustness are later broken — not because the idea was bad, but because the evaluation was. Adaptive attacks are non-negotiable.
- primer
Adversarial Examples vs. Data Poisoning
Adversarial examples attack a deployed model at inference; data poisoning attacks the model before it is deployed. Different timing, different defenses.
- attacks
Adversarial Attacks on Vision-Language Models
Vision-language models widen the adversarial attack surface: crafted images can steer text output, carry typographic payloads, and jailbreak the model.
- attacks
Adversarial Patch Attacks in the Physical World
Printable adversarial patches use transformation-aware optimization to fool vision models across camera conditions and challenge current defenses.
- attacks
Universal Adversarial Perturbations: One Vector, Many Inputs
Universal adversarial perturbations are input-agnostic: one crafted noise vector causes misclassification across most inputs and transfers between models.
- attacks
Adversarial Robustness in NLP: Why Text Attacks Differ
Discrete input spaces, semantic constraints, and human-perceptibility rules change what counts as an adversarial example in text.
- attacks
Data Poisoning and Backdoor Attacks on Foundation Models
Training data manipulation, backdoor triggers, and Trojan attacks against foundation models: what the threat model requires and which defenses hold up.
- attacks
Evasion Attacks on Image Classifiers: FGSM, PGD, and C&W
A technical comparison of FGSM, PGD, and C&W explains their optimization goals, threat models, benchmark roles, limitations, and defensive implications.
- privacy
Gradient Inversion Attacks in Federated Learning
Federated learning ships gradients instead of data. Gradient inversion turns those updates back into training examples, and every defense costs accuracy.
- attacks
Adversarial Transferability: How Black-Box Attacks Work
Adversarial examples transfer across models with different architectures and training sets. Why that happens, and what it means for black-box defenses.
- defenses
Certified Robustness via Randomized Smoothing
Randomized smoothing gives a provable robustness radius. What that certificate actually covers, where it breaks at realistic epsilon, and when to use it.
- privacy
Training Data Extraction from LLMs: Attacks and Defenses
How attackers extract memorized training data from LLMs, from GPT-2 to ChatGPT, how to measure it on Pythia, and which defenses and GDPR tests apply.
- attacks
How the GCG Optimizer Finds Adversarial Suffixes
How the Greedy Coordinate Gradient algorithm builds an adversarial suffix token by token: the gradient step, the top-k candidate search, and its cost.
- privacy
Membership Inference Attacks on Production ML APIs
Shokri et al.'s shadow-model attack is the canonical reference, but the gap between the paper's threat model and a real rate-limited API is wide.