All articles
-
Adversarial Attack Libraries: ART, Foolbox, torchattacks
ART, Foolbox, torchattacks, CleverHans and TextAttack compared on scope, framework support, attack coverage, licence and repository maintenance.
-
CLIP Adversarial Attacks: One Perturbation, Every Model
CLIP is the shared vision encoder under most multimodal systems, which is why one universal perturbation now transfers across encoders, tasks and domains.
-
GraphRP: A Structure-Aware Defense Against GNN Model Extraction
GraphRP repurposes model reprogramming as a proactive defense against GNN model extraction, avoiding the Euclidean bias that image-borne defenses import.
-
Best AI Red Teaming Tools for ML Models in 2026
A practitioner's guide to the tools used to red team machine learning models: PyRIT, garak, ART, ModelScan, and Giskard, and where each fits a pipeline.
-
Data Poisoning Attack Detection Methods That Actually Work
A practitioner's rundown of data poisoning attack detection methods: spectral signatures, activation clustering, and what OWASP and NIST recommend.
-
Adversarial Training Best Practices That Survive Evaluation
A practitioner's guide to adversarial training: pick a threat model, run PGD-AT correctly, catch robust overfitting, and evaluate with AutoAttack.
-
PLAA: A 92.78% NIDS Evasion Rate and Feature-Space Attacks
PLAA builds adversarial network traffic at the packet level instead of the flow level, reaching a 92.78% evasion rate against deep-learning NIDS.
-
Embedding Inversion: Reconstructing Text From Vectors
Embedding inversion recovers the original text from a model's embedding vectors, breaking the assumption that stored embeddings are privacy-safe.
-
Testing Robustness Against Unforeseen Adversaries: The UAR Metric
OpenAI's Unforeseen Attack Robustness metric scores classifiers against adversarial perturbations they never trained on. What it measures and misses.
-
Adversarial Training Methods: PGD-AT, TRADES, and MART
Adversarial training is the most defensible empirical robustness method, but 'adversarial training' isn't one thing.
-
Evaluating Adversarial Robustness Without Fooling Yourself
Most defenses that claim robustness are later broken — not because the idea was bad, but because the evaluation was. Adaptive attacks are non-negotiable.
-
Adversarial Examples vs. Data Poisoning: Timing Is Everything
Adversarial examples attack a deployed model at inference; data poisoning attacks the model before it is deployed. Different timing, different defenses.
-
Adversarial Attacks on Vision-Language Models: CLIP, LLaVA, GPT-4
Vision-language models widen the adversarial attack surface: crafted images can steer text output, carry typographic payloads, and jailbreak the model.
-
Adversarial Patch Attacks: Physical Perturbations That Fool ML
Adversarial patches are large, visible, localized perturbations designed to survive physical-world conditions — printing, lighting, and camera optics.
-
Membership Inference vs. Model Inversion: Privacy Attacks
Membership inference asks 'was this sample in the training set?' Model inversion asks 'what samples were in the training set?
-
Universal Adversarial Perturbations: One Vector That Fools Inputs
Universal adversarial perturbations are input-agnostic: one crafted noise vector causes misclassification across most inputs and transfers between models.
-
Adversarial Robustness in NLP: Why Text Attacks Are Different
Discrete input spaces, semantic constraints, and human-perceptibility rules change what counts as an adversarial example in text.
-
Data Poisoning and Backdoor Attacks on Foundation Models
Training data manipulation, backdoor triggers, and Trojan attacks against foundation models: what the threat model requires and which defenses hold up.
-
Evasion Attacks on Image Classifiers: FGSM, PGD, and C&W
The three foundational gradient-based evasion attacks, what each one actually optimizes, and what the benchmark numbers mean when you're evaluating a defense.
-
Model Inversion Attacks: Reconstructing Training Data from Output
From Fredrikson's pharmacogenetics exploit to gradient inversion, model inversion attacks recover private training data most ML teams assume is safe.
-
Adversarial Transferability: Why Black-Box Attacks Work at All
Adversarial examples transfer across models with different architectures and training sets. Why that happens, and what it means for black-box defenses.
-
Certified Robustness via Randomized Smoothing: What It Guarantees
Randomized smoothing gives a provable robustness radius. What that certificate actually covers, where it breaks at realistic epsilon, and when to use it.
-
Training Data Extraction from LLMs: The Carlini Results Explained
Carlini et al. demonstrated verbatim extraction of training data from GPT-2. The results have been widely misread. What the extraction numbers actually show.
-
GCG-Class Adversarial Suffix Attacks: A 2026 Practitioner Primer
The math, the cost curve, and why optimization-based adversarial suffix attacks are now within reach of solo practitioners, plus what defenders can do.
-
Membership Inference Attacks: What Works on Production ML APIs
Shokri et al.'s shadow-model attack is the canonical reference, but the gap between the paper's threat model and a real rate-limited API is wide.
-
Model Extraction via Query-Based Functional Stealing
Query-based model stealing can recover a functionally equivalent model from API access alone, and the economics matter more than the technique.