All articles
Adversarial ML coverage for engineers shipping ML systems. Evasion, data poisoning and backdoors, model extraction, membership inference, training-data extraction, and the multimodal attacks that ride a shared vision encoder into every model downstream of it. Built from the published papers and reference implementations, with the threat model each result assumes stated up front.
-
Backdoor Attack on Neural Networks Detection: What Works
Backdoor detection splits into data, model and input checks. How spectral signatures, Neural Cleanse, STRIP and MNTD work, and where they fail.
-
How Adversarial Examples Fool Image Classifiers
Adversarial examples follow the model's own gradient: a 0.007 per-pixel nudge made GoogLeNet call a panda a gibbon at 99.3%. How and why it works.
-
Fraise Agent Memory Is a Stored Prompt-Injection Surface
Fraise gives LLM agents ranked remember/recall memory over HTTP and MCP. Let untrusted text reach remember and one injection can steer later tool calls.
-
Preprocessing Defenses Fail on Depthwise-Separable Edge CNNs
A new preprint: six preprocessing defenses recover a residual CNN but not depthwise-separable ones, inverting the signal squeeze detectors read.
-
How FGSM Adversarial Attacks Work: Fast Gradient Sign Method
FGSM adds one signed gradient step to every pixel to flip a classifier's prediction. The update rule, epsilon trade-offs, and why PGD replaced it.
-
CLIP Adversarial Attacks: One Perturbation, Every Model
CLIP is the shared vision encoder under most multimodal systems, which is why one universal perturbation now transfers across encoders, tasks and domains.
-
Adversarial Attack Libraries: ART, Foolbox, torchattacks
ART, Foolbox, torchattacks, CleverHans and TextAttack compared on scope, framework support, attack coverage, licence and repository maintenance.
-
GraphRP Defense Against GNN Model Extraction
GraphRP repurposes model reprogramming as a proactive defense against GNN model extraction, avoiding the Euclidean bias that image-borne defenses import.
-
Adversarial ML Testing Tools: ART, ModelScan, Giskard
Which tools red-team a classical ML model: ART for evasion and poisoning, ModelScan for model files, Giskard as a CI gate, mapped to the attack surface.
-
Data Poisoning Attack Detection Methods That Actually Work
A practitioner's rundown of data poisoning attack detection methods: spectral signatures, activation clustering, and what OWASP and NIST recommend.
-
Adversarial Training Best Practices That Survive Evaluation
A practitioner's guide to adversarial training: pick a threat model, run PGD-AT correctly, catch robust overfitting, and evaluate with AutoAttack.
-
PLAA: A 92.78% NIDS Evasion Rate and Feature-Space Attacks
PLAA builds adversarial network traffic at the packet level instead of the flow level, reaching a 92.78% evasion rate against deep-learning NIDS.
-
Unforeseen Attack Robustness: How the UAR Metric Works
OpenAI's Unforeseen Attack Robustness metric scores classifiers against adversarial perturbations they never trained on. What it measures and misses.
-
TRADES vs MART vs PGD-AT: Robust Training Losses
PGD-AT, TRADES, and MART are the three main adversarial-training losses. How each trades clean accuracy for robustness, and when to reach for which.
-
Evaluating Adversarial Robustness Without Fooling Yourself
Most defenses that claim robustness are later broken — not because the idea was bad, but because the evaluation was. Adaptive attacks are non-negotiable.
-
Adversarial Examples vs. Data Poisoning
Adversarial examples attack a deployed model at inference; data poisoning attacks the model before it is deployed. Different timing, different defenses.
-
Adversarial Attacks on Vision-Language Models
Vision-language models widen the adversarial attack surface: crafted images can steer text output, carry typographic payloads, and jailbreak the model.
-
Adversarial Patch Attacks in the Physical World
Printable adversarial patches use transformation-aware optimization to fool vision models across camera conditions and challenge current defenses.
-
Universal Adversarial Perturbations: One Vector, Many Inputs
Universal adversarial perturbations are input-agnostic: one crafted noise vector causes misclassification across most inputs and transfers between models.
-
Adversarial Robustness in NLP: Why Text Attacks Differ
Discrete input spaces, semantic constraints, and human-perceptibility rules change what counts as an adversarial example in text.
-
Data Poisoning and Backdoor Attacks on Foundation Models
Training data manipulation, backdoor triggers, and Trojan attacks against foundation models: what the threat model requires and which defenses hold up.
-
Evasion Attacks on Image Classifiers: FGSM, PGD, and C&W
A technical comparison of FGSM, PGD, and C&W explains their optimization goals, threat models, benchmark roles, limitations, and defensive implications.
-
Gradient Inversion Attacks in Federated Learning
Federated learning ships gradients instead of data. Gradient inversion turns those updates back into training examples, and every defense costs accuracy.
-
Adversarial Transferability: How Black-Box Attacks Work
Adversarial examples transfer across models with different architectures and training sets. Why that happens, and what it means for black-box defenses.
-
Certified Robustness via Randomized Smoothing
Randomized smoothing gives a provable robustness radius. What that certificate actually covers, where it breaks at realistic epsilon, and when to use it.
-
Training Data Extraction from LLMs: Attacks and Defenses
How attackers extract memorized training data from LLMs, from GPT-2 to ChatGPT, how to measure it on Pythia, and which defenses and GDPR tests apply.
-
How the GCG Optimizer Finds Adversarial Suffixes
How the Greedy Coordinate Gradient algorithm builds an adversarial suffix token by token: the gradient step, the top-k candidate search, and its cost.
-
Membership Inference Attacks on Production ML APIs
Shokri et al.'s shadow-model attack is the canonical reference, but the gap between the paper's threat model and a real rate-limited API is wide.