Adversarial ML

• How Adversarial Examples Fool Image Classifiers

  Adversarial examples follow the model's own gradient: a 0.007 per-pixel nudge made GoogLeNet call a panda a gibbon at 99.3%. How and why it works.

• Preprocessing Defenses Fail on Depthwise-Separable Edge CNNs

  A new preprint: six preprocessing defenses recover a residual CNN but not depthwise-separable ones, inverting the signal squeeze detectors read.

• How FGSM Adversarial Attacks Work: Fast Gradient Sign Method

  FGSM adds one signed gradient step to every pixel to flip a classifier's prediction. The update rule, epsilon trade-offs, and why PGD replaced it.

• CLIP Adversarial Attacks: One Perturbation, Every Model

  CLIP is the shared vision encoder under most multimodal systems, which is why one universal perturbation now transfers across encoders, tasks and domains.

• Adversarial Attack Libraries: ART, Foolbox, torchattacks

  ART, Foolbox, torchattacks, CleverHans and TextAttack compared on scope, framework support, attack coverage, licence and repository maintenance.

• GraphRP Defense Against GNN Model Extraction

  GraphRP repurposes model reprogramming as a proactive defense against GNN model extraction, avoiding the Euclidean bias that image-borne defenses import.

• Adversarial ML Testing Tools: ART, ModelScan, Giskard

  Which tools red-team a classical ML model: ART for evasion and poisoning, ModelScan for model files, Giskard as a CI gate, mapped to the attack surface.

• Data Poisoning Attack Detection Methods That Actually Work

  A practitioner's rundown of data poisoning attack detection methods: spectral signatures, activation clustering, and what OWASP and NIST recommend.

• PLAA: A 92.78% NIDS Evasion Rate and Feature-Space Attacks

  PLAA builds adversarial network traffic at the packet level instead of the flow level, reaching a 92.78% evasion rate against deep-learning NIDS.

• TRADES vs MART vs PGD-AT: Robust Training Losses

  PGD-AT, TRADES, and MART are the three main adversarial-training losses. How each trades clean accuracy for robustness, and when to reach for which.

• Evaluating Adversarial Robustness Without Fooling Yourself

  Most defenses that claim robustness are later broken — not because the idea was bad, but because the evaluation was. Adaptive attacks are non-negotiable.

• Adversarial Examples vs. Data Poisoning

  Adversarial examples attack a deployed model at inference; data poisoning attacks the model before it is deployed. Different timing, different defenses.

• Adversarial Attacks on Vision-Language Models

  Vision-language models widen the adversarial attack surface: crafted images can steer text output, carry typographic payloads, and jailbreak the model.

• Adversarial Patch Attacks in the Physical World

  Printable adversarial patches use transformation-aware optimization to fool vision models across camera conditions and challenge current defenses.

• Universal Adversarial Perturbations: One Vector, Many Inputs

  Universal adversarial perturbations are input-agnostic: one crafted noise vector causes misclassification across most inputs and transfers between models.

• Adversarial Robustness in NLP: Why Text Attacks Differ

  Discrete input spaces, semantic constraints, and human-perceptibility rules change what counts as an adversarial example in text.

• Data Poisoning and Backdoor Attacks on Foundation Models

  Training data manipulation, backdoor triggers, and Trojan attacks against foundation models: what the threat model requires and which defenses hold up.

• Evasion Attacks on Image Classifiers: FGSM, PGD, and C&W

  A technical comparison of FGSM, PGD, and C&W explains their optimization goals, threat models, benchmark roles, limitations, and defensive implications.

• Gradient Inversion Attacks in Federated Learning

  Federated learning ships gradients instead of data. Gradient inversion turns those updates back into training examples, and every defense costs accuracy.

• Adversarial Transferability: How Black-Box Attacks Work

  Adversarial examples transfer across models with different architectures and training sets. Why that happens, and what it means for black-box defenses.

• How the GCG Optimizer Finds Adversarial Suffixes

  How the Greedy Coordinate Gradient algorithm builds an adversarial suffix token by token: the gradient step, the top-k candidate search, and its cost.

All tags · Browse all topics