#adversarial-ml

• Adversarial Attack Libraries: ART, Foolbox, torchattacks

  ART, Foolbox, torchattacks, CleverHans and TextAttack compared on scope, framework support, attack coverage, licence and repository maintenance.

• CLIP Adversarial Attacks: One Perturbation, Every Model

  CLIP is the shared vision encoder under most multimodal systems, which is why one universal perturbation now transfers across encoders, tasks and domains.

• GraphRP: A Structure-Aware Defense Against GNN Model Extraction

  GraphRP repurposes model reprogramming as a proactive defense against GNN model extraction, avoiding the Euclidean bias that image-borne defenses import.

• Best AI Red Teaming Tools for ML Models in 2026

  A practitioner's guide to the tools used to red team machine learning models: PyRIT, garak, ART, ModelScan, and Giskard, and where each fits a pipeline.

• PLAA: A 92.78% NIDS Evasion Rate and Feature-Space Attacks

  PLAA builds adversarial network traffic at the packet level instead of the flow level, reaching a 92.78% evasion rate against deep-learning NIDS.

• Embedding Inversion: Reconstructing Text From Vectors

  Embedding inversion recovers the original text from a model's embedding vectors, breaking the assumption that stored embeddings are privacy-safe.

• Adversarial Training Methods: PGD-AT, TRADES, and MART

  Adversarial training is the most defensible empirical robustness method, but 'adversarial training' isn't one thing.

• Evaluating Adversarial Robustness Without Fooling Yourself

  Most defenses that claim robustness are later broken — not because the idea was bad, but because the evaluation was. Adaptive attacks are non-negotiable.

• Adversarial Examples vs. Data Poisoning: Timing Is Everything

  Adversarial examples attack a deployed model at inference; data poisoning attacks the model before it is deployed. Different timing, different defenses.

• Adversarial Attacks on Vision-Language Models: CLIP, LLaVA, GPT-4

  Vision-language models widen the adversarial attack surface: crafted images can steer text output, carry typographic payloads, and jailbreak the model.

• Adversarial Patch Attacks: Physical Perturbations That Fool ML

  Adversarial patches are large, visible, localized perturbations designed to survive physical-world conditions — printing, lighting, and camera optics.

• Membership Inference vs. Model Inversion: Privacy Attacks

  Membership inference asks 'was this sample in the training set?' Model inversion asks 'what samples were in the training set?

• Universal Adversarial Perturbations: One Vector That Fools Inputs

  Universal adversarial perturbations are input-agnostic: one crafted noise vector causes misclassification across most inputs and transfers between models.

• Adversarial Robustness in NLP: Why Text Attacks Are Different

  Discrete input spaces, semantic constraints, and human-perceptibility rules change what counts as an adversarial example in text.

• Data Poisoning and Backdoor Attacks on Foundation Models

  Training data manipulation, backdoor triggers, and Trojan attacks against foundation models: what the threat model requires and which defenses hold up.

• Evasion Attacks on Image Classifiers: FGSM, PGD, and C&W

  The three foundational gradient-based evasion attacks, what each one actually optimizes, and what the benchmark numbers mean when you're evaluating a defense.

• Model Inversion Attacks: Reconstructing Training Data from Output

  From Fredrikson's pharmacogenetics exploit to gradient inversion, model inversion attacks recover private training data most ML teams assume is safe.

• Adversarial Transferability: Why Black-Box Attacks Work at All

  Adversarial examples transfer across models with different architectures and training sets. Why that happens, and what it means for black-box defenses.

• GCG-Class Adversarial Suffix Attacks: A 2026 Practitioner Primer

  The math, the cost curve, and why optimization-based adversarial suffix attacks are now within reach of solo practitioners, plus what defenders can do.

• Model Extraction via Query-Based Functional Stealing

  Query-based model stealing can recover a functionally equivalent model from API access alone, and the economics matter more than the technique.

Browse all topics