#ml-security

• Adversarial Attack Libraries: ART, Foolbox, torchattacks

  ART, Foolbox, torchattacks, CleverHans and TextAttack compared on scope, framework support, attack coverage, licence and repository maintenance.

• CLIP Adversarial Attacks: One Perturbation, Every Model

  CLIP is the shared vision encoder under most multimodal systems, which is why one universal perturbation now transfers across encoders, tasks and domains.

• Data Poisoning Attack Detection Methods That Actually Work

  A practitioner's rundown of data poisoning attack detection methods: spectral signatures, activation clustering, and what OWASP and NIST recommend.

• Adversarial Training Best Practices That Survive Evaluation

  A practitioner's guide to adversarial training: pick a threat model, run PGD-AT correctly, catch robust overfitting, and evaluate with AutoAttack.

• Embedding Inversion: Reconstructing Text From Vectors

  Embedding inversion recovers the original text from a model's embedding vectors, breaking the assumption that stored embeddings are privacy-safe.

• Adversarial Examples vs. Data Poisoning: Timing Is Everything

  Adversarial examples attack a deployed model at inference; data poisoning attacks the model before it is deployed. Different timing, different defenses.

• Membership Inference vs. Model Inversion: Privacy Attacks

  Membership inference asks 'was this sample in the training set?' Model inversion asks 'what samples were in the training set?

• Adversarial Robustness in NLP: Why Text Attacks Are Different

  Discrete input spaces, semantic constraints, and human-perceptibility rules change what counts as an adversarial example in text.

• Data Poisoning and Backdoor Attacks on Foundation Models

  Training data manipulation, backdoor triggers, and Trojan attacks against foundation models: what the threat model requires and which defenses hold up.

• Adversarial Transferability: Why Black-Box Attacks Work at All

  Adversarial examples transfer across models with different architectures and training sets. Why that happens, and what it means for black-box defenses.

• Certified Robustness via Randomized Smoothing: What It Guarantees

  Randomized smoothing gives a provable robustness radius. What that certificate actually covers, where it breaks at realistic epsilon, and when to use it.

• Membership Inference Attacks: What Works on Production ML APIs

  Shokri et al.'s shadow-model attack is the canonical reference, but the gap between the paper's threat model and a real rate-limited API is wide.

• Model Extraction via Query-Based Functional Stealing

  Query-based model stealing can recover a functionally equivalent model from API access alone, and the economics matter more than the technique.

Browse all topics