Topics
Browse everything Adversarial ML publishes by category and tag: every topic covered here, with the most recent guides listed under each one.
Tags
- #adversarial-ml 21
- #ml-security 14
- #adversarial-examples 8
- #evasion-attacks 8
- #adversarial-robustness 4
- #backdoor-attacks 4
- #data-poisoning 4
- #image-classifiers 3
- #llm-security 3
- #privacy 3
- #tooling 3
- #transferability 3
- #vision-language-models 3
- #adversarial-training 2
- #ai-red-teaming 2
- #clip-attacks 2
- #fgsm 2
- #model-testing 2
- #multimodal-adversarial-attacks 2
- #red-team 2
- #robustness 2
- #robustness-evaluation 2
- #universal-adversarial-perturbations 2
- #adaptive-attacks 1
- #adversarial-defense 1
- #adversarial-nlp 1
- #adversarial-patches 1
- #agent-security 1
- #alignment 1
- #autoattack 1
- #autonomous-vehicles 1
- #black-box-attacks 1
- #carlini-wagner 1
- #certified-robustness 1
- #edge-inference 1
- #evaluation 1
- #feature-space-attacks 1
- #federated-learning 1
- #formal-verification 1
- #foundation-models 1
- #garak 1
- #gcg 1
- #gdpr 1
- #gradient-inversion 1
- #gradient-masking 1
- #graph-neural-networks 1
- #input-agnostic-attacks 1
- #jailbreaking 1
- #mart 1
- #mcp-security 1
- #membership-inference 1
- #memorization 1
- #memory-poisoning 1
- #metrics 1
- #mlaas 1
- #mlsecops 1
- #model-extraction 1
- #model-hardening 1
- #model-inversion 1
- #model-reprogramming 1
- #network-security 1
- #neural-cleanse 1
- #neural-networks 1
- #nids 1
- #nlp 1
- #object-detection 1
- #optimization-attacks 1
- #pgd 1
- #physical-adversarial-attacks 1
- #production-ml 1
- #prompt-injection 1
- #pyrit 1
- #rag-poisoning 1
- #randomized-smoothing 1
- #robustbench 1
- #robustness-accuracy-tradeoff 1
- #text-attacks 1
- #threat-modeling 1
- #trades 1
- #training-data 1
- #training-data-extraction 1
- #transformers 1
- #trojan-detection 1
- #trojan-ml 1
- #unforeseen-attacks 1
- #visual-adversarial-examples 1
- #white-box-attacks 1
Categories
attacks 11 posts
- Fraise Agent Memory Is a Stored Prompt-Injection SurfaceFraise gives LLM agents ranked remember/recall memory over HTTP and MCP. Let untrusted text reach remember and one injection can steer later tool calls.
- CLIP Adversarial Attacks: One Perturbation, Every ModelCLIP is the shared vision encoder under most multimodal systems, which is why one universal perturbation now transfers across encoders, tasks and domains.
- PLAA: A 92.78% NIDS Evasion Rate and Feature-Space AttacksPLAA builds adversarial network traffic at the packet level instead of the flow level, reaching a 92.78% evasion rate against deep-learning NIDS.
- Adversarial Attacks on Vision-Language ModelsVision-language models widen the adversarial attack surface: crafted images can steer text output, carry typographic payloads, and jailbreak the model.
- Adversarial Patch Attacks in the Physical WorldPrintable adversarial patches use transformation-aware optimization to fool vision models across camera conditions and challenge current defenses.
- Universal Adversarial Perturbations: One Vector, Many InputsUniversal adversarial perturbations are input-agnostic: one crafted noise vector causes misclassification across most inputs and transfers between models.
defenses 7 posts
- Backdoor Attack on Neural Networks Detection: What WorksBackdoor detection splits into data, model and input checks. How spectral signatures, Neural Cleanse, STRIP and MNTD work, and where they fail.
- Preprocessing Defenses Fail on Depthwise-Separable Edge CNNsA new preprint: six preprocessing defenses recover a residual CNN but not depthwise-separable ones, inverting the signal squeeze detectors read.
- GraphRP Defense Against GNN Model ExtractionGraphRP repurposes model reprogramming as a proactive defense against GNN model extraction, avoiding the Euclidean bias that image-borne defenses import.
- Data Poisoning Attack Detection Methods That Actually WorkA practitioner's rundown of data poisoning attack detection methods: spectral signatures, activation clustering, and what OWASP and NIST recommend.
- Adversarial Training Best Practices That Survive EvaluationA practitioner's guide to adversarial training: pick a threat model, run PGD-AT correctly, catch robust overfitting, and evaluate with AutoAttack.
- TRADES vs MART vs PGD-AT: Robust Training LossesPGD-AT, TRADES, and MART are the three main adversarial-training losses. How each trades clean accuracy for robustness, and when to reach for which.
primer 3 posts
- How Adversarial Examples Fool Image ClassifiersAdversarial examples follow the model's own gradient: a 0.007 per-pixel nudge made GoogLeNet call a panda a gibbon at 99.3%. How and why it works.
- How FGSM Adversarial Attacks Work: Fast Gradient Sign MethodFGSM adds one signed gradient step to every pixel to flip a classifier's prediction. The update rule, epsilon trade-offs, and why PGD replaced it.
- Adversarial Examples vs. Data PoisoningAdversarial examples attack a deployed model at inference; data poisoning attacks the model before it is deployed. Different timing, different defenses.
privacy 3 posts
- Gradient Inversion Attacks in Federated LearningFederated learning ships gradients instead of data. Gradient inversion turns those updates back into training examples, and every defense costs accuracy.
- Training Data Extraction from LLMs: Attacks and DefensesHow attackers extract memorized training data from LLMs, from GPT-2 to ChatGPT, how to measure it on Pythia, and which defenses and GDPR tests apply.
- Membership Inference Attacks on Production ML APIsShokri et al.'s shadow-model attack is the canonical reference, but the gap between the paper's threat model and a real rate-limited API is wide.
evaluation 2 posts
- Unforeseen Attack Robustness: How the UAR Metric WorksOpenAI's Unforeseen Attack Robustness metric scores classifiers against adversarial perturbations they never trained on. What it measures and misses.
- Evaluating Adversarial Robustness Without Fooling YourselfMost defenses that claim robustness are later broken — not because the idea was bad, but because the evaluation was. Adaptive attacks are non-negotiable.
tooling 2 posts
- Adversarial Attack Libraries: ART, Foolbox, torchattacksART, Foolbox, torchattacks, CleverHans and TextAttack compared on scope, framework support, attack coverage, licence and repository maintenance.
- Adversarial ML Testing Tools: ART, ModelScan, GiskardWhich tools red-team a classical ML model: ART for evasion and poisoning, ModelScan for model files, Giskard as a CI gate, mapped to the attack surface.