jiep/offensive-ai-compilationA curated list of useful resources that cover Offensive AI.
A curated list of useful resources that cover Offensive AI.
Exploiting the vulnerabilities of AI models.
Adversarial Machine Learning is responsible for assessing their weaknesses and providing countermeasures.
It is organized into four types of attacks: extraction, inversion, poisoning and evasion.
It tries to steal the parameters and hyperparameters of a model by making requests that maximize the extraction of information.
Depending on the knowledge of the adversary's model, white-box and black-box attacks can be performed.
In the simplest white-box case (when the adversary has full knowledge of the model, e.g., a sigmoid function), one can create a system of linear equations that can be easily solved.
In the generic case, where there is insufficient knowledge of the model, the substitute model is used. This model is trained with the requests made to the original model in order to imitate the same functionality as the original one.
Training a substitute model is equivalent (in many cases) to training a model from scratch.
Very computationally intensive.
The adversary has limitations on the number of requests before being detected.
Rounding of output values.
Use of differential privacy.
Use of ensembles.
Use of specific defenses
They are intended to reverse the information flow of a machine-learning model.
They enable an adversary to know the model that was not explicitly intended to be shared.
They allow us to know the training data or information as statistical properties of the model.
Three types are possible:
Membership Inference Attack (MIA): An adversary attempts to determine whether a sample was employed as part of the training.
Property Inference Attack (PIA): An adversary aims to extract statistical properties that were not explicitly encoded as features during the training phase.
Reconstruction: An adversary tries to reconstruct one or more samples from the training set and/or their corresponding labels. Also called inversion.
Use of advanced cryptography. Countermeasures include differential privacy, homomorphic cryptography and secure multiparty computation.
Use of regularization techniques such as Dropout due to the relationship between overtraining and privacy.
Model compression has been proposed as a defense against reconstruction attacks.
They aim to corrupt the training set by causing a machine-learning model to reduce its accuracy.
This attack is difficult to detect when performed on the training data since the attack can propagate among different models using the same training data.
The adversary seeks to destroy the availability of the model by modifying the decision boundary and, as a result, producing incorrect predictions or, create a backdoor in a model. In the latter, the model behaves correctly (returning the desired predictions) in most cases, except for certain inputs specially created by the adversary that produce undesired results. The adversary can manipulate the results of the predictions and launch future attacks.
BadNets are the simplest type of backdoor in a machine learning model. Moreover, BadNets are able to be preserved in a model, even if they are retrained again for a different task than the original model (transfer learning).
It is important to note that public pre-trained models may contain backdoors.
Detection of poisoned data, along with the use of data sanitization.
Robust training methods.
Specific defenses.
An adversary adds a small perturbation (in the form of noise) to the input of a machine learning model to make it classify incorrectly (example adversary).
They are similar to poisoning attacks, but their main difference is that evasion attacks try to exploit the weaknesses of the model in the inference phase.
The goal of the adversary is for adversarial examples to be imperceptible to a human.
Two types of attack can be performed depending on the output desired by the opponent:
Targeted: the adversary aims to obtain a prediction of his choice.
Untargeted: the adversary intends to achieve a misclassification.
The most common attacks are white-box attacks:
Adversarial training, which consists of crafting adversarial examples during training to allow the model to learn features of the adversarial examples, making the model more robust to this type of attack.
Transformations on inputs.
Gradient masking/regularization. Not very effective.
Weak defenses.
Prompt Injection Defenses: Every practical and proposed defense against prompt injection.
Lakera PINT Benchmark: The Prompt Injection Test (PINT) Benchmark provides a neutral way to evaluate the performance of a prompt injection detection system, like Lakera Guard, without relying on known public datasets that these tools can use to optimize for evaluation performance.
Devil's Inference: A method to adversarially assess the Phi-3 Instruct model by observing the attention distribution across its heads when exposed to specific inputs. This approach prompts the model to adopt the 'devil's mindset’, enabling it to generate outputs of a violent nature.
Over-the-Air Adversarial Attack Detection: from Datasets to Defenses
Harnessing Hyperbolic Geometry for Harmful Prompt Detection and Sanitization
Adversarial Robustness Toolbox, abbreviated as ART, is an open-source Adversarial Machine Learning library for testing the robustness of machine learning models.
It is developed in Python and implements extraction, inversion, poisoning and evasion attacks and defenses.
ART supports the most popular frameworks: Tensorflow, Keras, PyTorch, MxNet, and ScikitLearn among many others.
It is not limited to the use of models that use images as input but also supports other types of data, such as audio, video, tabular data, etc.
Cleverhans is a library for performing evasion attacks and testing the robustness of a deep learning model on image models.
It is developed in Python and integrates with the Tensorflow, Torch and JAX frameworks.
It implements numerous attacks such as L-BFGS, FGSM, JSMA, C&W, among others.
AI is used to accomplish malicious tasks and boost classic attacks.
| Name | Type | Supported algorithms | Supported attack types | Attack/Defence | Supported frameworks | Popularity |
|---|
| Cleverhans | Image | Deep Learning | Evasion | Attack | Tensorflow, Keras, JAX | |
| Foolbox | Image | Deep Learning | Evasion | Attack | Tensorflow, PyTorch, JAX | |
| ART | Any type (image, tabular data, audio,...) | Deep Learning, SVM, LR, etc. | Any (extraction, inference, poisoning, evasion) | Both | Tensorflow, Keras, Pytorch, Scikit Learn | |
| TextAttack | Text | Deep Learning | Evasion | Attack | Keras, HuggingFace | |
| Advertorch | Image | Deep Learning | Evasion | Both | --- | |
| AdvBox | Image | Deep Learning | Evasion | Both | PyTorch, Tensorflow, MxNet | |
| DeepRobust | Image, graph | Deep Learning | Evasion | Both | PyTorch | |
| Counterfit | Any | Any | Evasion | Attack | --- | |
| Adversarial Audio Examples | Audio | DeepSpeech | Evasion | Attack | --- |
