Adversarial ML

The attack surface that follows from everything else in the book. A model is a function you can query, a training set you can probe for, and — once it holds tools — an interpreter with no separation between instructions and data.

Six entries across five branches, none of them stubs.

Evasion

evasion/ ›

inputs constructed to break the model at test time

06.1

Greedy Coordinate Gradientstandard

Discrete optimisation of an adversarial suffix against a refusal-trained model.

O(k·B·d)06.2

Projected Gradient Descent Attackstandard

Iterative L_p-bounded perturbation maximising task loss.

O(k·d)

Poisoning

poisoning/ ›

attacks that arrive during training

06.3

Data Poisoning and Backdoorscommon

Corrupting training data so a trigger produces attacker-chosen behaviour.

O(P)

Privacy

privacy/ ›

what a model discloses about the data it saw

06.4

Membership Inferencecommon

Distinguish training members from held-out data via loss calibration.

O(N)

Stealing

stealing/ ›

reconstructing a model through its API

06.5

Model Extractioncommon

Query-only reconstruction of a victim model's decision function.

O(Q·d)

Agents

agents/ ›

the injection surface that tool use creates

06.6

Prompt Injection Taxonomystandard

Direct, indirect and tool-mediated instruction hijack surfaces.

—