adversarial-ml.json

[
  {
    "Instruction": "How to perform security assessment of machine learning models?",
    "Input": "Audit an ML model for adversarial vulnerabilities and data poisoning risks.",
    "Output": "## ML Model Security Assessment\n\n### Adversarial Attacks\n```python\n# Fast Gradient Sign Method (FGSM)\nimport torch\n\ndef fgsm_attack(model, image, label, epsilon):\n    image.requires_grad = True\n    output = model(image)\n    loss = torch.nn.functional.cross_entropy(output, label)\n    model.zero_grad()\n    loss.backward()\n    perturbed_image = image + epsilon * image.grad.data.sign()\n    return perturbed_image\n\n# Projected Gradient Descent (PGD)\ndef pgd_attack(model, image, label, epsilon, alpha, num_iter):\n    perturbed_image = image.clone().detach()\n    for i in range(num_iter):\n        perturbed_image.requires_grad = True\n        output = model(perturbed_image)\n        loss = torch.nn.functional.cross_entropy(output, label)\n        model.zero_grad()\n        loss.backward()\n        perturbed_image = perturbed_image + alpha * perturbed_image.grad.data.sign()\n        perturbed_image = torch.clamp(perturbed_image, image - epsilon, image + epsilon)\n    return perturbed_image\n```\n\n### Data Poisoning\n```python\n# Backdoor attack\n# Inject malicious samples into training data\n\ndef create_backdoor_sample(image, trigger, label):\n    poisoned_image = image.clone()\n    poisoned_image[:, :trigger_size, :trigger_size] = trigger\n    return poisoned_image, target_label\n```\n\n### Model Extraction\n```python\n# Query-based extraction\n# Send queries to API and train substitute model\n\ndef extract_model(api, num_queries):\n    queries = generate_random_inputs(num_queries)\n    predictions = [api.predict(q) for q in queries]\n    substitute_model = train_model(queries, predictions)\n    return substitute_model\n```\n\n### Privacy Attacks\n```python\n# Membership inference\n# Determine if specific data was in training set\n\ndef membership_inference(model, sample):\n    confidence = model.predict(sample)\n    # High confidence suggests membership\n    return confidence > threshold\n\n# Model inversion\n# Reconstruct training data from model\n```\n\n### Defense Mechanisms\n```python\n# Adversarial training\ndef adversarial_training(model, data, labels, epsilon):\n    perturbed_data = fgsm_attack(model, data, labels, epsilon)\n    loss = train_step(model, perturbed_data, labels)\n    return loss\n\n# Differential privacy\nfrom opacus import PrivacyEngine\nprivacy_engine = PrivacyEngine()\nmodel, optimizer, dataloader = privacy_engine.make_private(\n    module=model,\n    optimizer=optimizer,\n    data_loader=dataloader,\n    noise_multiplier=1.0,\n    max_grad_norm=1.0,\n)\n```\n\n### Tools\n- CleverHans\n- Foolbox\n- ART (Adversarial Robustness Toolbox)\n- TextAttack\n- Counterfit\n- Microsoft Counterfit",
    "Metadata": {
      "category": "ai-ml-security",
      "tools": ["CleverHans", "Foolbox", "ART", "TextAttack"],
      "technique": "ml-security-audit"
    }
  }
]