Week 10: Adversarial Examples and Data Poisoning

Dates: Mar 15-19  ·  Reading: Handout 8: Adversarial Attacks on ML Systems

Now the AI model itself is the target. We study attacks on machine-learning systems so we can defend them. Monday: adversarial examples & evasion (fool the input at test time) and data poisoning & backdoors (corrupt the training data). Wednesday: privacy attacks (model inversion, membership inference, model theft) and the full defensive toolkit. Lab 8 released this week.

📄 Read Handout 8 (PDF)

Learning Objectives

• Explain adversarial examples and how they fool ML models
• Describe data poisoning and its impact on model training
• Define model evasion, model inversion, and privacy attacks
• Identify defenses against each attack type

Lecture Slides

⬇ Monday: How AI Systems Are Attacked (PPTX) ⬇ Wednesday: Privacy Attacks & Defenses (PPTX)

Two full 75-minute decks, CSU-branded, with an attack taxonomy, a real adversarial-example on digits, data-poisoning and model-inversion diagrams, an attack→defense map, defensive Colab code, activities, and detailed speaker notes on every slide.

Monday Session

The model as a target: why ML models are fragile. Adversarial examples - tiny, crafted input changes that cause confident wrong predictions - and evasion in the wild (malware, stop signs). Then data poisoning - corrupting the training data - and backdoors that plant a hidden trigger. Includes a sandboxed demo that flips a toy digit classifier.

Wednesday Session

Privacy attacks: how a model can leak its training data (model inversion, membership inference, model theft). Then the defensive toolkit: adversarial training and low-confidence detection (evasion), data vetting and provenance (poisoning), and differential privacy (privacy) - plus the realistic “no perfect defense” view and AI-security governance (NIST, MITRE ATLAS).

Lab

Lab 8: Adversarial Example Explorer. In a sandbox, craft a tiny perturbation that flips a toy digit classifier, visualize how invisible the change is, watch the confidence drop, and apply a detection defense. Purely defensive - never applied to real systems.

⬇ Lab 8 starter notebook (.ipynb)

Download, then open in Google Colab (File → Upload notebook). Submit your completed notebook in Canvas.

Quiz / This Week

Quiz 8. Adversarial examples; data poisoning & backdoors; model evasion; privacy attacks (inversion, membership, theft); and defenses.

In-Class Activity

Craft Adversarial Examples to Fool a Classifier — CTFd capture-the-flag challenge (Colab + browser). Graded, 20 points.

⬇ Activity slides (PPTX) 📄 Student worksheet (PDF)

🚩 CTF challenge starter (.ipynb)

Graded in-class activity with a worksheet. Full rotation on the Activities page.

---

← All lecture notes  ·  Assessments unlock on the Quizzes and Labs pages when the instructor releases them.