Concept library
883 concepts across 20 domains and 101 tracks. Each track is a coherent sequence — read it top to bottom or dip in wherever the gap is.
All domains
01Foundations
02Transformer Internals
03Training & Fine-Tuning
04Reinforcement Learning
05Inference, Systems & Hardware
06Applied LLM Engineering
07Reasoning, Evaluation & Safety
08Multimodal & Applications
09Classical ML & Statistical Learning
10Causal Inference & Experimentation
11Time Series & Forecasting
12Graphs, Recommenders & Structured Data
13Generative Modelling Beyond Transformers
14Efficiency, Compression & Edge AI
15Search & Information Retrieval
16Data & Feature Engineering
17MLOps & Platform Engineering
18Security, Privacy & Adversarial ML
19Governance, Risk & Responsible AI
20Human-AI Interaction, Product & Economics
18
Security, Privacy & Adversarial ML
Attacks on models, data and the supply chain, and the defences that survive contact.
5tracks
25concepts
300cards
3.0hreading
Adversarial Robustness Perturbation attacks, adversarial training, certified defences, and the robustness-accuracy tradeoff. 5 concepts · 58 cards
- 01 Adversarial Examples and the Threat Model Why an imperceptible perturbation flips a confident classifier, what a norm ball is actually assuming, and why stating the threat model precisely is the first substantive step in any robustness claim.
- 02 Adversarial Training and Certified Defences The min-max formulation behind the only empirical defence that has held up, what a certificate actually guarantees, and the gap between certified and empirical robustness.
- 03 Data Poisoning and Backdoors How an attacker who controls a small fraction of training data can install a trigger, why backdoors are nearly invisible to standard evaluation, and what the web-scale training setting makes possible.
- 04 Model Extraction and Membership Inference What an attacker can learn from query access alone, why confident outputs leak training set membership, and the defences that trade utility for protection.
- 05 Robustness Evaluation That Means Something Why fixed-attack benchmarks systematically overstate robustness, what an adaptive evaluation requires, and the reporting practices that make a robustness claim checkable.
Privacy-Preserving ML Differential privacy accounting, federated learning, secure aggregation, and the utility cost of each guarantee. 5 concepts · 62 cards
- 01 PII Detection and Redaction Pipelines Why regular expressions catch the easy half, how the recall-utility tradeoff differs between training corpora and live traffic, and the re-identification risk that survives field-level redaction.
- 02 Differential Privacy and the Epsilon You Actually Get What the differential privacy guarantee says precisely, how DP-SGD achieves it through clipping and noise, and why the epsilon values used in practice permit far more leakage than the formalism's reputation suggests.
- 03 Federated Learning and Secure Aggregation Why keeping data on device is not by itself a privacy guarantee, how gradient inversion recovers training inputs, and what secure aggregation does and does not prevent.
- 04 Machine Unlearning What it would mean to remove a training example's influence from a model, why retraining is the only exact method, and the approximate approaches and their verification problem.
- 05 Synthetic Data and What It Does Not Protect Why generating data from a model trained on real records does not by itself anonymise anything, the utility-privacy frontier that no generator escapes, and the evaluation that a synthetic dataset needs.
LLM Application Security Injection across trust boundaries, tool and sandbox escape, secret exposure and threat modelling for agents. 5 concepts · 60 cards
- 01 Agent Permissions and Blast Radius How to design tool access for a component you must assume is compromised, why capability scoping beats identity-based permissions here, and the reversibility test that decides what needs confirmation.
- 02 Output Handling and Downstream Injection Why model output is untrusted input to everything it touches, the injection classes that follow from rendering or executing it, and the encoding discipline that prevents them.
- 03 Prompt Injection as a Trust Boundary Failure Why injection is architectural rather than a prompting problem, the distinction between direct and indirect injection that decides severity, and why no known technique closes it.
- 04 Red-Teaming and Security Evaluation for LLM Apps What automated attack generation covers, why a pass rate is not a security property against an adversary who retries, and how to structure an evaluation that informs a decision.
- 05 Threat Modelling an LLM System The trust boundaries specific to model-based applications, an inventory of assets and adversaries worth enumerating, and how to turn that into controls rather than a document.
Model Provenance & Watermarking Output watermarking, content credentials, fingerprinting weights and detecting extraction. 5 concepts · 58 cards
- 01 Content Credentials and Provenance Metadata The complementary approach of signing assertions about how content was made, why cryptographic provenance is strong where watermarking is weak, and the stripping problem that limits it.
- 02 Disclosure Obligations for Generated Content What the emerging transparency rules actually require, why machine-readable marking and human-visible disclosure are separate obligations, and the design decisions a deployer has to make.
- 03 Detecting Synthetic Media Without Watermarks Why passive detectors work in the lab and fail in deployment, the base rate problem that makes accusation dangerous, and what the evidence supports doing instead.
- 04 Model Fingerprinting and Weight Attribution How to prove a deployed model was derived from yours, the difference between backdoor-style and intrinsic fingerprints, and why fine-tuning is the adversary that matters.
- 05 Text Watermarking and the Detectability Tradeoff How a statistical signal is embedded in generated text by biasing the sampler, the detection test that makes it verifiable, and the reasons the scheme survives paraphrase poorly.
ML Supply Chain Security Untrusted weights and datasets, deserialisation risk, dependency and registry attacks, and signing artefacts. 5 concepts · 62 cards
- 01 Dependency and Registry Attacks in ML Stacks Why ML environments are unusually exposed to package-level attacks, the specific techniques that keep working, and the controls that actually reduce exposure.
- 02 Untrusted Weights and Deserialisation Risk Why loading a model file can execute code, what safetensors changed, and the checks that belong in any pipeline that downloads weights from a public hub.
- 03 Vetting Third-Party Models and Datasets A practical intake process for an artefact you did not produce, what each check can and cannot establish, and how to size the effort to the deployment's exposure.
- 04 Securing the Training Pipeline Why the training environment is a high-value target with unusually broad access, the specific credential and isolation failures that recur, and the controls proportionate to what a compromise would yield.
- 05 Signing, Attestation and SBOMs for Models How software supply chain frameworks map onto model artefacts, what a model bill of materials should contain, and why the interesting claims are about the training process rather than the file.