CVE-2024-45436

Эксплойт для Ollama CVE-2024-45436 Чистая и эффективная реализация эксплойта для уязвимости обхода ZIP-путей в Ollama CVE-2024-45436. 中文文档：READMECN.md Описание уязвимости CVE-2024-45436 — это уязвимость обхода путей также известная как «Zip Slip» в Ollama до версии 0.1.47. Уязвимость позволяет...

PrivacyRaven

참고: 이 프로젝트는 일시 중단 상태입니다. PrivacyRaven 은 딥러닝 시스템을 위한 프라이버시 테스트 라이브러리입니다. 이를 사용하여 모델이 다양한 프라이버시 공격에 얼마나 취약한지 판단하고, 프라이버시 보존 머신러닝 기법을 평가하며, 새로운 프라이버시 메트릭과 공격을 개발하고, 데이터 출처data provenance 및 기타 사용 사례를 위해 공격을 재활용할 수 있습니다. PrivacyRaven은 라벨 전용 블랙박스 모델 추출, 멤버십 추론, 그리고 곧 제공될 모델 역전 공격을 지원합니다. 또한 차분 프라이버시 검증...

ai-kill-chain

AI 시대 위협을 위한 확장된 사이버 킬 체인 LLM대규모 언어 모델 및 에이전트형 AI 공격에 대응하는 방어자를 위한 Lockheed Martin Cyber Kill Chain의 업데이트입니다. 모델 공급망 손상에 대한 사전 공격 단계를 추가합니다. 원래 7개 단계 각각에 AI 특화 하위 기법을 추가합니다. Actions on Objectives 단계를 고전적 데이터 유출, 모델 추출, 에이전트 피벗agentic pivot이라는 세 가지 동등한 하위 단계로 분할합니다. 저자: Gourav Nagar 버전: 1.0 날짜:...

offensive-ai-compilation

공격적 AI 모음집 공격적 AI를 다루는 유용한 리소스 모음입니다. 📁 목차 📁 🚫 악용 🚫 🧠 적대적 머신러닝 🧠 ⚡ 공격 ⚡ 🔒 추출 🔒 ⚠️ 제한 사항 ⚠️ 🛡️ 방어 조치 🛡️ 🔗 유용한 링크 🔗 ⬅️ 역전또는 추론 ⬅️ 🛡️ 방어 조치 🛡️ 🔗 유용한 링크 🔗 💉 중독 💉 🔓 백도어 🔓 🛡️ 방어 조치 🛡️ 🔗 유용한 링크 🔗 🏃‍♂️ 회피 🏃‍♂️ 🛡️ 방어 조치 🛡️ 🔗 유용한 링크 🔗 🛠️ 도구 🛠️ ART Cleverhans 🔧 활용 🔧 🕵️‍♂️ 침투 테스트 🕵️‍♂️ 🦠 악성코드 🦠 🗺️ OSINT 🗺️ 📧...

ai-security-battle

🤖 Система битвы за безопасность ИИ Красная команда против Синей команды: симуляция состязательного машинного обучения Комплексная симуляция безопасности на основе состязательного машинного обучения, где атакующие из Красной команды сражаются против защитников из Синей команды в 30-минутном сценар...

AI Model Extraction Attacks: Bypassing Single-Client Assumptions in Defenses

Ensuring the protection of Artificial Intelligence AI models deployed in military Command and Control C2 systems and critical infrastructure is essential for maintaining information superiority. Model Extraction Attacks MEAs pose a significant threat, as they enable adversaries to replicate...

Anthropic Claims Chinese AI Firms ‘Distilled’ Claude to Train Their Models

Anthropic claims Chinese AI firms distilled Claude to train rival AI models, raising concerns about model extraction, security risks, and AI distillation abuse...

Breaking SafetyCore: Exploring the Risks of On-Device AI Deployment

Due to hardware and software improvements, an increasing number of AI models are deployed on-device. This shift enhances privacy and reduces latency, but also introduces security risks distinct from traditional software. In this article, we examine these risks through the real-world case study of...

Measuring the Vulnerability Disclosure Policies of AI Vendors

As AI is increasingly integrated into products and critical systems, researchers are paying greater attention to identifying related vulnerabilities. Effective remediation depends on whether vendors are willing to accept and respond to AI vulnerability reports. In this paper, we examine the...

LLM4MEA: Data-Free Model Extraction Attacks on Sequential Recommenders Via Large Language Models

Recent studies have demonstrated the vulnerability of sequential recommender systems to Model Extraction Attacks MEAs. MEAs collect responses from recommender systems to replicate their functionality, enabling unauthorized deployments and posing critical privacy and security risks. Black-box...

Entangled Threats: a Unified Kill Chain Model for Quantum Machine Learning Security

Quantum Machine Learning QML systems inherit vulnerabilities from classical machine learning while introducing new attack surfaces rooted in the physical and algorithmic layers of quantum computing. Despite a growing body of research on individual attack vectors - ranging from adversarial poisoni...

BarkBeetle: Stealing Decision Tree Models with Fault Injection

Machine learning models, particularly decision trees DTs, are widely adopted across various domains due to their interpretability and efficiency. However, as ML models become increasingly integrated into privacy-sensitive applications, concerns about their confidentiality have grown, particularly...

CEGA: a Cost-Effective Approach for Graph-Based Model Extraction and Acquisition

Graph Neural Networks GNNs have demonstrated remarkable utility across diverse applications, and their growing complexity has made Machine Learning as a Service MLaaS a viable platform for scalable deployment. However, this accessibility also exposes GNN to serious security threats, most notably...

GradEscape: a Gradient-Based Evader against AI-Generated Text Detectors

In this paper, we introduce GradEscape, the first gradient-based evader designed to attack AI-generated text AIGT detectors. GradEscape overcomes the undifferentiable computation problem, caused by the discrete nature of text, by introducing a novel approach to construct weighted embeddings for t...

MISLEADER: Defending against Model Extraction with Ensembles of Distilled Models

Model extraction attacks aim to replicate the functionality of a black-box model through query access, threatening the intellectual property IP of machine-learning-as-a-service MLaaS providers. Defending against such attacks is challenging, as it must balance efficiency, robustness, and utility...

RADEP: a Resilient Adaptive Defense Framework against Model Extraction Attacks

Machine Learning as a Service MLaaS enables users to leverage powerful machine learning models through cloud-based APIs, offering scalability and ease of deployment. However, these services are vulnerable to model extraction attacks, where adversaries repeatedly query the application programming...

Evaluating Query Efficiency and Accuracy of Transfer Learning-Based Model Extraction Attack in Federated Learning

Federated Learning FL is a collaborative learning framework designed to protect client data, yet it remains highly vulnerable to Intellectual Property IP threats. Model extraction ME attacks pose a significant risk to Machine Learning as a Service MLaaS platforms, enabling attackers to replicate...

On the Interplay of Explainability, Privacy and Predictive Performance with Explanation-Assisted Model Extraction

Machine Learning as a Service MLaaS has gained important attraction as a means for deploying powerful predictive models, offering ease of use that enables organizations to leverage advanced analytics without substantial investments in specialized infrastructure or expertise. However, MLaaS...

Deep Java Library path traversal issue

Summary Deep Java Library DJL is an open-source, high-level, engine-agnostic Java framework for deep learning. DJL is designed to be easy to get started with and simple to use for Java developers. DJL provides a native Java development experience and functions like any other regular Java library...

Model Extraction from Neural Networks

A new paper, "Polynomial Time Cryptanalytic Extraction of Neural Network Models," by Adi Shamir and others, uses ideas from differential cryptanalysis to extract the weights inside a neural network using specific queries and their results. This is much more theoretical than practical, but its a...