evasion

AI security did not start with LLMs. The scored answer explains how these classifiers learn, the adversarial dynamics they have lived with for decades, and the lessons that carry over.

One attacks the model's inputs, the other its upbringing. The phase decides the defence, and interviewers want you to say so.

The two attacks every robustness paper starts from. The scored answer explains the gradient step, the budget as a threat model, and why the iterative attack is the standard for evaluation.

The one defence that has held up in research, at a price. The scored answer explains the min-max objective and names the costs: accuracy, compute, and robustness only to the threat model trained on.

Hiding scores slows attackers down; it does not stop them. The scored answer explains decision-based search and transfer, and turns query patterns into a detection opportunity.

Fraudsters are the original adaptive adversaries. The scored answer attacks with realistic, feasible changes, probes the whole decision system rather than the model alone, and measures dollars, not just accuracy.

An attacker who cannot see your model can attack one they can see, and much of the damage carries over. That single property turns 'the weights are secret' into a weak defence.

Evasion testing is a search problem with a budget. Start from real harmful content, transform it while keeping its meaning, adapt to what gets through, and report false negatives and false positives by category.