人工智能-数据与模型安全 (姜育刚马兴军吴祖煊) (Z-Library)

【One-Line Pitch】 A systematic, research-frontier survey of AI security organized around the two things every model depends on—data and models—covering the attack and defense algorithms that define the field. Best for graduate students, researchers, and engineers who want a structured map of adversarial ML rather than a hands-on coding tutorial. 【Book Arc】 - **Opening (~0%–10%)**: Frames the whole field—a short history of AI (Dartmouth, Deep Blue, ImageNet-era deep learning) and a three-way taxonomy of AI safety: endogenous, derivative, and AI-assisted security. Then lays the ML groundwork (loss functions, ERM/SRM, overfitting, SGD, reinforcement-learning basics) that later attack chapters assume. - **Early (~10%–30%)**: Moves into data-side threats. Data poisoning is formalized as a bi-level optimization problem; privacy attacks (membership inference, attribute inference) are tied to the train/test generalization gap; data stealing is split into black-box and white-box settings, with large language models and diffusion models as headline cases of unintended memorization. - **Early–Middle (~30%–45%)**: Deepfakes and forgery. Face swapping (SimSwap, FSGAN), Transformer-based editing (TransEditor), and video generation are described, followed by detection methods (color-space statistics, frequency analysis) and the emerging problem of detecting AI-generated text (GPTZero, watermarking). - **Middle (~45%–55%)**: Adversarial examples. The classic progression from L-BFGS to FGSM, BIM, and PGD, then query-based and transfer attacks, ending with physical-world attacks (RP2) that survive printing, distance, and camera angle. - **Late (~55%–100%)**: Defense and privacy-preserving training. Differential privacy (DP-SGD, gradient clipping, noise addition, moment accounting), federated learning variants and frameworks, secure boosted trees (XGBoost under local-data constraints), and defenses against poisoning, backdoors, and model stealing. *Excerpts do not cover the exact chapter boundaries in this final stretch.* 【Key Takeaways】 - **AI safety splits into three layers** (Opening): endogenous (data/model flaws), derivative (misuse like deepfakes), and AI-assisted security. This taxonomy is the book's organizing spine—keep it in mind as a filing system for every later technique. - **Poisoning is best understood as bi-level optimization** (Early): the attacker's outer loop picks poisoned data, the inner loop retrains the victim. Framing it this way makes nearly all poisoning variants special cases, and explains why gradient-based poisoning struggles with deep nets (vanishing/exploding gradients, memory cost). - **Privacy leakage is a generalization-gap problem** (Early): membership inference works because models behave differently on train vs. test data. Metrics like prediction loss, confidence, and entropy are practical attack signals—and overfitting is a direct privacy risk. - **Generative models memorize** (Early): LLMs and diffusion models can regurgitate training data, including private text and near-identical images. This is not a bug in one model but a structural property of large-scale training. - **Adversarial attacks form a complexity ladder** (Middle): FGSM (one-step, cheap, weak) → BIM (iterative) → PGD (strongest white-box baseline) → query and transfer attacks (black-box). Transferability is what makes black-box attacks practical. - **Physical-world attacks are real** (Middle): RP2 shows perturbations can be printed and remain effective across distance, angle, and lighting—so adversarial robustness is not just a digital concern. - **Defense is layered, not singular** (Late): data augmentation and filtering for poisoning, norm thresholding in federated settings, DP-SGD with clipping and moment accounting for privacy. No single defense covers all threat models. - **Detection of AI-generated content is an open problem** (Middle): watermarking and perplexity-based detectors exist, but false positives (e.g., the US Constitution flagged as AI-written) show reliability is unresolved. 【Reading Tips】 - **Deep-read Chapters 1–2** even if you know ML—the loss-function and optimization framing is reused constantly in attack derivations. - **Skim the deepfake generation chapter** if your interest is defense; the detection half is more actionable and less model-specific. - **Treat the attack chapters as a ladder**: read FGSM→BIM→PGD in sequence; skipping ahead makes the black-box methods feel unmotivated. - **Watch the math notation**: the book uses a symbol table and reuses θ, f, L across chapters—keep it handy. - **For practitioners**, jump to the defense and federated-learning sections first, then return to attacks to understand what you're defending against. 【Coverage Limits】 This guide is based on stratified excerpts covering roughly the first half of the book plus scattered late material; the exact structure and content of the final defense chapters are only partially represented.