Part I · The model

Everything here is about the artifact, not the application. A model is a file of learned weights plus the process that produced it. That process is where training data leaks back out, where a poisoned dataset becomes a permanent backdoor, and where a pickle in a checkpoint becomes remote code execution on load.

Each part of this book splits the same three ways: how it works, how it breaks, and how you hold it. The attack and the control for one layer sit together, because that is how you actually meet them.

How it works

I.1 How a model works Training vs inference, and what a "model" really is - the thing every later attack targets. concept · 2 min read I.2 Shaping a model - training, tuning, alignment From pre-training to fine-tuning, RAG, and agents - the stages that shape a model and where each one opens a distinct security exposure to attack. concept · 3 min read

How it breaks

I.3 Training data - extraction and poisoning Extraction and memorization, web-scale data poisoning, and the upstream defenses for the training corpus. attack · 5 min read I.4 Adversarial machine learning Five families of adversarial ML, model-file deserialization RCE, and the defenses for the model artifact. attack · 5 min read

How you hold it

I.5 The model artifact & its supply chain Data, weights, code, and infrastructure pulled from public hubs on implicit trust - and the provenance tooling (signing, ML-BOM, SLSA) that closes the gap. defense · 6 min read I.6 Protecting weights in use - TEEs & attestation Confidential computing for AI: what a GPU TEE actually closes, why attestation is the whole control, and what three sub-$1,000 memory interposers did to it. defense · 10 min read I.7 Frontier capability & the if-then frameworks How the field tries to govern frontier capability at the source: the labs' if-then frameworks, capability-gated deployment, and dangerous-capability evals. defense · 5 min read