AI & CybersecurityHSLU / UiA Student Search AI & Cybersecurity
Menu for AI & Cybersecurity
Courses and project AI & Cybersecurity
On this page

Read the idea behind the experiment

Start with the lecture reading routes

The required reading is set on the slides. Read these first; each has its question:

  • After Parts 1–3 (slide 72): Arp et al. (2022), introduction and pitfalls taxonomy. Which missing evaluation choice could change your vendor verdict? Then NIST AI 100-2e2025, sections 1–2. What can the attacker know and control?
  • After Parts 4–6 (slide 51): choose one route. Attacks: NIST AI 100-2e2025, sections 1–2, then the generative-AI taxonomy (what can the attacker change?). Injection: Greshake et al. (2023), introduction and attack examples (where does content gain authority?). Application review: OWASP LLM Top 10 2026, three risks relevant to your system (what control evidence is missing?).

Suggested times on the slides are planning estimates, not a workload requirement.

Connect the experiments to the literature

The routes below connect our experiments to books and research; the papers are optional extensions. Start with the question, read the indicated part, then return to one observation from your own run. Our small generated datasets are original teaching examples and do not reproduce the sources’ experiments.

Learning a function

Part 1, slides 13–33; labs 01 and 03. Goodfellow, Bengio and Courville, Deep Learning (MIT Press, 2016), chapter 5, introduces learning, regression and generalisation. Start with the author’s chapter-5 lecture slides, pages 2–4 for a line, error and capacity; the free book also lists chapter 6 on feedforward networks.

Return to our login example: why can a lower training error coexist with a worse security decision? Explain weights, labels and the independent routing threshold before discussing a larger network. No calculus is required in class.

Security evaluation

Part 2, slides 36–46, and Part 3, slides 50–56; labs 04, 05 and 09–11. Arp et al., “Dos and Don’ts of Machine Learning in Computer Security,” USENIX Security 2022, pp. 3971–3988. Use the conference page and open paper: read the workflow figure and pitfall P3 (data snooping), P8 (base rates) or P9 (lab-only evaluation, including changing conditions), choosing the one relevant to your lab.

Return to Mina: what population, split and time period would support the claim you want to make? Our eight campaign cards and independent queue-rate sliders illustrate questions; they do not estimate production rates. Liu et al., AI for Cybersecurity: A Handbook of Use Cases (2022) adds security-problem-to-deployment examples: choose Android malware feature engineering or abnormal events in sequential data.

Poisoning and evasion

Part 4, slides 10–17; labs 07, 08 and 13, and all five input learners. Biggio, Nelson and Laskov, “Poisoning Attacks against Support Vector Machines” (ICML 2012), studies crafted training-data injection. Read the abstract and identify where the attacker writes. Our experiment deliberately edits accepted labels in different models; it does not implement their SVM attack.

Goodfellow, Shlens and Szegedy, “Explaining and Harnessing Adversarial Examples” (2015; preprint 2014), examines input perturbations and model errors. Read the abstract and compare training-time interference with inference-time changes. Our visible pixel edits and supplied email-feature changes are introductory comparisons, not reproductions of its gradient-sign method or imperceptibility claims.

For accepted-label manipulation, NIST AI 100-2e2025, sections 2.1.3 and 2.3.1–2.3.2 distinguishes attacker capabilities and label-flipping poisoning. Our binary-label edits use that mechanism; the scalar-priority experiment lowers continuous labels instead of flipping binary classes. Neither is a clean-label attack: both assume the attacker’s changed labels reach training.

Return to your run: identify the changed surface, what stayed fixed, the attacker’s feasible control and which security outcome the source-case label represents. A changed score alone is insufficient.

Traffic and video

Used in lab 14 and optional lab 16. The Penn State handbook, chapter 4, describes abnormal-event detection with sequential data. Start with the security problem and data-processing sections before model architecture.

Return to our schedules: a minute or frame at a different position meets a different learned weight. Our flat positional classifiers expose that sensitivity; they are not the handbook’s sequence models or a natural-video recognition system. Which unseen start times and benign workload changes belong in an evaluation?

Audio and graphs

Optional transfer, labs 15 and 17. Carlini and Wagner, “Audio Adversarial Examples: Targeted Attacks on Speech-to-Text” (2018), investigates attacks on a speech recogniser. Read the abstract to see that audio can be a model input. Our two-tone phase shift is a different, much simpler alignment experiment: no speech recogniser or speaker authentication runs here, and we make no imperceptibility claim.

Gilmer et al., “Neural Message Passing for Quantum Chemistry” (2017), section 2, describes message passing and a permutation-invariant graph readout. The application is molecular prediction; the representation principle motivates our security question about node order. Our adjacency-cell learner is not a graph neural network. Renumbering a data structure is not evidence that a real attacker can control its ingestion.

For the graph task, preserve node roles as well as edges. Our canonical review and no-review cases have the same unlabelled shape: a directed three-edge path and two isolated nodes. Their role-labelled paths differ. Node-role features or a trusted canonical representation would be needed to retain that distinction in a more general model; order invariance alone cannot recover omitted roles.

Return to your run: point to the preserved spectrum or identity-based edges. Explain why the numerical input still changes. A future robust model must be evaluated under the transformations its task should tolerate.

Authority and incident evidence

Part 5, slides 24–32, and Part 6, slide 45; labs 02, 06 and 12. The OWASP LLM Top 10 2026 is practice guidance rather than a research paper. Read the prompt-injection entry for indirect injection and the mitigation guidance on permissions and human approval.

For the retrieval concept, read Lewis et al., “Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks,” NeurIPS 2020, abstract. It combines a generator with retrieved memory and also studies fine-tuning. Retrieving a passage at answer time does not itself update model weights; our local context-flow simulation implements neither the paper’s training recipe nor a live retriever/generator.

For indirect prompt injection, read Greshake et al., “Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection” (2023 author preprint), abstract. It studies instructions introduced through data an application retrieves. Compare that mechanism with the customer-controlled ticket in our case; the paper’s experiments are not evidence for an attack rate in our scripted assistant.

Return to the assistant case: which material may inform the answer, and which trusted record authorises the exact action? Our assistant and incident traces are authored simulations; they do not measure an LLM attack rate or prove backend enforcement. Request the operation result and authoritative ticket history when execution is uncertain.

Phishing and network anomalies

Hands-On Artificial Intelligence for Cybersecurity (code repository) has Python examples on email threats, malware and network anomalies. Use it after our two-feature phishing exercise to ask what a richer representation would require. Its documented Python environment is older; inspect dependencies before running examples in a separate environment.

More machine-learning approaches

Hands-On Machine Learning for Cybersecurity (code repository) has more classification and clustering examples. Try explaining the input, label, split and operational decision for one example before reproducing it. The browser course does not require these notebooks or their dependencies.

Malware and sequential behaviour

AI for Cybersecurity: A Handbook of Use Cases follows concrete security problems through data preparation, representation, learning and deployment. For follow-up, read the Android malware, abnormal sequential events or PC malware case. Open the handbook PDF.

Our malware-feature discussion and traffic baseline are original introductory examples. They do not reproduce the handbook’s models or reported results.

A broad overview to read critically

P. V. Ananda Mohan, AI in cyber security, dated 10 February 2022, surveys terminology and application areas. Treat broad performance claims as questions to investigate. In particular, a general promise of perfect detection with no false alarms is not a measured guarantee for our use cases.

Check the technical ideas

All Northbridge messages, labels and incident records were written for this course. The experiments illustrate mechanisms; they are not benchmark results copied from the resources above.

Language-model generation and application architecture

Vaswani et al. (2017), Attention Is All You Need, sections 3 and 3.4, is the primary architecture reference for autoregressive output, token embeddings and next-token probabilities. Read alongside Parts 1–3 slide 57 and Parts 4–6 slide 24: explain next-token generation, then locate the application’s retrieval and action boundaries. The course diagram is original; the assistant lab scripts proposals and runs no language model. The paper does not establish the security of the surrounding application. Checked 28 October 2026.