Poisoning, evasion, extraction, and LLM threats
Use poisoning, evasion, extraction, and llm threats to move the responsible ml production brief toward a defensible release.
A high-performing system creates subgroup harm and leaks sensitive information.
This lesson isolates poisoning, evasion, extraction, and llm threats as one decision inside that system. The people affected are product users and operators; the learning data must carry event time, availability time, ownership, and version; and the operating envelope is risk-tiered human oversight.
Choose whether and how to use differential privacy at a declared prediction cutoff.
Measure decision utility alongside calibration, slice reliability, and system latency—not model score alone.
A high-performing system creates subgroup harm and leaks sensitive information. An unsafe release must degrade to a named baseline or the last known-good version.
Build the mental model before the machinery.
The core move is to treat poisoning, evasion, extraction, and llm threats as a contract between data, a computation, and an action. Governance evidence must travel with the exact model, data, policy, and runtime release throughout its lifetime. The implementation becomes easier to debug once you can state which inputs exist, which state is learned, what output means, and what must remain invariant after serialization.
differential privacy
Define it in a hand-checkable form and name the prediction-time inputs.
model supply chain
Connect it to the production metric and identify what it cannot guarantee.
prompt injection
Stress it with a slice, a temporal boundary, and a failure-safe alternative.
recourse
Stress it with a slice, a temporal boundary, and a failure-safe alternative.
Lessons 1, 2, 3 in this course.
Name every symbol. Check every shape.
Differential privacy guarantee is the central invariant for this lesson. The formula is useful only when its inputs match the production cutoff and its output maps to an action.
Differential privacy guarantee
| Symbol | Meaning / shape / unit |
|---|---|
M | randomized mechanism |
D, D′ | adjacent datasets |
ε, δ | privacy-loss parameters |
Open derivation and numerical substitution
Start from the production quantity being optimized, substitute the observed values with their declared units, then isolate the model-controlled term. Preserve shape annotations at each step so broadcasting or aggregation cannot silently change the result.
- Write the named inputs: M, D, D′, ε, δ.
- Substitute one small, hand-checkable batch before vectorizing.
- Calculate an independent reference value and compare within a declared tolerance.
# equation → code contract
inputs = validate_shapes_and_units(batch)
value = compute_c20(inputs)
assert is_finite(value)Calculate it small. Shape it realistically. Break it on purpose.
A result you can reproduce on paper
Two thresholds have equal overall accuracy but very different true- and false-positive rates by group.
- Write every input and unit.
- Substitute values into the differential privacy guarantee equation above.
- Compare the result to one simple baseline and explain the direction of the difference.
The same reasoning under real constraints
A controlled underwriting pilot uses subgroup analysis, retention controls, signed artifacts, human review, and appeals.
The production record includes the data snapshot, transformation state, artifact identity, cutoff, score, decision, and the version of the policy that consumed it.
The attractive result you should reject
The team reports one aggregate fairness number, deletes the protected field, loads an untrusted pickle, and logs sensitive inputs forever.
Diagnostic: replay the smallest failing slice from immutable inputs, then compare each boundary rather than retuning the model.
Change one assumption and make the tradeoff visible.
This lab runs predefined TypeScript only. It never executes learner code. Use the slider, numeric input, reset, live text, or table—the computation is the same.
Threshold parity lab
Move one group threshold and inspect error-rate and utility tradeoffs.
Assumption: Fixed score/label table with different group base rates; group A threshold is 0.5.
Open nonvisual data table
| Item | Computed state | Interpretation |
|---|---|---|
| A | 0.50 | TPR 1.00 / FPR 0.33 |
| B | 0.50 | TPR 0.50 / FPR 0.33 |
Trace the complete operating path.
- 01
Validate and version differential privacy.
- 02
Compute poisoning, evasion, extraction, and llm threats from prediction-time-safe inputs.
- 03
Persist model, feature, and configuration identities together.
- 04
Serve or materialize behind explicit risk-tiered human oversight.
- 05
Join telemetry to mature outcomes and retain a rollback path.
Observability
Join service health, input quality, prediction distributions, slice behavior, and mature outcomes by exact version.
Cost
Measure storage, preprocessing, compute, queueing, and human review under a representative arrival pattern.
Failure modes
The team reports one aggregate fairness number, deletes the protected field, loads an untrusted pickle, and logs sensitive inputs forever. Add a detector, owner, mitigation, and stop condition for this class of failure.
Alternatives
Compare a rule, a simpler statistical baseline, and a different system boundary before adding model complexity.
Explain the contract, not just the vocabulary.
Model assurance package
Produce intended-use, fairness, privacy, security, human-review, monitored-rollout, and release evidence.
- Model/data cards
- Intersectional analysis
- Privacy/retention plan
- Threat model and recourse
Read primary material with a purpose.
Return to the opening failure.
Governance evidence must travel with the exact model, data, policy, and runtime release throughout its lifetime.
For this lesson, the release evidence is a hand-checked formal result, deterministic simulation output, a ≥80% checkpoint, the production rubric, and a named fallback. The course resolves when the system can produce a launch review covering fairness, privacy, licensing, abuse, security, and response.