Practical AI Security A Hands-On Guide to Attacking, Defending, and Securing Modern AI Systems (Harriet Farlow) (z-library.sk, 1lib.sk, z-lib.sk)

【One-Line Pitch】 A first-principles field guide that teaches security practitioners and ML engineers how modern AI systems actually fail, how adversaries exploit them, and how to defend, red-team, and govern them—with runnable Python demos rather than slideware. Read it if you want breadth across the whole AI security discipline, not just prompt-injection tricks. 【Book Arc】 - **Opening (~0%–10%)**: Front matter, author framing, and the book's thesis—AI security is not a subset of cybersecurity but a distinct discipline spanning adversarial ML, AI safety, and governance. Establishes the "prediction engines, not minds" mental model. - **Early (~10%–35%)**: Part I builds fundamentals: AI/ML history and math, what a model is, common architectures and modalities (language, vision, signal processing), then AI threat modeling via MAESTRO with real incident trends. This is the grounding layer everything else depends on. - **Middle (~35%–55%)**: Part II is the technical core—the ML life cycle as attack surface, then disruption/deception methods (FGSM, PGD, adversarial patches, Carlini-Wagner, poisoning, backdoors) and disclosure methods (prompt injection, membership inference, model extraction, side channels), plus system-level threats like RAG attacks, supply chain, and agent risks. Defenses follow: adversarial training, gradient obfuscation, randomized smoothing, certified defenses, ensembles, statistical detection, input validation, instruction-layer filtering, and life-cycle controls. - **Late (~55%–80%)**: Part III widens to the ecosystem—AI red teaming (objectives, threat modeling, tool selection, multi-turn attacks, responsible disclosure), attacking and defending *with* AI (detection, threat intel, autonomous attack agents, disinformation), and AI safety (bias, misuse, interpretability, alignment, benchmarks, mechanistic interpretability). - **Ending (~80%–100%)**: Governance (dedicated AI laws vs. sector-based adaptation, frameworks, rapid risk audits, Bayesian and matrix prioritization) and a forward look at agentic AI, open vs. closed weights, Web3, quantum, and AGI—closing on the "new kind of hacker" identity. 【Key Takeaways】 - **AI security is its own discipline, not a cybersecurity subdomain** (Early): models are probabilistic, uninterpretable, unpatchable, and nondeterministic, so classic controls are necessary but insufficient. The book's framing of these properties as scoring dimensions is the conceptual spine. - **Attacks split into disruption/deception and disclosure** (Middle): gradient-based evasion and poisoning corrupt what a model does; prompt injection, membership inference, and model extraction steal what it knows. Organizing threats this way makes the long attack catalog navigable. - **System-level threats matter as much as model-level ones** (Middle): RAG pipelines, supply chains, and autonomous agents introduce weaknesses that no amount of model hardening fixes—architecture and permissions become security controls. - **Defenses are layered and none is complete** (Middle): adversarial training, smoothing, certified methods, ensembles, and detection each trade robustness against cost or accuracy; the book treats them as a portfolio, not a silver bullet. - **AI red teaming differs from cyber red teaming** (Late): objectives, threat models, and test design must account for probabilistic behavior, multi-turn manipulation, and harm-based rather than exploit-based success criteria. - **Safety and security converge on evaluation** (Late): bias, toxicity, alignment, and agent safety are assessed through structured benchmarks and interpretability techniques—practical measurement, not philosophy. - **Governance is an operational skill** (Ending): rapid risk audits, qualitative vs. quantitative analysis, and prioritization matrices turn policy frameworks into decisions organizations can actually execute. - **Hands-on demos are the pedagogy** (throughout): over 30 Python/Colab notebooks build attacks from scratch so you understand mechanisms rather than treating toolkits as black boxes. 【Reading Tips】 - **Deep-read Parts I–II; skim Part III selectively.** The fundamentals and attack/defense chapters are the durable core. If you're an ML engineer, prioritize Chapters 3–5; if you're a security practitioner, prioritize Chapters 1–2 first so the math lands. - **Run the notebooks alongside the text.** The book explicitly builds demos from scratch; typing and breaking the code is where the intuition forms. - **Treat the attack catalog as a reference, not a narrative.** Return to it when threat-modeling a real system rather than reading linearly. - **Expect the math to be "gentle" but present.** Don't skip the statistical foundations—the author argues that's where weaknesses originate. - **Use the governance chapter as a checklist** for real deployments; it's the most immediately actionable for managers. 【Coverage Limits】 These excerpts cover front matter, the table of contents, the introduction, and the opening of Part I; the detailed technical content of Chapters 4–10 is visible mainly through chapter outlines, so this guide synthesizes structure and stated intent rather than chapter-level specifics.