Resources

There is no required textbook. The instructor posts papers, tool documentation, and tutorials on Canvas per unit. The references below are organized by the course’s three pillars. Use these libraries for homework, the midterm, and the capstone.

Pillar 1 — AI for Security

Datasets, tools, and references for building defensive ML (intrusion, malware, phishing/fraud detection, and security operations).

• scikit-learn — classical ML, pipelines, and evaluation metrics (PR/ROC, imbalanced data): https://scikit-learn.org/
• NSL-KDD — benchmark network-intrusion dataset: https://www.unb.ca/cic/datasets/nsl.html
• CIC-IDS-2017 / CSE-CIC-IDS2018 — modern labeled intrusion/flow datasets: https://www.unb.ca/cic/datasets/ids-2017.html
• EMBER — labeled PE-malware feature dataset and benchmark: https://github.com/elastic/ember
• MalConv — deep learning on raw bytes for malware detection (reference): https://arxiv.org/abs/1710.09435
• Zeek — network security monitor / flow + log generation: https://zeek.org/
• Suricata — IDS/IPS and network analysis engine: https://suricata.io/
• PhishTank — phishing URL feeds: https://www.phishtank.com/ · UCI Phishing Websites dataset: https://archive.ics.uci.edu/dataset/327/phishing+websites
• LLMs for SecOps — using LLMs for log analysis, alert triage, and threat-intel extraction (with caution re: hallucination and prompt injection — see Pillar 2): https://github.com/cybersecurity-llm/awesome-cybersecurity-llm
• Key concepts: class imbalance, base-rate fallacy, concept drift, feature engineering for flows/binaries/emails, operational thresholds and alert volume.

Pillar 2 — Security of AI

Libraries for attacking and stress-testing ML models: adversarial examples, poisoning/backdoors, model extraction/inversion, and LLM security.

• CleverHans — adversarial example library (TF/JAX/PyTorch): https://github.com/cleverhans-lab/cleverhans
• Foolbox — fast adversarial attacks for PyTorch, TF, JAX: https://github.com/bethgelab/foolbox
• Adversarial Robustness Toolbox (ART) — attacks, defenses, poisoning, extraction, inference (IBM/LF AI): https://github.com/Trusted-AI/adversarial-robustness-toolbox
• TextAttack — adversarial attacks and data augmentation for NLP models: https://github.com/QData/TextAttack
• RobustBench — standardized robustness benchmark & model zoo: https://robustbench.github.io/
• OWASP Top 10 for LLM Applications — prompt injection, jailbreaks, data leakage (reference): https://owasp.org/www-project-top-10-for-large-language-model-applications/
• Key methods: FGSM, PGD, C&W, transfer/black-box attacks; data poisoning and backdoors; model extraction, model inversion, membership inference; prompt injection and jailbreaks; adversarial training as a defense.

Pillar 3 — Trustworthy AI

Tools for interpretability, fairness, privacy-preserving ML, certified robustness, and governance.

Interpretability & Explainability

• SHAP — Shapley-value feature attribution: https://github.com/shap/shap
• LIME — local interpretable model-agnostic explanations: https://github.com/marcotcr/lime
• Captum — model interpretability for PyTorch (saliency, Integrated Gradients, Grad-CAM): https://captum.ai/
• InterpretML — glassbox models and blackbox explanations: https://github.com/interpretml/interpret

Fairness

• AIF360 — AI Fairness 360 toolkit (metrics + mitigation): https://github.com/Trusted-AI/AIF360
• Fairlearn — fairness assessment and mitigation: https://fairlearn.org/
• What-If Tool — interactive bias/fairness probing: https://pair-code.github.io/what-if-tool/
• Key concepts: demographic parity, equalized odds, calibration; pre-/in-/post-processing mitigation; impossibility results.

Privacy-Preserving ML

• Opacus — differential privacy (DP-SGD) for PyTorch: https://opacus.ai/
• TensorFlow Privacy — DP optimizers and analysis for TF: https://github.com/tensorflow/privacy
• Flower — federated learning framework: https://flower.ai/
• TenSEAL — homomorphic encryption for tensors: https://github.com/OpenMined/TenSEAL
• Key concepts: differential privacy & privacy budgets, membership inference, model inversion, secure aggregation.

Robustness Certification & Formal Verification

• Marabou — SMT-based neural network verification: https://github.com/NeuralNetworkVerification/Marabou
• auto_LiRPA — automatic linear relaxation bound propagation: https://github.com/Verified-Intelligence/auto_LiRPA
• α,β-CROWN — state-of-the-art complete NN verifier (VNN-COMP): https://github.com/Verified-Intelligence/alpha-beta-CROWN
• ERAN — abstract-interpretation-based verification: https://github.com/eth-sri/eran
• Key concepts: SMT solvers, abstract interpretation, interval bound propagation, ACAS Xu, randomized smoothing.

Transparency, Accountability & Governance

• Model Cards — model documentation framework (reference): https://modelcards.withgoogle.com/about
• Datasheets for Datasets (reference): https://arxiv.org/abs/1803.09010
• EU AI Act — official text and overview: https://artificialintelligenceact.eu/
• NIST AI Risk Management Framework (AI RMF): https://www.nist.gov/itl/ai-risk-management-framework

Frameworks & General Tooling

• PyTorch docs: https://pytorch.org/docs/ · tutorials: https://pytorch.org/tutorials/
• TensorFlow docs: https://www.tensorflow.org/api_docs · tutorials: https://www.tensorflow.org/tutorials
• scikit-learn (classical ML & metrics): https://scikit-learn.org/
• Jupyter (notebooks for documenting experiments): https://jupyter.org/

See the Schedule for which pillar each week covers.