Provides AI and machine learning techniques for CTF challenges. Use when attacking ML models, crafting adversarial examples, performing model extraction, prompt injection, membership inference, training data poisoning, fine-tuning manipulation, neural network analysis, LoRA adapter exploitation, LLM

CTF AI/ML Quick reference for AI/ML CTF challenges. Each technique has a one liner here; see supporting files for full details. Prerequisites Python packages (all platforms): Linux (apt): macOS (Homebrew): Additional Resources [model attacks.md](model attacks.md) Model weight perturbation negation, model inversion via gradient descent, neural network encoder collision, LoRA adapter weight merging, model extraction via query API, membership inference attack [adversarial ml.md](adversarial ml.md) Adversarial example generation (FGSM, PGD, C&W), adversarial patch generation, evasion attacks on ML classifiers, data poisoning, backdoor detection in neural networks [llm attacks.md](llm attacks.md) Prompt injection (direct/indirect), LLM jailbreaking, token smuggling, context window manipulation, tool use exploitation When to Pivot If the challenge becomes pure math, lattice reduction, or number theory with no ML component, switch to /ctf crypto . If the task is reverse engineering a compiled ML model binary (ONNX loader, TensorRT engine, custom inference binary), switch to /ctf reverse . If the challenge is a game or puzzle that merely uses ML as a wrapper (e.g., Python jail inside a chatbot), switch to /ctf misc . Quick Start Commands Model Weight Analysis Weight perturbation negation: Fine tuned model suppresses behavior; recover by computing 2 W orig W chal to negate the fine tuning delta. See [model attacks.md](model attacks.md ml model weight perturbation negation dicectf 2026). LoRA adapter merging: Merge LoRA adapter W base + alpha (B @ A) and inspect activations or generate output with merged weights. See [model attacks.md](model attacks.md lora adapter weight merging apoorvctf 2026). Model inversion: Optimize random input tensor to minimize distance between model output and known target via gradient descent. See [model attacks.md](model attacks.md ml model inversion via gradient descent bsidessf 2025). Neural network collision: Find two distinct inputs that produce identical encoder output via joint optimization. See [model attacks.md](model attacks.md neural network encoder collision rootaccess2026). Adversarial Examples FGSM: Single step attack: x adv = x + eps sign(grad x(loss)) . Fast but less effective than iterative methods. See [adversarial ml.md](adversarial ml.md adversarial example generation fgsm pgd cw). PGD: Iterative FGSM with projection back to epsilon ball each step. Standard benchmark attack. See [adversarial ml.md](adversarial ml.md adversarial example generation fgsm pgd cw). C&W: Optimization based attack that minimizes perturbation norm while achieving misclassification. See [adversarial ml.md](adversarial ml.md adversarial example generation fgsm pgd cw). Adversarial patches: Physical world patches that cause misclassification when placed in a scene. See [adversarial ml.md](adversarial ml.md adversarial patch generation). Data poisoning: Injecting backdoor triggers into training data so model learns attacker chosen behavior. See [adversarial ml.md](adversarial ml.md data poisoning foundational). LLM Attacks Prompt injection: Overriding system instructions via user input; both direct injection and indirect via retrieved documents. See [llm attacks.md](llm attacks.md prompt injection foundational). Jailbreaking: Bypassing safety filters via DAN, role play, encoding tricks, multi turn escalation. See [llm attacks.md](llm attacks.md llm jailbreaking foundational). Token smuggling: Exploiting tokenizer splits so filtered words pass through as subword tokens. See [llm attacks.md](llm attacks.md token smuggling foundational). Tool use exploitation: Abusing function calling in LLM agents to execute unintended actions. See [llm attacks.md](llm attacks.md tool use exploitation foundational). Model Extraction & Inference Model extraction: Querying a model API with crafted inputs to reconstruct its parameters or decision boundary. See [model attacks.md](model attacks.md model extraction via query api). Membership inference: Determining whether a specific sample was in the training data based on confidence score distribution. See [model attacks.md](model attacks.md membership inference attack). Gradient Based Techniques Gradient based input recovery: Using model gradients to reconstruct private training data from shared gradients (federated learning attacks). See [model attacks.md](model attacks.md ml model inversion via gradient descent bsidessf 2025). Activation maximization: Optimizing input to maximize a specific neuron's activation, revealing what the network has learned.

ctf-ai-ml