# Program Overview ## Program Structure & Learning Path SecureAI is a comprehensive, **self-paced** training program that equips AI professionals and researchers with practical knowledge and skills in the security, privacy, and ethics of AI systems. It is delivered as an independent, self-study guide: across **12 self-study workshops** you watch recorded expert panels and lectures on demand, read the written guide, and run hands-on lab notebooks yourself. There are no live sessions to attend and no schedule to keep. This page is the complete roadmap: every workshop, what it covers, how the workshops build on one another, what you need to start, and what you can expect to be able to do by the end. ### How to use this program - **Format:** fully self-study and self-paced. Watch the recordings, read the guide, run the labs, on your own schedule. - **Structure:** 12 workshops, designed to be followed in order over roughly 12 weeks, or any pace you choose. - **Each workshop includes** some combination of a recorded panel or guest lecture to watch, a written guide to read, and a hands-on lab notebook to run. A few workshops are discussion- or lecture-only and have no notebook. - **Running the labs:** every lab notebook is placed directly in its workshop's `WorkshopNN/` directory (not under `assets/`) and has a matching Google Colab link. Run it locally with Python and Jupyter, or in your browser on Colab with no installation. On Colab, use **File → Save a copy in Drive** to run and save your own copy. --- ## Complete Workshop Roadmap ### Workshop 1: Introduction and Fundamentals in AI *Recorded panel + lab.* Introduces the foundational concepts of artificial intelligence, cybersecurity, and privacy through a recorded panel discussion with industry and academic experts. You gain awareness of how AI systems are deployed across industries, their benefits and risks, and the security and privacy challenges organizations face. **Panelists:** Muhammad Saad (PayPal), Ahmed Abusnaina (Meta), Jon McLachlan (YSecurity), Mohammed Abuhamad (Loyola University Chicago), Eric Chan-Tin (Loyola University Chicago) **Key Topics:** - AI fundamentals: machine learning, deep learning, neural networks - Cybersecurity and privacy in AI systems - AI applications across industries: healthcare, finance, retail, government - Fundamental security concerns: model poisoning, extraction, evasion attacks - Ethical considerations: bias, fairness, transparency, accountability **Learning Outcomes:** - Understand core concepts of artificial intelligence and machine learning - Recognize the importance of cybersecurity and privacy in AI systems - Identify potential risks and vulnerabilities associated with AI deployment - Appreciate ethical considerations including fairness and bias - Understand the diversity of AI applications across industries [Go to Workshop 1](Workshop01/Introduction_and_Fundamentals_in_AI.md) --- ### Workshop 2: AI and Threat Models *Recorded lecture + lab.* Introduces threat modeling as a structured framework for understanding adversarial risks in AI systems. You learn to characterize different types of threats, understand attacker capabilities and motivations, and appreciate how threat-model assumptions shape defense strategies. **Speaker:** Mohammed Abuhamad (Loyola University Chicago) **Key Topics:** - What threat models are and why they are essential for AI security - Components of a threat model: learning stage, model type, adversarial objectives, attacker capabilities and knowledge - Classes of attacks: evasion, poisoning, extraction, inference, backdoor - White-box, black-box, and gray-box threat models - Threat models across different deployment contexts **Learning Outcomes:** - Understand what threat models are and their essential role in AI security - Identify and characterize the key components of any threat model - Recognize the different classes of attacks that emerge under different threat assumptions - Relate threat models to deployment scenarios and organizational contexts - Appreciate the importance of documenting threat-model assumptions **Hands-on Lab:** extract and analyze the threat model from the PGD attack paper, then implement adversarial attacks on a ResNet-18 classifier with the Adversarial Robustness Toolbox (ART), measuring attack success rates and perturbation sizes. [Go to Workshop 2](Workshop02/AI_and_Threat_Models.md) --- ### Workshop 3: Adversarial Attacks - White-Box Attacks *Recorded lecture + lab.* Focuses on white-box adversarial attacks, where the attacker has complete access to model parameters, architecture, and gradients. You implement and compare the three canonical gradient-based attacks, FGSM, PGD, and C&W, and then cross from attacking to defending by training binary detectors that try to catch the perturbations. **Speaker:** Blaine Hoak (University of Wisconsin-Madison & Visa Research) **Key Topics:** - The white-box threat model and its role as an upper bound on robustness - Two families of attacks: max-loss (norm-bounded) versus min-norm optimization - Fast Gradient Sign Method (FGSM): single-step gradient attacks - Projected Gradient Descent (PGD): iterative, projected, randomly-started attacks - Carlini & Wagner (C&W): unconstrained min-norm optimization - Perturbation norms $L_\infty$, $L_2$, $L_0$, and attack transferability **Learning Outcomes:** - Implement and execute gradient-based attacks including FGSM, PGD, and C&W - Understand the mathematical formulations underlying white-box attacks - Tune attack hyperparameters (step sizes, iterations, perturbation budgets) - Explore attack transferability across model architectures - Understand why a detector calibrated at one attack strength fails to generalize across the strength spectrum **Hands-on Lab:** implement all three attacks on both an MNIST digit model and a CIFAR-10 color-image model with ART, then train and evaluate adversarial-example detectors across a sweep of attack strengths. [Go to Workshop 3](Workshop03/Adversarial_Attacks_-_White-Box_Attacks.md) --- ### Workshop 4: Adversarial Attacks - Black-Box Attacks *Recorded lecture + lab.* Builds on the white-box methodology to focus on attacks where the adversary has only query access to model predictions. You learn practical black-box attack strategies including ZOO and SimBA, and reason about the query-budget tradeoffs that make these attacks realistic. **Speaker:** Blaine Hoak (University of Wisconsin-Madison & Visa Research) *(temp - speaker to be confirmed)* **Key Topics:** - The black-box threat model: query access, limited queries, no model knowledge - Gradient approximation using finite differences - Zero-Order Optimization (ZOO): gradient estimation from queries - Simple Black-box Adversarial (SimBA): sequential per-pixel perturbations - Substitute-model and transfer-based approaches - Query-budget management and detection mechanisms **Learning Outcomes:** - Implement and execute query-based attacks including ZOO and SimBA - Understand gradient-approximation techniques for optimization without direct access - Evaluate query-budget tradeoffs between effectiveness and efficiency - Compare black-box attacks to their white-box variants - Understand practical constraints such as rate limiting and detection **Hands-on Lab:** run query-based attacks on MNIST and CIFAR-10 classifiers with ART, tracking query counts and success under realistic query budgets. [Go to Workshop 4](Workshop04/Adversarial_Attacks_-_Black-Box_Attacks.md) --- ### Workshop 5: Robustness and Resilience *Recorded lecture + lab.* Turns from attacking to defending, covering adversarial training, certified defenses, domain adaptation, and fault tolerance. You learn strategies to improve model stability, reliability, and performance under adverse conditions, and see the gap between empirical and provable robustness. **Speaker:** Ryan Sheatsley (University of Wisconsin-Madison) **Key Topics:** - Robustness fundamentals: evasion, poisoning, and distribution robustness - Adversarial training as minimax optimization against worst-case perturbations - Certified defenses: randomized smoothing and formal robustness guarantees - Domain adaptation and transfer learning for distribution shifts - Fault tolerance: redundancy, graceful degradation, and failure recovery **Learning Outcomes:** - Understand the concepts of adversarial robustness and resilience - Implement and evaluate adversarial-training approaches - Apply certified defenses and read certified robustness guarantees - Handle distribution shifts through domain adaptation - Design fault-tolerant systems with graceful degradation **Hands-on Lab:** train and compare standard, PGD-adversarially-trained, and certified (zonotope/DeepZ) MNIST classifiers with ART, weighing clean accuracy against provable $L_\infty$ robustness. [Go to Workshop 5](Workshop05/Robustness_and_Resilience.md) --- ### Workshop 6: AI and Privacy - Differential Privacy & Federated Learning *Recorded lecture + lab.* Shifts the target of protection from the model's output to its training data. You explore privacy-preserving methods around differential privacy and federated learning, understand privacy attacks such as model inversion and gradient leakage, and evaluate the privacy-utility tradeoff directly. **Speaker:** Kai Yue (North Carolina State University) **Key Topics:** - Privacy threats: membership inference, model inversion, attribute inference, data memorization - $(\epsilon, \delta)$-differential privacy, the privacy budget, and composition - DP-SGD: per-example gradient clipping and Gaussian noise - Federated learning and the FedAvg protocol - Deep Leakage from Gradients (DLG) and federated backdoor attacks - Central versus local differential privacy and the privacy-utility tradeoff **Learning Outcomes:** - Implement differential-privacy mechanisms that provide formal guarantees - Design and evaluate federated-learning architectures for distributed training - Understand and defend against privacy attacks including DLG and membership inference - Evaluate privacy-utility tradeoffs through noise-multiplier experiments - Relate these techniques to regulatory frameworks such as GDPR and CCPA **Hands-on Lab:** build a FedAvg federated system in PyTorch with Opacus for the differential-privacy machinery, then attack the very system you built to show why sharing gradients is not automatically private. [Go to Workshop 6](Workshop06/AI_and_Privacy_Differential_Privacy_and_Federated_Learning.md) --- ### Workshop 7: Ethics in AI - Bias and Fairness *Recorded lecture + lab.* Explores ethical considerations in AI development, focusing on bias detection, fairness metrics, and mitigation. You learn to identify different types of bias, understand fairness definitions and their tradeoffs, and implement mitigation across the ML pipeline. **Speaker:** Tamer Abuhmed (Sungkyunkwan University) **Key Topics:** - Types of bias: data, algorithmic, and societal - Fairness definitions: demographic parity, equalized odds, predictive parity, calibration - Fairness tradeoffs and conflicts between definitions - Mitigation approaches: pre-processing, in-processing, post-processing - Fairness assessment and governance beyond technical fixes **Learning Outcomes:** - Recognize multiple sources of bias, including data, algorithmic, and societal origins - Understand different fairness definitions and their inherent tradeoffs - Measure bias through statistical metrics and evaluation frameworks - Implement mitigation techniques at pre-, in-, and post-processing stages - Appreciate that ethical AI requires organizational commitment beyond code **Hands-on Lab:** measure bias on a fairness-benchmark dataset (Adult/Census Income by default, with COMPAS and German Credit selectable) using AI Fairness 360 (AIF360) over a scikit-learn classifier, apply the Optimized Preprocessing mitigation, and compare the fairness metrics and accuracy before and after. [Go to Workshop 7](Workshop07/Ethics_in_AI_-_Bias_and_Fairness.md) --- ### Workshop 8: Trust in AI - Transparency, Explainability & Interpretability *Recorded lecture + lab.* Explores trust in AI systems through transparency, explainability, and interpretability. You learn how the dominant explanation techniques work, then see the workshop's distinctive point: explanations are fragile and can be manipulated. **Speaker:** Eldor Abdukhamidov (Sungkyunkwan University, South Korea) **Key Topics:** - Dimensions of trust: user acceptance, organizational adoption, accountability - Explainability versus interpretability versus transparency - Feature attribution with LIME and SHAP - Gradient- and activation-based maps: saliency, Class Activation Mapping (CAM), Integrated Gradients - Vulnerabilities in interpretation: adversarial attacks on explanations, instability, manipulated saliency **Learning Outcomes:** - Distinguish between explainability, interpretability, and transparency - Understand how LIME and SHAP attribute a model's decisions - Identify vulnerabilities in interpretation methods and how they can be exploited - Design systems with transparency-by-design principles - Evaluate the reliability and robustness of explanations **Hands-on Lab:** implement CAM and Integrated Gradients from first principles in PyTorch on a pre-trained ResNet-18, then use the resulting heatmaps to inspect adversarial inputs and see the "focus displacement" a successful attack produces. LIME and SHAP are covered conceptually and situated in a taxonomy alongside the methods the lab builds. [Go to Workshop 8](Workshop08/Trust_in_AI_Transparency_Explainability_and_Interpretability.md) --- ### Workshop 9: AI Development and Security *Recorded lecture.* Introduces DevOps and MLOps practices in the context of AI security. You learn to integrate security throughout the ML development lifecycle, apply secure coding practices, and understand regulatory compliance requirements. This is a lecture-only workshop with no lab notebook. **Speaker:** Jaron Mink (Arizona State University) **Key Topics:** - DevOps and MLOps pipelines: data collection through deployment and monitoring - Secure coding in machine learning: data handling, input validation, dependency management - Model-robustness testing and interpretability for security analysis - Containerization security and secure API endpoints - Regulatory requirements: GDPR, HIPAA, ISO 27001, NIST Cybersecurity Framework **Learning Outcomes:** - Understand DevOps and MLOps principles that support secure delivery - Integrate security into every stage of the ML development lifecycle - Implement secure coding practices including data handling and input validation - Design secure ML pipelines with proper CI/CD practices - Apply regulatory compliance frameworks (GDPR, HIPAA, ISO 27001) [Go to Workshop 9](Workshop09/AI_Development_and_Security.md) --- ### Workshop 10: AI and Data Governance - Regulations and Standards *Recorded panel.* Introduces the key regulations and standards for AI and data governance through a recorded panel. You learn about legal and ethical considerations in AI development, GDPR, CCPA, and EU AI Act compliance, and data-protection techniques. This is a discussion workshop with no lab notebook. **Panelists:** Ahmed Abusnaina (Meta), Muhammad Saad (X), Jon McLachlan (YSecurity), Yasser Shoukry (UC Irvine), Eric Chan-Tin (Loyola University Chicago) **Key Topics:** - Data governance: quality, security, metadata, stewardship, lifecycle management - GDPR: seven core principles and implications for automated decisions - CCPA: consumer rights to know, delete, opt-out, and non-discrimination - EU AI Act: risk classification from prohibited to minimal-risk - Data protection: anonymization, pseudonymization, encryption **Learning Outcomes:** - Navigate legal regulations including GDPR, CCPA, and the EU AI Act - Apply data-privacy principles specifically to AI systems - Implement data-protection techniques including anonymization and encryption - Conduct responsible-AI and bias assessments - Design compliant AI systems across multiple jurisdictions [Go to Workshop 10](Workshop10/AI_and_Data_Govern_Regulations_and_Standards.md) --- ### Workshop 11: Secure Deployment and Operation of AI Systems *Recorded lecture.* Focuses on secure deployment practices for ML models, covering framework vulnerabilities in TensorFlow and PyTorch, container security, API authentication, monitoring, and incident response. This is a lecture-only workshop with no lab notebook. **Speaker:** Neophytos Christou (Brown University) **Key Topics:** - Model-level attacks: adversarial examples, poisoning, extraction, inversion, membership inference - Framework vulnerabilities: buffer/integer overflow, type confusion, use-after-free in TensorFlow/PyTorch - Dependency and supply-chain security - Secure deployment: Docker hardening, authentication, rate limiting, input validation - Monitoring metrics and incident-response planning **Learning Outcomes:** - Identify vulnerabilities in AI frameworks including TensorFlow and PyTorch - Implement secure deployment practices for ML models - Design monitoring systems to detect attacks and anomalous behavior - Manage dependencies securely and handle configuration safely - Create incident-response plans specifically for AI systems [Go to Workshop 11](Workshop11/Secure_Deployment_and_Operation_of_AI_Systems.md) --- ### Workshop 12: Case Studies & Real-World Applications *Case studies + capstone lab.* The capstone workshop examines real-world secure-AI practice through case studies from AIShield (a Bosch startup), then integrates the program's threads in a hands-on federated-learning-with-differential-privacy lab. **Key Topics:** - AIShield overview: technology for model-robustness enhancement - Case Study 1: adversarial robustness in spam detection - Case Study 2: privacy-preserving healthcare ML with federated learning and differential privacy - Case Study 3: fairness mitigation in hiring AI across demographic groups - Case Study 4: federated-learning security with Byzantine and hidden-trigger backdoor attacks **Learning Outcomes:** - Apply the program's concepts to real-world deployment scenarios - Evaluate trade-offs between security, privacy, fairness, and performance - Analyze federated-learning vulnerabilities including Byzantine and backdoor attacks - Build a complete DP-FedAvg pipeline and read off a stated $(\epsilon, \delta)$ guarantee - Understand industry best practices from a leading organization **Hands-on Lab:** build a DP-FedAvg pipeline in TensorFlow Federated (TFF) on the pre-partitioned federated EMNIST dataset, then use Google's `dp_accounting` to calibrate the noise multiplier and compute the exact $(\epsilon, \delta)$ bound for the released model. [Go to Workshop 12](Workshop12/Case_Studies_RealWorld_Applications_AIShield.md) --- ## Integrated Learning Outcomes By working through all 12 workshops, you will be able to: ### Security & Robustness - Understand and classify threat models in AI systems - Design and implement attacks against ML systems (white-box and black-box) - Evaluate model robustness using multiple metrics and perturbation norms - Implement defenses including adversarial training and certified defenses - Conduct security assessments of neural networks ### Privacy & Data Protection - Design privacy-preserving machine learning systems - Implement differential privacy with formal guarantees and federated-learning architectures - Understand and defend against privacy attacks (DLG, membership inference, model inversion) - Apply data-protection principles under GDPR and CCPA - Reason about privacy impact for AI systems ### Ethics & Responsibility - Identify and measure bias across multiple fairness definitions - Implement fairness-aware ML with pre-, in-, and post-processing techniques - Apply ethical frameworks to AI development decisions - Conduct fairness and bias audits with governance structures - Balance accuracy with fairness requirements ### Transparency & Trust - Generate explanations for model predictions using attribution and activation methods - Understand interpretability techniques, their limitations, and vulnerabilities - Design trustworthy AI systems with transparency-by-design principles - Understand secure deployment strategies with monitoring and incident response - Communicate system capabilities, limitations, and risks effectively ### Development & Operations - Apply secure coding practices to ML systems throughout the lifecycle - Understand MLOps pipelines with integrated security at every stage - Apply compliance and governance frameworks (GDPR, HIPAA, ISO 27001) - Reason about risk assessments, privacy impact assessments, and bias audits - Understand documentation and policy needs for AI systems ### Practical Implementation - Implement attacks and defenses using industry-standard tools (ART, AIF360, Opacus, TensorFlow Federated) - Work with real datasets across multiple domains (MNIST, CIFAR-10, federated EMNIST, Adult/Census Income, COMPAS, German Credit) - Apply concepts to current industry challenges through case studies - Analyze framework vulnerabilities in TensorFlow and PyTorch - Produce secure, documented ML experiments --- ## Technical Stack & Tools Everything below is used somewhere in the workshop labs. You can run all of it locally with Python and Jupyter, or in the browser with Google Colab. ### Programming & ML Frameworks - **Python** 3.8+ - **PyTorch** and **torchvision** (the attack, defense, privacy, and explainability labs) - **TensorFlow / Keras** and **TensorFlow Federated (TFF)** (the Workshop 12 capstone lab) - **scikit-learn** for traditional ML - **NumPy**, **Pandas**, **Matplotlib** ### Security, Privacy & Fairness Libraries - **Adversarial Robustness Toolbox (ART)** - attacks and defenses (Workshops 2-5) - **Opacus** - differential privacy for PyTorch (Workshop 6) - **Google `dp_accounting`** - privacy accounting for the DP-FedAvg lab (Workshop 12) - **AI Fairness 360 (AIF360)** - bias measurement and mitigation (Workshop 7) - **LIME / SHAP** - feature-attribution explainers (taught in Workshop 8) - **CAM / Integrated Gradients** - activation- and gradient-based explanations implemented from scratch in the Workshop 8 lab ### Datasets - **MNIST** and **CIFAR-10** - the image classifiers used across the attack and defense labs - **Federated EMNIST** - the pre-partitioned dataset for the Workshop 12 federated lab - **Adult / Census Income**, **COMPAS**, **German Credit** - the fairness-benchmark datasets in Workshop 7 - **ImageNet** images with a pre-trained ResNet-18 - the explainability lab in Workshop 8 --- ## Session Dependencies & Learning Flow The program has a foundation (Workshops 1 and 2), a core attack-and-defense arc (Workshops 3 to 5), a parallel privacy and ethics track (Workshops 6 and 7), and a set of trust, development, governance, and deployment sessions (Workshops 8 to 11) that culminate in the capstone (Workshop 12). Following the sequence in order is recommended because later workshops assume the vocabulary of earlier ones. ``` Workshop 1: Introduction and Fundamentals └── Foundation: AI basics, security landscape, ethical awareness │ ├── Workshop 2: AI and Threat Models │ └── Foundation for the attack/defense taxonomy │ │ │ ├── Workshop 3: White-Box Attacks │ │ └── Gradient-based attacks (FGSM, PGD, C&W) │ │ │ │ │ └── Workshop 4: Black-Box Attacks │ │ └── Query-based attacks (ZOO, SimBA) │ │ │ │ │ └── Workshop 5: Robustness and Resilience │ │ └── Defenses (adversarial training, certified defenses) │ │ │ ├── Workshop 6: Privacy and Federated Learning │ │ └── Privacy-preserving ML (DP, FL, DLG attacks) │ │ │ └── Workshop 7: Ethics and Fairness │ └── Bias detection and mitigation │ ├── Workshop 8: Trust and Explainability │ └── LIME, SHAP, CAM, Integrated Gradients, interpretation vulnerabilities │ ├── Workshop 9: AI Development and Security │ └── MLOps, secure coding, regulatory compliance │ ├── Workshop 10: Data Governance │ └── GDPR, CCPA, EU AI Act, data-protection techniques │ ├── Workshop 11: Secure Deployment │ └── Framework vulnerabilities, container security, monitoring │ └── Workshop 12: Case Studies & Real-World Applications └── Capstone: integrates all concepts from Workshops 1-11 ``` --- ## Prerequisites & Requirements ### Minimum Knowledge - Python programming (intermediate level) - Linear algebra basics (vectors, matrices) - Calculus fundamentals (derivatives, gradients) - Machine-learning basics (supervised learning, neural networks) - Comfort with command-line tools and Jupyter notebooks ### Software & Environment - Python 3.8 or higher with Jupyter Notebook or JupyterLab, **or** a Google account for Google Colab (no local installation needed) - Git and a GitHub account (optional, for cloning the materials) - Operating system: Linux, macOS, or Windows (with WSL2) ### Recommended Background - Some experience with PyTorch or TensorFlow - Familiarity with CNN architectures - Awareness of dataset characteristics (MNIST, CIFAR-10, etc.) - Basic knowledge of cybersecurity concepts --- ## Completing the Program This is a completion-based, self-study program, there are no live sessions and no attendance to track. **To complete the program:** work through all 12 workshops, watch the recorded panels and lectures, and complete the hands-on lab activities. **By completing the program, you gain:** - Understanding of core concepts in AI security, privacy, and ethics - Practical skills in secure ML development and evaluation - Understanding of ethical principles and compliance frameworks - Applied competencies in trustworthy AI systems --- ## Frequently Asked Questions **Q: Do I need to attend anything live?** A: No. The program is fully self-study. Every panel and lecture is a recording you watch on demand, and you run the labs on your own schedule. **Q: Where are the code and datasets?** A: All lab notebooks are stored directly in each workshop's `WorkshopNN/` directory (not under `assets/`) and each has a matching Google Colab link on the workshop page. Supporting files like datasets, models, and slides are also placed directly in each workshop's directory alongside the notebook. **Q: Do I need to install anything to run the labs?** A: No. Every lab notebook has a Google Colab link, so you can run it in your browser with no local setup. If you prefer, run the notebooks locally with Python and Jupyter. **Q: Is this program suitable for beginners?** A: It assumes intermediate Python and basic machine-learning knowledge. If you are new to ML, review the fundamentals in the [Resource Library](resources.md) before starting. **Q: How much time should I plan per workshop?** A: Plan for roughly 4 to 5 hours per workshop: time to watch the session and work through the hands-on lab. You can go faster or slower as you like. --- ## Next Steps 1. [Start with Workshop 1](Workshop01/Introduction_and_Fundamentals_in_AI.md) - Introduction and Fundamentals 2. [Read the site introduction](index.md) - How the self-study program works 3. [Resource Library](resources.md) - Papers, tools, datasets, and external references