Resource Library¶

A curated collection of the tools, datasets, papers, and standards that the SecureAI workshops actually use and cite. Everything here maps to something you will read, run, or reference while working through the 12 self-study workshops, it is a reference shelf, not an exhaustive survey.

Use it two ways: as a setup checklist before you start the labs, and as a lookup table when a workshop mentions a tool or paper and you want the primary source.

Setting Up for the Labs¶

The program is fully self-study. You can run every lab in one of two ways:

• Google Colab (no installation): open the Colab link on each workshop page, then File -> Save a copy in Drive to run it with your own account and save your results.
• Local Python + Jupyter: install Python 3.8+ and Jupyter, then open the notebook from the workshop's own directory.

Each workshop page lists the exact notebooks for that session, with both a repository link and a Colab link. Install lab-specific libraries as each notebook requires them; the notebooks import what they need at the top of the file.

Recommended baseline: Python 3.8+, Jupyter (or a Colab account), and the scientific Python stack (NumPy, Pandas, Matplotlib). Individual labs add the specialized libraries listed below.

Tools and Libraries¶

These are the libraries the workshops build their labs on. Only tools that appear in the actual course materials are listed.

Model Frameworks¶

Security, Privacy, and Fairness¶

Explainability¶

Data Handling and Visualization¶

Datasets¶

The labs use a small set of canonical benchmarks. Most download automatically from the notebook; the fairness and federated datasets are also shipped under each workshop's root-level datasets/ folder so the labs run offline.

Common access patterns:

# Vision datasets (PyTorch)
from torchvision import datasets
mnist  = datasets.MNIST(root="./data", download=True)
cifar  = datasets.CIFAR10(root="./data", download=True)

# Vision datasets (Keras)
from tensorflow.keras.datasets import mnist, cifar10
(x_train, y_train), (x_test, y_test) = mnist.load_data()

# Fairness datasets (AIF360)
from aif360.datasets import AdultDataset, CompasDataset, GermanDataset

Key Papers and References¶

Primary sources cited across the workshops, grouped by theme. Where a link may not resolve, the work is cited by author, year, and venue instead.

Adversarial Attacks (WS3-4)¶

• Goodfellow, Shlens & Szegedy (2015), "Explaining and Harnessing Adversarial Examples" (FGSM), ICLR 2015: arXiv:1412.6572
• Madry et al. (2018), "Towards Deep Learning Models Resistant to Adversarial Attacks" (PGD), ICLR 2018: arXiv:1706.06083
• Carlini & Wagner (2017), "Towards Evaluating the Robustness of Neural Networks" (C&W), IEEE Symposium on Security and Privacy (S&P) 2017: arXiv:1608.04644
• Chen, Zhang, Sharma, Yi & Hsieh (2017), "ZOO: Zeroth Order Optimization Based Black-box Attacks to Deep Neural Networks without Training Substitute Models," ACM Workshop on Artificial Intelligence and Security (AISec), co-located with ACM CCS 2017: arXiv:1708.03999
• Guo, Gardner, You, Wilson & Weinberger (2019), "Simple Black-box Adversarial Attacks" (SimBA), ICML 2019: arXiv:1905.07121

Robustness and Evaluation (WS5)¶

• Cohen, Rosenfeld & Kolter (2019), "Certified Adversarial Robustness via Randomized Smoothing," ICML 2019: arXiv:1902.02918
• Carlini et al. (2019), "On Evaluating Adversarial Robustness," arXiv preprint (not published in a peer-reviewed venue): arXiv:1902.06705

Privacy and Federated Learning (WS6, WS12)¶

• Abadi et al. (2016), "Deep Learning with Differential Privacy" (DP-SGD), ACM CCS 2016: arXiv:1607.00133
• McMahan, Moore, Ramage, Hampson & Agüera y Arcas (2017), "Communication-Efficient Learning of Deep Networks from Decentralized Data" (FedAvg), AISTATS 2017: arXiv:1602.05629
• Zhu, Liu & Han (2019), "Deep Leakage from Gradients" (DLG), NeurIPS 2019: arXiv:1906.08935
• Blanchard, El Mhamdi, Guerraoui & Stainer (2017), "Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent" (Krum), NeurIPS 2017: proceedings.neurips.cc

Fairness (WS7)¶

• Hardt, Price & Srebro (2016), "Equality of Opportunity in Supervised Learning," NeurIPS 2016: arXiv:1610.02413
• Chouldechova (2017), "Fair Prediction with Disparate Impact: A Study of Bias in Recidivism Prediction Instruments," Big Data, 5(2):153-163: arXiv:1610.07524
• Kleinberg, Mullainathan & Raghavan (2017), "Inherent Trade-Offs in the Fair Determination of Risk Scores," ITCS 2017: arXiv:1609.05807
• Bellamy et al. (2019), "AI Fairness 360: An Extensible Toolkit for Detecting, Understanding, and Mitigating Unwanted Algorithmic Bias" (AIF360), IBM Journal of Research and Development, 63(4/5): arXiv:1810.01943

Explainability and Attacks on Explanations (WS8)¶

• Ribeiro, Singh & Guestrin (2016), "Why Should I Trust You? Explaining the Predictions of Any Classifier" (LIME), KDD 2016: arXiv:1602.04938
• Lundberg & Lee (2017), "A Unified Approach to Interpreting Model Predictions" (SHAP), NeurIPS 2017: arXiv:1705.07874
• Sundararajan, Taly & Yan (2017), "Axiomatic Attribution for Deep Networks" (Integrated Gradients), ICML 2017: arXiv:1703.01365
• Zhou, Khosla, Lapedriza, Oliva & Torralba (2016), "Learning Deep Features for Discriminative Localization" (CAM), CVPR 2016: arXiv:1512.04150
• Ghorbani, Abid & Zou (2019), "Interpretation of Neural Networks is Fragile," AAAI 2019: arXiv:1710.10547
• Slack, Hilgard, Jia, Singh & Lakkaraju (2020), "Fooling LIME and SHAP: Adversarial Attacks on Post hoc Explanation Methods," AIES 2020: arXiv:1911.02508

Governance and Standards¶

Referenced in the governance and deployment workshops (WS9-11). Cited by title where an official URL may change over time.

• NIST AI Risk Management Framework (AI RMF 1.0): the reference framework for identifying and managing AI risks. airc.nist.gov
• NIST AI 100-2 E2025, "Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations": the standard taxonomy for adversarial-ML threats and defenses. csrc.nist.gov
• EU AI Act (Regulation (EU) 2024/1689): the European Union's risk-tiered regulation of AI systems, in force since August 2024. eur-lex.europa.eu
• Blueprint for an AI Bill of Rights (US OSTP, 2022): principles for the design and deployment of automated systems. bidenwhitehouse.archives.gov

Cross-Reference: Workshops¶

Each workshop page carries its own focused resource list. Jump directly to a session:

• Workshop 1: Introduction and Fundamentals in AI
• Workshop 2: AI and Threat Models
• Workshop 3: Adversarial Attacks - White-Box Attacks
• Workshop 4: Adversarial Attacks - Black-Box Attacks
• Workshop 5: Robustness and Resilience
• Workshop 6: AI and Privacy - Differential Privacy and Federated Learning
• Workshop 7: Ethics in AI - Bias and Fairness
• Workshop 8: Trust in AI - Transparency, Explainability and Interpretability
• Workshop 9: AI Development and Security
• Workshop 10: AI and Data Governance - Regulations and Standards
• Workshop 11: Secure Deployment and Operation of AI Systems
• Workshop 12: Case Studies and Real-World Applications - AIShield

See also the Program Overview for the full learning path.

Suggested Learning Paths¶

The workshops are designed to be followed in order, since later sessions build on earlier ones. If you are focused on a particular area, these paths highlight the most relevant sessions.

Adversarial ML (attacks and defenses): Workshop 2 (threat models) -> Workshop 3 (white-box) -> Workshop 4 (black-box) -> Workshop 5 (robustness). Core tool: ART.

Privacy and federated learning: Workshop 6 (differential privacy and FedAvg) -> Workshop 12 (DP-FedAvg case study). Core tools: Opacus, TensorFlow Federated, dp_accounting.

Trustworthy and responsible AI: Workshop 7 (bias and fairness) -> Workshop 8 (explainability) -> Workshop 10 (governance). Core tools: AIF360, LIME, SHAP, Integrated Gradients, CAM.

Secure development and deployment: Workshop 9 (development and security) -> Workshop 11 (secure deployment) -> Workshop 12 (case studies).

Glossary¶

Adversarial example - an input with a small, deliberately chosen perturbation that causes a model to misclassify it.

White-box / black-box attack - an attack with full access to the model's parameters and gradients (white-box) versus one limited to querying its outputs (black-box).

Robustness - a model's ability to maintain correct behavior under adversarial or shifted inputs; certified robustness gives a provable guarantee within a bounded region.

Differential privacy (DP) - a mathematical guarantee, parameterized by \((\epsilon, \delta)\), that a model's output reveals little about any single training record.

DP-SGD - differentially private stochastic gradient descent: clip per-example gradients, add Gaussian noise, and track the privacy spend with an accountant.

Federated learning (FL) - training a shared model across decentralized clients that keep their data local; FedAvg is the canonical aggregation algorithm.

Gradient leakage - reconstruction of private training data from shared gradients (e.g., the Deep Leakage from Gradients attack).

Byzantine / Krum - a Byzantine participant sends malicious updates in distributed training; Krum is a robust aggregation rule that resists them.

Fairness metric - a precise definition of equitable treatment (e.g., statistical parity, equal opportunity, calibration); several are mutually incompatible in general.

Explainability / interpretability - methods that make a model's predictions understandable, either post hoc (LIME, SHAP) or through attribution (Integrated Gradients, CAM).

Threat model - an explicit statement of an adversary's goals, knowledge, and capabilities, used to scope what a defense must protect against.

Resource Library | SecureAI Self-Study Program | 12-Workshop Format