# Resource Library

A curated collection of the tools, datasets, papers, and standards that the SecureAI workshops
actually use and cite. Everything here maps to something you will read, run, or reference while
working through the 12 self-study workshops, it is a reference shelf, not an exhaustive survey.

Use it two ways: as a **setup checklist** before you start the labs, and as a **lookup table**
when a workshop mentions a tool or paper and you want the primary source.

---

## Setting Up for the Labs

The program is fully self-study. You can run every lab in one of two ways:

- **Google Colab (no installation):** open the Colab link on each workshop page, then
  **File -> Save a copy in Drive** to run it with your own account and save your results.
- **Local Python + Jupyter:** install Python 3.8+ and Jupyter, then open the notebook from the
  workshop's own directory.

Each workshop page lists the exact notebooks for that session, with both a repository link and a
Colab link. Install lab-specific libraries as each notebook requires them; the notebooks import
what they need at the top of the file.

**Recommended baseline:** Python 3.8+, Jupyter (or a Colab account), and the scientific Python
stack (NumPy, Pandas, Matplotlib). Individual labs add the specialized libraries listed below.

---

## Tools and Libraries

These are the libraries the workshops build their labs on. Only tools that appear in the actual
course materials are listed.

### Model Frameworks

| Tool | Purpose | Used in | Reference |
|------|---------|---------|-----------|
| **PyTorch** | Primary deep-learning framework for most labs | WS3-8 | [pytorch.org](https://pytorch.org/) |
| **TensorFlow / Keras** | Model building and training; the federated labs' framework | WS3, WS12 | [tensorflow.org](https://www.tensorflow.org/), [keras.io](https://keras.io/) |

### Security, Privacy, and Fairness

| Tool | Purpose | Used in | Reference |
|------|---------|---------|-----------|
| **Adversarial Robustness Toolbox (ART)** | Attack and defense implementations (FGSM, PGD, C&W, evasion defenses) | WS2-5 | [github.com/Trusted-AI/adversarial-robustness-toolbox](https://github.com/Trusted-AI/adversarial-robustness-toolbox) |
| **Opacus** | Differential privacy for PyTorch: per-example gradient clipping, Gaussian noise, privacy accounting | WS6 | [opacus.ai](https://opacus.ai/) |
| **TensorFlow Federated (TFF)** | Simulating federated computations (DP-FedAvg pipeline) | WS12 | [tensorflow.org/federated](https://www.tensorflow.org/federated) |
| **Google `dp_accounting`** | Computing the formal $(\epsilon, \delta)$ privacy guarantee for the DP-FedAvg lab | WS12 | [github.com/google/differential-privacy](https://github.com/google/differential-privacy) |
| **AI Fairness 360 (AIF360)** | Bias metrics and pre-processing mitigations (Optimized Preprocessing) | WS7 | [github.com/Trusted-AI/AIF360](https://github.com/Trusted-AI/AIF360) |

### Explainability

| Tool | Purpose | Used in | Reference |
|------|---------|---------|-----------|
| **LIME** | Local, model-agnostic explanations | WS8 (theory) | [github.com/marcotcr/lime](https://github.com/marcotcr/lime) |
| **SHAP** | Shapley-value feature attributions | WS8 (theory) | [github.com/shap/shap](https://github.com/shap/shap) |
| **Class Activation Mapping (CAM)** | Localizing image regions that drive a prediction | WS8 (lab) | [Zhou et al., 2016](https://arxiv.org/abs/1512.04150) |
| **Integrated Gradients** | Axiomatic attribution for deep networks | WS8 (lab) | [Sundararajan et al., 2017](https://arxiv.org/abs/1703.01365) |

### Data Handling and Visualization

| Tool | Purpose | Reference |
|------|---------|-----------|
| **scikit-learn** | Classical models (e.g., the logistic-regression classifier in the fairness lab), utilities | [scikit-learn.org](https://scikit-learn.org/) |
| **NumPy** | Numerical arrays | [numpy.org](https://numpy.org/) |
| **Pandas** | Tabular data handling | [pandas.pydata.org](https://pandas.pydata.org/) |
| **Matplotlib** | Plotting | [matplotlib.org](https://matplotlib.org/) |
| **seaborn** | Statistical visualization | [seaborn.pydata.org](https://seaborn.pydata.org/) |
| **VisualKeras** (optional) | Layered visualization of Keras model architectures | WS3 | [github.com/paulgavrikov/visualkeras](https://github.com/paulgavrikov/visualkeras) |

---

## Datasets

The labs use a small set of canonical benchmarks. Most download automatically from the notebook;
the fairness and federated datasets are also shipped under each workshop's root-level `datasets/` folder so the
labs run offline.

| Dataset | Type | Used in | Access |
|---------|------|---------|--------|
| **MNIST** | Handwritten digits (10 classes) | WS3-6 | Auto-download via `torchvision.datasets.MNIST` or `keras.datasets.mnist` |
| **CIFAR-10** | Natural images (10 classes) | WS3-5 | Auto-download via `torchvision.datasets.CIFAR10` or `keras.datasets.cifar10` |
| **ImageNet (pre-trained ResNet-18)** | Natural images (1000 classes) | WS8 | Pre-trained weights via `torchvision.models.resnet18`; sample images used for explanations |
| **Federated EMNIST** | Handwritten characters, pre-partitioned by writer (non-IID) | WS12 | Loaded via TFF (`tff.simulation.datasets.emnist`); also shipped under Workshop 12 `datasets/` |
| **Adult / Census Income** | Tabular; predicts income > \$50K (protected: sex, race) | WS7 (primary) | AIF360 loader, or local copy in `Workshop07/datasets/adult/` |
| **COMPAS** | Tabular; recidivism-risk scores (protected: race) | WS7 | AIF360 loader, or local copy in `Workshop07/datasets/compas/` |
| **German Credit** | Tabular; credit risk (protected: sex, age) | WS7 | AIF360 loader, or local copy in `Workshop07/datasets/german/` |
> The AIF360 fairness datasets (Adult, COMPAS, German Credit) may require you to place raw data
> files in the library's dataset directory the first time you use them; the Workshop 7 notebook
> ships local copies so the lab runs without that step.

**Common access patterns:**

```python
# Vision datasets (PyTorch)
from torchvision import datasets
mnist  = datasets.MNIST(root="./data", download=True)
cifar  = datasets.CIFAR10(root="./data", download=True)

# Vision datasets (Keras)
from tensorflow.keras.datasets import mnist, cifar10
(x_train, y_train), (x_test, y_test) = mnist.load_data()

# Fairness datasets (AIF360)
from aif360.datasets import AdultDataset, CompasDataset, GermanDataset
```

---

## Key Papers and References

Primary sources cited across the workshops, grouped by theme. Where a link may not resolve, the
work is cited by author, year, and venue instead.

### Adversarial Attacks (WS3-4)

- **Goodfellow, Shlens & Szegedy (2015), "Explaining and Harnessing Adversarial Examples" (FGSM), ICLR 2015:** [arXiv:1412.6572](https://arxiv.org/abs/1412.6572)
- **Madry et al. (2018), "Towards Deep Learning Models Resistant to Adversarial Attacks" (PGD), ICLR 2018:** [arXiv:1706.06083](https://arxiv.org/abs/1706.06083)
- **Carlini & Wagner (2017), "Towards Evaluating the Robustness of Neural Networks" (C&W), IEEE Symposium on Security and Privacy (S&P) 2017:** [arXiv:1608.04644](https://arxiv.org/abs/1608.04644)
- **Chen, Zhang, Sharma, Yi & Hsieh (2017), "ZOO: Zeroth Order Optimization Based Black-box Attacks to Deep Neural Networks without Training Substitute Models," ACM Workshop on Artificial Intelligence and Security (AISec), co-located with ACM CCS 2017:** [arXiv:1708.03999](https://arxiv.org/abs/1708.03999)
- **Guo, Gardner, You, Wilson & Weinberger (2019), "Simple Black-box Adversarial Attacks" (SimBA), ICML 2019:** [arXiv:1905.07121](https://arxiv.org/abs/1905.07121)

### Robustness and Evaluation (WS5)

- **Cohen, Rosenfeld & Kolter (2019), "Certified Adversarial Robustness via Randomized Smoothing," ICML 2019:** [arXiv:1902.02918](https://arxiv.org/abs/1902.02918)
- **Carlini et al. (2019), "On Evaluating Adversarial Robustness," arXiv preprint (not published in a peer-reviewed venue):** [arXiv:1902.06705](https://arxiv.org/abs/1902.06705)

### Privacy and Federated Learning (WS6, WS12)

- **Abadi et al. (2016), "Deep Learning with Differential Privacy" (DP-SGD), ACM CCS 2016:** [arXiv:1607.00133](https://arxiv.org/abs/1607.00133)
- **McMahan, Moore, Ramage, Hampson & Agüera y Arcas (2017), "Communication-Efficient Learning of Deep Networks from Decentralized Data" (FedAvg), AISTATS 2017:** [arXiv:1602.05629](https://arxiv.org/abs/1602.05629)
- **Zhu, Liu & Han (2019), "Deep Leakage from Gradients" (DLG), NeurIPS 2019:** [arXiv:1906.08935](https://arxiv.org/abs/1906.08935)
- **Blanchard, El Mhamdi, Guerraoui & Stainer (2017), "Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent" (Krum), NeurIPS 2017:** [proceedings.neurips.cc](https://proceedings.neurips.cc/paper/2017/hash/f4b9ec30ad9f68f89b29639786cb62ef-Abstract.html)

### Fairness (WS7)

- **Hardt, Price & Srebro (2016), "Equality of Opportunity in Supervised Learning," NeurIPS 2016:** [arXiv:1610.02413](https://arxiv.org/abs/1610.02413)
- **Chouldechova (2017), "Fair Prediction with Disparate Impact: A Study of Bias in Recidivism Prediction Instruments," Big Data, 5(2):153-163:** [arXiv:1610.07524](https://arxiv.org/abs/1610.07524)
- **Kleinberg, Mullainathan & Raghavan (2017), "Inherent Trade-Offs in the Fair Determination of Risk Scores," ITCS 2017:** [arXiv:1609.05807](https://arxiv.org/abs/1609.05807)
- **Bellamy et al. (2019), "AI Fairness 360: An Extensible Toolkit for Detecting, Understanding, and Mitigating Unwanted Algorithmic Bias" (AIF360), IBM Journal of Research and Development, 63(4/5):** [arXiv:1810.01943](https://arxiv.org/abs/1810.01943)

### Explainability and Attacks on Explanations (WS8)

- **Ribeiro, Singh & Guestrin (2016), "Why Should I Trust You? Explaining the Predictions of Any Classifier" (LIME), KDD 2016:** [arXiv:1602.04938](https://arxiv.org/abs/1602.04938)
- **Lundberg & Lee (2017), "A Unified Approach to Interpreting Model Predictions" (SHAP), NeurIPS 2017:** [arXiv:1705.07874](https://arxiv.org/abs/1705.07874)
- **Sundararajan, Taly & Yan (2017), "Axiomatic Attribution for Deep Networks" (Integrated Gradients), ICML 2017:** [arXiv:1703.01365](https://arxiv.org/abs/1703.01365)
- **Zhou, Khosla, Lapedriza, Oliva & Torralba (2016), "Learning Deep Features for Discriminative Localization" (CAM), CVPR 2016:** [arXiv:1512.04150](https://arxiv.org/abs/1512.04150)
- **Ghorbani, Abid & Zou (2019), "Interpretation of Neural Networks is Fragile," AAAI 2019:** [arXiv:1710.10547](https://arxiv.org/abs/1710.10547)
- **Slack, Hilgard, Jia, Singh & Lakkaraju (2020), "Fooling LIME and SHAP: Adversarial Attacks on Post hoc Explanation Methods," AIES 2020:** [arXiv:1911.02508](https://arxiv.org/abs/1911.02508)

---

## Governance and Standards

Referenced in the governance and deployment workshops (WS9-11). Cited by title where an official
URL may change over time.

- **NIST AI Risk Management Framework (AI RMF 1.0):** the reference framework for identifying and
  managing AI risks. [airc.nist.gov](https://airc.nist.gov/)
- **NIST AI 100-2 E2025, "Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and
  Mitigations":** the standard taxonomy for adversarial-ML threats and defenses.
  [csrc.nist.gov](https://csrc.nist.gov/pubs/ai/100/2/e2025/final)
- **EU AI Act (Regulation (EU) 2024/1689):** the European Union's risk-tiered regulation of AI
  systems, in force since August 2024. [eur-lex.europa.eu](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng)
- **Blueprint for an AI Bill of Rights** (US OSTP, 2022): principles for the design and deployment
  of automated systems. [bidenwhitehouse.archives.gov](https://bidenwhitehouse.archives.gov/ostp/ai-bill-of-rights/)

---

## Cross-Reference: Workshops

Each workshop page carries its own focused resource list. Jump directly to a session:

- [Workshop 1: Introduction and Fundamentals in AI](Workshop01/Introduction_and_Fundamentals_in_AI.md)
- [Workshop 2: AI and Threat Models](Workshop02/AI_and_Threat_Models.md)
- [Workshop 3: Adversarial Attacks - White-Box Attacks](Workshop03/Adversarial_Attacks_-_White-Box_Attacks.md)
- [Workshop 4: Adversarial Attacks - Black-Box Attacks](Workshop04/Adversarial_Attacks_-_Black-Box_Attacks.md)
- [Workshop 5: Robustness and Resilience](Workshop05/Robustness_and_Resilience.md)
- [Workshop 6: AI and Privacy - Differential Privacy and Federated Learning](Workshop06/AI_and_Privacy_Differential_Privacy_and_Federated_Learning.md)
- [Workshop 7: Ethics in AI - Bias and Fairness](Workshop07/Ethics_in_AI_-_Bias_and_Fairness.md)
- [Workshop 8: Trust in AI - Transparency, Explainability and Interpretability](Workshop08/Trust_in_AI_Transparency_Explainability_and_Interpretability.md)
- [Workshop 9: AI Development and Security](Workshop09/AI_Development_and_Security.md)
- [Workshop 10: AI and Data Governance - Regulations and Standards](Workshop10/AI_and_Data_Govern_Regulations_and_Standards.md)
- [Workshop 11: Secure Deployment and Operation of AI Systems](Workshop11/Secure_Deployment_and_Operation_of_AI_Systems.md)
- [Workshop 12: Case Studies and Real-World Applications - AIShield](Workshop12/Case_Studies_RealWorld_Applications_AIShield.md)

See also the [Program Overview](overview.md) for the full learning path.

---

## Suggested Learning Paths

The workshops are designed to be followed in order, since later sessions build on earlier ones.
If you are focused on a particular area, these paths highlight the most relevant sessions.

**Adversarial ML (attacks and defenses):** Workshop 2 (threat models) -> Workshop 3 (white-box) ->
Workshop 4 (black-box) -> Workshop 5 (robustness). Core tool: ART.

**Privacy and federated learning:** Workshop 6 (differential privacy and FedAvg) -> Workshop 12
(DP-FedAvg case study). Core tools: Opacus, TensorFlow Federated, `dp_accounting`.

**Trustworthy and responsible AI:** Workshop 7 (bias and fairness) -> Workshop 8 (explainability) ->
Workshop 10 (governance). Core tools: AIF360, LIME, SHAP, Integrated Gradients, CAM.

**Secure development and deployment:** Workshop 9 (development and security) -> Workshop 11 (secure
deployment) -> Workshop 12 (case studies).

---

## Glossary

**Adversarial example** - an input with a small, deliberately chosen perturbation that causes a
model to misclassify it.

**White-box / black-box attack** - an attack with full access to the model's parameters and
gradients (white-box) versus one limited to querying its outputs (black-box).

**Robustness** - a model's ability to maintain correct behavior under adversarial or shifted
inputs; *certified* robustness gives a provable guarantee within a bounded region.

**Differential privacy (DP)** - a mathematical guarantee, parameterized by $(\epsilon, \delta)$,
that a model's output reveals little about any single training record.

**DP-SGD** - differentially private stochastic gradient descent: clip per-example gradients, add
Gaussian noise, and track the privacy spend with an accountant.

**Federated learning (FL)** - training a shared model across decentralized clients that keep their
data local; **FedAvg** is the canonical aggregation algorithm.

**Gradient leakage** - reconstruction of private training data from shared gradients (e.g., the
Deep Leakage from Gradients attack).

**Byzantine / Krum** - a Byzantine participant sends malicious updates in distributed training;
Krum is a robust aggregation rule that resists them.

**Fairness metric** - a precise definition of equitable treatment (e.g., statistical parity,
equal opportunity, calibration); several are mutually incompatible in general.

**Explainability / interpretability** - methods that make a model's predictions understandable,
either post hoc (LIME, SHAP) or through attribution (Integrated Gradients, CAM).

**Threat model** - an explicit statement of an adversary's goals, knowledge, and capabilities,
used to scope what a defense must protect against.

---

*Resource Library | SecureAI Self-Study Program | 12-Workshop Format*