AI Security Simulator | mysimulator.uk

Threat model

Attack strength 0.30

Privacy budget ε_DP 3.0

Model accuracy

–

Attack success

–

Re-identification risk

–

Drag to orbit · scroll to zoom.

How it works

A trained classifier separates two classes of data with a decision boundary. Attacks try to fool it, steal it, or leak its training data; defenses trade some accuracy or convenience for robustness and privacy.

FGSM:  x_adv = x + ε · sign(∇ₓ J(θ, x, y))
Adversarial training:  min_θ E[ max_{|δ|≤ε} J(θ, x+δ, y) ]
Differential privacy:  Pr[M(D)∈S] ≤ e^ε · Pr[M(D′)∈S] + δ

Attack type — Adversarial nudges one sample by an imperceptible vector until it crosses the boundary; Poisoning corrupts training data to drag the boundary itself off course; Extraction repeatedly queries the model to clone a copy of it (shown as a ghost network).
Attack strength (ε) — how large the adversarial perturbation or poisoning push is.
Adversarial training — retrains the model to stay correct even for perturbed inputs, widening the safety margin around the boundary.
Privacy budget ε_DP — a smaller ε adds more noise (differential privacy), making individual training records harder to re-identify but lowering measured accuracy.

Real-world relevance: production ML systems face exactly these three attack families — evasion, poisoning and extraction — which is why robust deployments combine adversarial training, input sanitisation, rate-limited APIs and differential-privacy training pipelines rather than relying on raw accuracy alone.

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.