Jason Edwards, DM, CISSP, is an accomplished cybersecurity leader with extensive experience in the technology, finance, insurance, and energy sectors. Holding a Doctorate in Management, Information Systems, and Technology, Jason specializes in guiding large public and private companies through complex cybersecurity challenges. His career includes leadership roles across the military, insurance, finance, energy, and technology industries. He is a husband, father, former military cyber officer, adjunct professor, avid reader, dog dad, and popular on LinkedIn.

• Preface xiAcknowledgments xiiiFrom the Author xvIntroduction xviiAbout the Companion Website xxi1 The Age of Intelligent Threats 1The Rise of AI as a Security Target 1Fragility in Intelligent Systems 3Categories of AI: Predictive, Generative, and Agentic 5Milestones in Adversarial Vulnerability 8Intelligence as an Attack Multiplier 10Why This Book and Who It’s For 12Recommendations 14Conclusion 16Key Concepts 162 Anatomy of AI Systems and Their Attack Surfaces 21The Architecture of Predictive, Generative, and Agentic AI 21The AI Development Lifecycle: From Data to Deployment 24Classical Machine Learning vs. Modern AI Pipelines 26Identifying Entry Points: Training, Inference, and Supply Chain 28Security Debt in the Model Development Lifecycle 31Recommendations 33Conclusion 35Key Concepts 353 The Adversary’s Playbook 39Threat Actors: Profiles, Motivations, and Objectives 39White-Box Attack Techniques and Methodologies 41Black-Box Attack Techniques and Methodologies 44Gray-Box Attack Techniques and Methodologies 47Operationalizing AI Attacks: Tactical Methodologies and Execution 49Advanced Multi-Stage and Coordinated AI Attacks 52Recommendations 54Conclusion 55Key Concepts 564 Evasion Attacks—Tricking AI Models at Inference 61Core Principles and Mechanisms of Evasion Attacks 61Gradient-Based Evasion Techniques 64Linguistic and Textual Evasion Methods 67Image- and Vision-Based Evasion Techniques 69Evasion Attacks on Time-Series and Sequential Models 72Recommendations 74Conclusion 76Key Concepts 765 Poisoning Attacks—Compromising AI Systems During Training 81Fundamentals and Mechanisms of Training-Time Poisoning 81Label Manipulation and Clean-Label Poisoning Techniques 84Backdoor and Trojan Insertion in Training Data 86Poisoning Attacks on Federated and Distributed Learning Systems 89Poisoning Attacks Against Reinforcement Learning (RL) Systems 91Poisoning Attacks on Transfer Learning and Fine-Tuning Processes 94Recommendations 96Conclusion 98Key Concepts 986 Privacy Attacks—Extracting Secrets from AI Models 103Core Mechanisms and Objectives of AI Privacy Attacks 103Membership Inference Techniques 106Model Inversion Attacks and Data Reconstruction 109Attribute and Property Inference Attacks 111Model Extraction and Functionality Reconstruction 114Exploiting Privacy Leakage Through Prompting Generative AI 117Recommendations 119Conclusion 120Key Concepts 1217 Backdoor and Trojan Attacks—Embedding Hidden Behaviors in AI Models 125Fundamental Concepts of AI Backdoors and Trojans 125Backdoor Trigger Design and Optimization 128Data Poisoning Methods for Backdoor Embedding 130Trojan Attacks in Transfer and Fine-Tuning Scenarios 132Embedding Backdoors in Federated and Decentralized Training 135Advanced Trigger Embedding in Generative and Agentic AI Models 137Recommendations 140Conclusion 141Key Concepts 1428 The Generative AI Attack Surface 147Architectural Foundations of Large Language Models 147How Generative Architectures Expand Attack Opportunities 150Exploiting Fine-Tuning as an Adversarial Vector 152Prompt Engineering as an Adversarial Exploitation Pathway 155Technical Risks in Retrieval-Augmented Generation Systems 157Leveraging Model Internals for Generative AI Exploitation 160Recommendations 163Conclusion 164Key Concepts 1659 Prompt Injection and Jailbreak Techniques 169Technical Foundations of Prompt Injection Attacks 169Direct Prompt Injection Methods and Input Crafting 173Indirect Prompt Injection via External or Retrieved Content 175Jailbreak Techniques and Semantic Boundary Exploitation 177Token-Level and Embedding Space Manipulations 180Contextual and Conversational Injection Strategies 182Recommendations 185Conclusion 186Key Concepts 18710 Data Leakage and Model Hallucination 191Technical Mechanisms of Data Leakage in Generative Models 191Membership and Attribute Inference via Generative Outputs 195Model Inversion and Training Data Reconstruction 197Hallucination Exploitation in Generative Outputs 199Prompt-Based Extraction of Memorized Data 202Exploiting Multi-Modal and Cross-Modal Leakage in Generative Models 204Recommendations 207Conclusion 208Key Concepts 20911 Adversarial Fine-Tuning and Model Reprogramming 213Technical Foundations of Adversarial Fine-Tuning 213Semantic Perturbation Methods for Adversarial Fine-Tuning 216Embedding Covert Behaviors via Adversarial Prompt Conditioning 219Advanced Trojan Embedding via Fine-Tuning Gradients 221Cross-Model and Transferable Adversarial Fine-Tuning Attacks 223Model Reprogramming via Adversarial Fine-Tuning Techniques 226Recommendations 228Conclusion 229Key Concepts 23012 Agentic AI and Autonomous Threat Loops 235Technical Foundations of Agentic AI Systems 235Technical Manipulation of Autonomous Decision Loops 238Exploitation of Agentic Memory and Context Management 241Agentic Tool Integration and External API Exploitation 244Technical Embedding of Autonomous Chain Injection 246Exploitation of Environmental Interactions and Stateful Vulnerabilities 248Recommendations 251Conclusion 252Key Concepts 25313 Securing the AI Supply Chain 257Technical Mechanisms of Supply Chain Poisoning in AI Models 257Artifact and Model Checkpoint Contamination Techniques 260Technical Exploitation of Third-Party AI Libraries and Frameworks 263Dataset Provenance and Annotation Manipulation Techniques 265Technical Exploitation of Hosted and Cloud-based Model Infrastructure 268Artifact Repositories and Model Zoo Contamination Methods 270Recommendations 272Conclusion 273Key Concepts 27414 Evaluating AI Robustness and Response Strategies 277Technical Foundations of AI Robustness Evaluation 277Metrics for Evaluating AI Security and Robustness 279Robust Optimization Methods and Adversarial Training 282Certified Robustness and Formal Verification Techniques 285Technical Benchmarking Tools and Evaluation Frameworks 287Technical Analysis of Robustness Across Model Architectures and Modalities 289Recommendations 292Conclusion 293Key Concepts 29415 Building Trustworthy AI by Design 299Technical Foundations of Security-by-Design in AI Systems 299Robust Embedding and Representation Learning Methods 302Technical Approaches to Adversarially Robust Architectures 304Technical Integration of Formal Verification in Model Design 306Technical Frameworks for Runtime Anomaly Detection and Filtering 308Technical Embedding of Model Interpretability and Transparency 310Recommendations 313Conclusion 315Key Concepts 31516 Looking Ahead—Security in the Era of Intelligent Agents 319Technical Foundations of Future Agentic AI Systems 319Emerging Technical Attack Vectors in Agentic Systems 322Technical Exploitation of Multi-Modal and Cross-Domain Agentic Capabilities 325Future Technical Capabilities in Automated Adversarial Generation 327Technical Mechanisms for Evaluating Advanced Agentic Robustness 330Technical Embedding of Ethical Constraints and Safety Mechanisms 332Recommendations 335Conclusion 337Key Concepts 337Glossary 341Index 367

Jason Edwards, DM, CISSP, is an accomplished cybersecurity leader with extensive experience in the technology, finance, insurance, and energy sectors. Holding a Doctorate in Management, Information Systems, and Technology, Jason specializes in guiding large public and private companies through complex cybersecurity challenges. His career includes leadership roles across the military, insurance, finance, energy, and technology industries. He is a husband, father, former military cyber officer, adjunct professor, avid reader, dog dad, and popular on LinkedIn.

• Preface xiAcknowledgments xiiiFrom the Author xvIntroduction xviiAbout the Companion Website xxi1 The Age of Intelligent Threats 1The Rise of AI as a Security Target 1Fragility in Intelligent Systems 3Categories of AI: Predictive, Generative, and Agentic 5Milestones in Adversarial Vulnerability 8Intelligence as an Attack Multiplier 10Why This Book and Who It’s For 12Recommendations 14Conclusion 16Key Concepts 162 Anatomy of AI Systems and Their Attack Surfaces 21The Architecture of Predictive, Generative, and Agentic AI 21The AI Development Lifecycle: From Data to Deployment 24Classical Machine Learning vs. Modern AI Pipelines 26Identifying Entry Points: Training, Inference, and Supply Chain 28Security Debt in the Model Development Lifecycle 31Recommendations 33Conclusion 35Key Concepts 353 The Adversary’s Playbook 39Threat Actors: Profiles, Motivations, and Objectives 39White-Box Attack Techniques and Methodologies 41Black-Box Attack Techniques and Methodologies 44Gray-Box Attack Techniques and Methodologies 47Operationalizing AI Attacks: Tactical Methodologies and Execution 49Advanced Multi-Stage and Coordinated AI Attacks 52Recommendations 54Conclusion 55Key Concepts 564 Evasion Attacks—Tricking AI Models at Inference 61Core Principles and Mechanisms of Evasion Attacks 61Gradient-Based Evasion Techniques 64Linguistic and Textual Evasion Methods 67Image- and Vision-Based Evasion Techniques 69Evasion Attacks on Time-Series and Sequential Models 72Recommendations 74Conclusion 76Key Concepts 765 Poisoning Attacks—Compromising AI Systems During Training 81Fundamentals and Mechanisms of Training-Time Poisoning 81Label Manipulation and Clean-Label Poisoning Techniques 84Backdoor and Trojan Insertion in Training Data 86Poisoning Attacks on Federated and Distributed Learning Systems 89Poisoning Attacks Against Reinforcement Learning (RL) Systems 91Poisoning Attacks on Transfer Learning and Fine-Tuning Processes 94Recommendations 96Conclusion 98Key Concepts 986 Privacy Attacks—Extracting Secrets from AI Models 103Core Mechanisms and Objectives of AI Privacy Attacks 103Membership Inference Techniques 106Model Inversion Attacks and Data Reconstruction 109Attribute and Property Inference Attacks 111Model Extraction and Functionality Reconstruction 114Exploiting Privacy Leakage Through Prompting Generative AI 117Recommendations 119Conclusion 120Key Concepts 1217 Backdoor and Trojan Attacks—Embedding Hidden Behaviors in AI Models 125Fundamental Concepts of AI Backdoors and Trojans 125Backdoor Trigger Design and Optimization 128Data Poisoning Methods for Backdoor Embedding 130Trojan Attacks in Transfer and Fine-Tuning Scenarios 132Embedding Backdoors in Federated and Decentralized Training 135Advanced Trigger Embedding in Generative and Agentic AI Models 137Recommendations 140Conclusion 141Key Concepts 1428 The Generative AI Attack Surface 147Architectural Foundations of Large Language Models 147How Generative Architectures Expand Attack Opportunities 150Exploiting Fine-Tuning as an Adversarial Vector 152Prompt Engineering as an Adversarial Exploitation Pathway 155Technical Risks in Retrieval-Augmented Generation Systems 157Leveraging Model Internals for Generative AI Exploitation 160Recommendations 163Conclusion 164Key Concepts 1659 Prompt Injection and Jailbreak Techniques 169Technical Foundations of Prompt Injection Attacks 169Direct Prompt Injection Methods and Input Crafting 173Indirect Prompt Injection via External or Retrieved Content 175Jailbreak Techniques and Semantic Boundary Exploitation 177Token-Level and Embedding Space Manipulations 180Contextual and Conversational Injection Strategies 182Recommendations 185Conclusion 186Key Concepts 18710 Data Leakage and Model Hallucination 191Technical Mechanisms of Data Leakage in Generative Models 191Membership and Attribute Inference via Generative Outputs 195Model Inversion and Training Data Reconstruction 197Hallucination Exploitation in Generative Outputs 199Prompt-Based Extraction of Memorized Data 202Exploiting Multi-Modal and Cross-Modal Leakage in Generative Models 204Recommendations 207Conclusion 208Key Concepts 20911 Adversarial Fine-Tuning and Model Reprogramming 213Technical Foundations of Adversarial Fine-Tuning 213Semantic Perturbation Methods for Adversarial Fine-Tuning 216Embedding Covert Behaviors via Adversarial Prompt Conditioning 219Advanced Trojan Embedding via Fine-Tuning Gradients 221Cross-Model and Transferable Adversarial Fine-Tuning Attacks 223Model Reprogramming via Adversarial Fine-Tuning Techniques 226Recommendations 228Conclusion 229Key Concepts 23012 Agentic AI and Autonomous Threat Loops 235Technical Foundations of Agentic AI Systems 235Technical Manipulation of Autonomous Decision Loops 238Exploitation of Agentic Memory and Context Management 241Agentic Tool Integration and External API Exploitation 244Technical Embedding of Autonomous Chain Injection 246Exploitation of Environmental Interactions and Stateful Vulnerabilities 248Recommendations 251Conclusion 252Key Concepts 25313 Securing the AI Supply Chain 257Technical Mechanisms of Supply Chain Poisoning in AI Models 257Artifact and Model Checkpoint Contamination Techniques 260Technical Exploitation of Third-Party AI Libraries and Frameworks 263Dataset Provenance and Annotation Manipulation Techniques 265Technical Exploitation of Hosted and Cloud-based Model Infrastructure 268Artifact Repositories and Model Zoo Contamination Methods 270Recommendations 272Conclusion 273Key Concepts 27414 Evaluating AI Robustness and Response Strategies 277Technical Foundations of AI Robustness Evaluation 277Metrics for Evaluating AI Security and Robustness 279Robust Optimization Methods and Adversarial Training 282Certified Robustness and Formal Verification Techniques 285Technical Benchmarking Tools and Evaluation Frameworks 287Technical Analysis of Robustness Across Model Architectures and Modalities 289Recommendations 292Conclusion 293Key Concepts 29415 Building Trustworthy AI by Design 299Technical Foundations of Security-by-Design in AI Systems 299Robust Embedding and Representation Learning Methods 302Technical Approaches to Adversarially Robust Architectures 304Technical Integration of Formal Verification in Model Design 306Technical Frameworks for Runtime Anomaly Detection and Filtering 308Technical Embedding of Model Interpretability and Transparency 310Recommendations 313Conclusion 315Key Concepts 31516 Looking Ahead—Security in the Era of Intelligent Agents 319Technical Foundations of Future Agentic AI Systems 319Emerging Technical Attack Vectors in Agentic Systems 322Technical Exploitation of Multi-Modal and Cross-Domain Agentic Capabilities 325Future Technical Capabilities in Automated Adversarial Generation 327Technical Mechanisms for Evaluating Advanced Agentic Robustness 330Technical Embedding of Ethical Constraints and Safety Mechanisms 332Recommendations 335Conclusion 337Key Concepts 337Glossary 341Index 367

Jason Edwards, DM, CISSP, is an accomplished cybersecurity leader with extensive experience in the technology, finance, insurance, and energy sectors. Holding a Doctorate in Management, Information Systems, and Technology, Jason specializes in guiding large public and private companies through complex cybersecurity challenges. His career includes leadership roles across the military, insurance, finance, energy, and technology industries. He is a husband, father, former military cyber officer, adjunct professor, avid reader, dog dad, and popular on LinkedIn.

• Preface xiAcknowledgments xiiiFrom the Author xvIntroduction xviiAbout the Companion Website xxi1 The Age of Intelligent Threats 1The Rise of AI as a Security Target 1Fragility in Intelligent Systems 3Categories of AI: Predictive, Generative, and Agentic 5Milestones in Adversarial Vulnerability 8Intelligence as an Attack Multiplier 10Why This Book and Who It’s For 12Recommendations 14Conclusion 16Key Concepts 162 Anatomy of AI Systems and Their Attack Surfaces 21The Architecture of Predictive, Generative, and Agentic AI 21The AI Development Lifecycle: From Data to Deployment 24Classical Machine Learning vs. Modern AI Pipelines 26Identifying Entry Points: Training, Inference, and Supply Chain 28Security Debt in the Model Development Lifecycle 31Recommendations 33Conclusion 35Key Concepts 353 The Adversary’s Playbook 39Threat Actors: Profiles, Motivations, and Objectives 39White-Box Attack Techniques and Methodologies 41Black-Box Attack Techniques and Methodologies 44Gray-Box Attack Techniques and Methodologies 47Operationalizing AI Attacks: Tactical Methodologies and Execution 49Advanced Multi-Stage and Coordinated AI Attacks 52Recommendations 54Conclusion 55Key Concepts 564 Evasion Attacks—Tricking AI Models at Inference 61Core Principles and Mechanisms of Evasion Attacks 61Gradient-Based Evasion Techniques 64Linguistic and Textual Evasion Methods 67Image- and Vision-Based Evasion Techniques 69Evasion Attacks on Time-Series and Sequential Models 72Recommendations 74Conclusion 76Key Concepts 765 Poisoning Attacks—Compromising AI Systems During Training 81Fundamentals and Mechanisms of Training-Time Poisoning 81Label Manipulation and Clean-Label Poisoning Techniques 84Backdoor and Trojan Insertion in Training Data 86Poisoning Attacks on Federated and Distributed Learning Systems 89Poisoning Attacks Against Reinforcement Learning (RL) Systems 91Poisoning Attacks on Transfer Learning and Fine-Tuning Processes 94Recommendations 96Conclusion 98Key Concepts 986 Privacy Attacks—Extracting Secrets from AI Models 103Core Mechanisms and Objectives of AI Privacy Attacks 103Membership Inference Techniques 106Model Inversion Attacks and Data Reconstruction 109Attribute and Property Inference Attacks 111Model Extraction and Functionality Reconstruction 114Exploiting Privacy Leakage Through Prompting Generative AI 117Recommendations 119Conclusion 120Key Concepts 1217 Backdoor and Trojan Attacks—Embedding Hidden Behaviors in AI Models 125Fundamental Concepts of AI Backdoors and Trojans 125Backdoor Trigger Design and Optimization 128Data Poisoning Methods for Backdoor Embedding 130Trojan Attacks in Transfer and Fine-Tuning Scenarios 132Embedding Backdoors in Federated and Decentralized Training 135Advanced Trigger Embedding in Generative and Agentic AI Models 137Recommendations 140Conclusion 141Key Concepts 1428 The Generative AI Attack Surface 147Architectural Foundations of Large Language Models 147How Generative Architectures Expand Attack Opportunities 150Exploiting Fine-Tuning as an Adversarial Vector 152Prompt Engineering as an Adversarial Exploitation Pathway 155Technical Risks in Retrieval-Augmented Generation Systems 157Leveraging Model Internals for Generative AI Exploitation 160Recommendations 163Conclusion 164Key Concepts 1659 Prompt Injection and Jailbreak Techniques 169Technical Foundations of Prompt Injection Attacks 169Direct Prompt Injection Methods and Input Crafting 173Indirect Prompt Injection via External or Retrieved Content 175Jailbreak Techniques and Semantic Boundary Exploitation 177Token-Level and Embedding Space Manipulations 180Contextual and Conversational Injection Strategies 182Recommendations 185Conclusion 186Key Concepts 18710 Data Leakage and Model Hallucination 191Technical Mechanisms of Data Leakage in Generative Models 191Membership and Attribute Inference via Generative Outputs 195Model Inversion and Training Data Reconstruction 197Hallucination Exploitation in Generative Outputs 199Prompt-Based Extraction of Memorized Data 202Exploiting Multi-Modal and Cross-Modal Leakage in Generative Models 204Recommendations 207Conclusion 208Key Concepts 20911 Adversarial Fine-Tuning and Model Reprogramming 213Technical Foundations of Adversarial Fine-Tuning 213Semantic Perturbation Methods for Adversarial Fine-Tuning 216Embedding Covert Behaviors via Adversarial Prompt Conditioning 219Advanced Trojan Embedding via Fine-Tuning Gradients 221Cross-Model and Transferable Adversarial Fine-Tuning Attacks 223Model Reprogramming via Adversarial Fine-Tuning Techniques 226Recommendations 228Conclusion 229Key Concepts 23012 Agentic AI and Autonomous Threat Loops 235Technical Foundations of Agentic AI Systems 235Technical Manipulation of Autonomous Decision Loops 238Exploitation of Agentic Memory and Context Management 241Agentic Tool Integration and External API Exploitation 244Technical Embedding of Autonomous Chain Injection 246Exploitation of Environmental Interactions and Stateful Vulnerabilities 248Recommendations 251Conclusion 252Key Concepts 25313 Securing the AI Supply Chain 257Technical Mechanisms of Supply Chain Poisoning in AI Models 257Artifact and Model Checkpoint Contamination Techniques 260Technical Exploitation of Third-Party AI Libraries and Frameworks 263Dataset Provenance and Annotation Manipulation Techniques 265Technical Exploitation of Hosted and Cloud-based Model Infrastructure 268Artifact Repositories and Model Zoo Contamination Methods 270Recommendations 272Conclusion 273Key Concepts 27414 Evaluating AI Robustness and Response Strategies 277Technical Foundations of AI Robustness Evaluation 277Metrics for Evaluating AI Security and Robustness 279Robust Optimization Methods and Adversarial Training 282Certified Robustness and Formal Verification Techniques 285Technical Benchmarking Tools and Evaluation Frameworks 287Technical Analysis of Robustness Across Model Architectures and Modalities 289Recommendations 292Conclusion 293Key Concepts 29415 Building Trustworthy AI by Design 299Technical Foundations of Security-by-Design in AI Systems 299Robust Embedding and Representation Learning Methods 302Technical Approaches to Adversarially Robust Architectures 304Technical Integration of Formal Verification in Model Design 306Technical Frameworks for Runtime Anomaly Detection and Filtering 308Technical Embedding of Model Interpretability and Transparency 310Recommendations 313Conclusion 315Key Concepts 31516 Looking Ahead—Security in the Era of Intelligent Agents 319Technical Foundations of Future Agentic AI Systems 319Emerging Technical Attack Vectors in Agentic Systems 322Technical Exploitation of Multi-Modal and Cross-Domain Agentic Capabilities 325Future Technical Capabilities in Automated Adversarial Generation 327Technical Mechanisms for Evaluating Advanced Agentic Robustness 330Technical Embedding of Ethical Constraints and Safety Mechanisms 332Recommendations 335Conclusion 337Key Concepts 337Glossary 341Index 367