Building security tooling for the ML lifecycle: model supply chain security, LLM red-teaming, adversarial robustness, and privacy-preserving ML.
| Repo | What It Does | Key Threat | Status | Evidence |
|---|---|---|---|---|
| llm-redteam-framework | FastAPI scan service: prompt injection, PII leakage, RAG poisoning → SARIF output, PR gate | LLM01 Prompt Injection | F1=0.70 OOD / 0.93 curated | results/scan_metrics.json |
| hf-model-provenance-scanner | Scan HuggingFace models for supply chain attacks; Ed25519 model signing | T1683.001 ML Supply Chain | 12/12 internal fixture suite | tests/redteam/ |
| mcp-security-gateway-monitor | MCP tool-call security monitor — layered call inspection and policy decisions | T1684, T1687 | P99 < 5ms per tool call | benchmark/ |
| adversarial-ml-lab | FGSM/PGD/C&W attacks on CIFAR-10 ResNet-18; Madry adversarial training | AML.T0043 Craft Adversarial Data | Literature-consistent results (no weights committed) | results/cifar10_resnet18_benchmark.json |
| model-privacy-attacks | Yeom MIA, Fredrikson inversion, DP-SGD defense (synthetic data) | T1685 ML Privacy | MIA advantage=0.42; ε=0.54 at σ=4.0 | results/mia_advantage_report.json |
| dataset-poisoning-detector | Anomaly screening for training data integrity | T1685, T1688 | Research baseline | README.md |
| PulseNet-RUL-Forecasting | Jointly authored RUL forecasting and anomaly-serving research; STRIDE threat model | 12 STRIDE surfaces | F1=0.54 Isolation Forest, NASA C-MAPSS FD001 | docs/evidence/validation_results.json |
- Threat Modeling: STRIDE across ML pipelines; MITRE ATLAS + ATT&CK v19 mapping
- Privacy: Membership inference (Yeom 2018), model inversion (Fredrikson 2015), DP-SGD
- Supply Chain: Ed25519 model signing, SHA-256 artifact manifests, SARIF CI gates
- LLM Security: OWASP LLM Top 10, RAG poisoning detection, canary token tracking
- Adversarial ML: FGSM, PGD, C&W attacks; Madry AT on CIFAR-10 ResNet-18
All metrics link to committed JSON artifacts in their respective repositories. Synthetic data results are marked as such. Each repo README states what is and is not production-ready. No metric is claimed without a reproducible evidence file.