Question 1

What is data poisoning?

Accepted Answer

Data poisoning (OWASP ML03 / MITRE ATLAS AML.T0020) is an attack on the training phase of an ML model. An attacker introduces manipulated data points into the training dataset to systematically corrupt the model. The consequences: the model makes deliberately wrong decisions for specific inputs (backdoor attack), generates overall degraded predictions (denial-of-service against model quality), or has been conditioned to always misclassify a specific trigger input. Particularly critical for models that are continuously retrained - e.g., fraud detection systems that process new transaction data daily.

Question 2

What are adversarial examples and how do evasion attacks work?

Accepted Answer

Adversarial examples are inputs that look identical to legitimate inputs to a human but force the model into a wrong classification. In an image classifier, selectively shifting specific pixels by a minimal amount - invisible to the human eye - causes the model to suddenly perceive the object as something else. In tabular data (fraud detection, credit scoring), a few numerical features are minimally adjusted so that a fraudulent transaction passes as legitimate. Evasion attacks can be generated in the white-box setting (attacker knows the model) using gradient descent, or in the black-box setting (API access only) through transfer-based methods and query optimization.

Question 3

What is model inversion and why does GDPR affect me?

Accepted Answer

In a model inversion attack, an attacker reconstructs training data from an ML model - without direct access to the original data. Through systematic queries and analysis of model outputs, feature values of individual training data points can be approximately reconstructed. In healthcare this means: sensitive patient data can be reconstructed from a trained diagnostic model. In finance: conclusions about account data can be drawn from a scoring model. The GDPR relevance is direct: if personal data can be extracted from your model, this constitutes a data protection violation - even if the raw data is securely stored. Our tests verify whether your model is susceptible to inversion and what data could potentially be reconstructed.

Question 4

What is membership inference and why is this a GDPR issue?

Accepted Answer

Membership inference attacks answer the question: "Was person X in the training data of this model?" - with accuracy well above chance level. An attacker observes how a model responds to certain inputs and infers whether that data point was used in training. This is a direct GDPR issue because it reveals the processing of personal data, even if these are never directly accessible. In regulated industries - healthcare, insurance, HR - membership in the training group alone is protected information. A data subject could thus discover whether their data was processed without consent.

Question 5

What is the OWASP Machine Learning Security Top 10?

Accepted Answer

The OWASP Machine Learning Security Top 10 is a community standard for the most critical security risks in classical ML systems - analogous to the OWASP Top 10 for web applications. The ten categories are: ML01 Input Manipulation Attack (Adversarial Examples), ML02 Data Poisoning Attack, ML03 Model Inversion Attack, ML04 Membership Inference Attack, ML05 Model Theft, ML06 AI Supply Chain Attacks, ML07 Transfer Learning Attack, ML08 Model Skewing, ML09 Output Integrity Attack, and ML10 Model Poisoning. We use this standard as a systematic foundation for all ML security assessments and supplement it with the MITRE ATLAS framework for threat modeling.

Question 6

What is model theft and how is my ML model stolen?

Accepted Answer

Model extraction (OWASP ML05) refers to theft of an ML model through systematic API querying. An attacker sends thousands of carefully selected inputs and analyzes the outputs - using this to train a surrogate model that nearly perfectly mimics the original. Attacker motivation: your model is intellectual property with significant competitive value. A stolen fraud detection model also allows attackers to locally generate adversarial examples that are more precise in the white-box setting. Countermeasures include: differential privacy in training, output perturbation, rate limiting, and query pattern monitoring - we test how resilient your API is against extraction.

Question 7

What are transfer learning attacks and backdoors in pre-trained models?

Accepted Answer

Transfer learning is today's standard: organizations use pre-trained base models (ImageNet, BERT, GPT) and fine-tune them on their own data. An attacker can plant a backdoor in the pre-trained phase - hidden logic that is only activated with a specific trigger input. The resulting fine-tuned model behaves correctly for all normal inputs, but for the special trigger input always returns the attacker's desired output. Particularly dangerous: the backdoor typically survives fine-tuning and is not detectable in normal validation routines. We test your pre-trained models from public sources for known and novel backdoor signatures.

Question 8

Which ML systems do you test specifically?

Accepted Answer

We test all common ML system types: classical supervised learning models (random forests, gradient boosting, SVMs, neural networks) for fraud detection, credit scoring, churn prediction, and quality control. Computer vision models (CNN, ViT) for medical imaging, industrial inspection, and OCR. NLP models for sentiment analysis, document classification, and named entity recognition. Anomaly detection and time series models (LSTM, Prophet) for industrial process monitoring. Reinforcement learning systems for pricing and resource optimization. Both cloud-hosted (SageMaker, Vertex AI, Azure ML) and on-premise deployments.

Question 9

What does an ML security assessment cost?

Accepted Answer

An ML security assessment is more specialized than a classic penetration test and requires deep expertise in statistics, ML algorithms, and attack methodology. A focused assessment of a single ML model (e.g., your fraud detection system) starts from EUR 15,000. A comprehensive assessment of multiple models including pipeline testing and GDPR risk evaluation is EUR 25,000-45,000. You receive a binding fixed-price offer within 48 hours (business days). No hourly rates, no additional charges.

Your ML model is making
the wrong decisions.

ML models are systematically fooled

Six Attack Classes Against ML Models

Adversarial Examples & Evasion Attacks

Data Poisoning

Model Inversion

Membership Inference

Model Theft & Extraction

Transfer Learning & Supply Chain Backdoors

Who needs ML model security most urgently?

How an ML Security Assessment Works

Scoping & Threat Modeling

Model Analysis & Reconnaissance

Adversarial Testing

Privacy Attack Analysis

Supply Chain & Poisoning Analysis

Reporting & Remediation

One assessment - all compliance evidence

OWASP ML Top 10

MITRE ATLAS

EU AI Act - Art. 15

GDPR - Art. 5 & 25

ISO/IEC 42001

NIST AI RMF

Was uns von anderen Anbietern unterscheidet

Forschung und Lehre als Fundament

Digitale Souveränität - keine Kompromisse

Festpreis in 24h - planbare Projektzeiträume

Ihr fester Ansprechpartner - jederzeit erreichbar

OWASP Top 10 for Large Language Models

Management von Cyber-Risiken

Frequently Asked Questions about ML Model Security

How resilient is your ML model against targeted attacks?