Investigate how AI can be manipulated.
Inputs, training data, updates and supply paths built to change what a model does. A research area, not a product.
Separate the attack from the conditions.
Which path does the attack use?
Sensor input, training data and model file each need their own threat model.
Where does a release check stop?
It shows a release changed, not model provenance: where the approved bytes came from.
What belongs in the baseline?
Lighting, viewpoint, normal variation and sensor faults, so ordinary conditions are not read as attacks.
Is it drift or an attack?
An anomaly is a reason to investigate, not proof of an attack.
What does a countermeasure cost?
Latency, memory and compute on the edge, plus misses and false alarms.
Research direction, with no product claim.
Nothing Vraelis has built tests, detects or blocks these attacks. No detector, no measured result.
The one overlap is the supply path: unauthorized changes, a wrong destination or changed components, are specified as scripted fault tests, not run. That does not cover manipulated inputs or poisoned training data.
What is still open.
Which threats matter where
A vehicle and a control room face different attackers.
Adaptive testing
Fixed examples overstate a countermeasure.
Reproducible results
Model version, attacker access, input path and expected outcome.
One record for both
Release and input evidence in one ordered record.
Study these problems with us.
For researchers and academic teams.