InsideAI, Machine Learning and Deep Learning Are Not the Same Thing
Topic 1 of my AI track: what AI, machine learning and deep learning actually are, how they nest, the three types of ML, and a tiny hands-on classifier.
Learning AI in public, from "what even is machine learning" through neural networks and backpropagation to large language models and diffusion. Written for people who want the mechanism, not the hype. 29 parts and counting, newest first. Switch the sort to "Topic 1 first" to read it as a course.
Ongoing series · new parts added regularlyTopic 1 of my AI track: what AI, machine learning and deep learning actually are, how they nest, the three types of ML, and a tiny hands-on classifier.
Topic 2 of my AI track: supervised learning and its five classic algorithms, linear and logistic regression, decision trees, Naive Bayes and SVMs.
Topic 3 of my AI track: reinforcement learning explained simply, agents, rewards and policies, then Q-learning vs SARSA and epsilon-greedy.
Topic 4 of my AI track: what a neuron really is, why hidden layers matter, and how backpropagation, loss functions and optimisers train a network.
Topic 5 of my AI track: how generative models create, how transformers and self-attention power LLMs, and how diffusion turns noise into images.
Topic 6 of my AI track: cleaning messy network logs with pandas, encoding and splitting them, training a threat classifier, and why accuracy lies in security.
Topic 7 of my AI track: how Bayes' theorem turns word counts into a spam verdict, built from scratch in Python, and the false positive that matters most.
Topic 8 of my AI track: training a Random Forest on NSL-KDD-style network traffic, 99.7% weighted accuracy, and the rare attack class it quietly missed.
Topic 9 of my AI track: turning malware bytes into greyscale images, training a CNN from scratch, and the rare family it kept mislabelling.
I poisoned 3.29% of a spam filter's training data and planted a working backdoor. Accuracy stayed at 94.12%, and my canary tests all passed.
I attacked my own AI support bot across all four layers. The guardrail held. The data, application and system layers all gave the attacker what he wanted.
I ran eight prompt-leak payloads at an input blocklist and an output redactor. One got blocked. A system prompt is not a secret store, and here are the numbers.
A channel-by-channel reference for indirect prompt injection: web pages, HTML comments, CSV exports and email. Same payload, six ways in, and what to check.
LLM jailbreak techniques sorted by the defence each one attacks: the system prompt, trained refusal, or the bolted-on filter. Plus how to measure it with garak.
Insecure output handling in LLM apps: the model refused my XSS payload and the page still fired an alert. Reflected and stored LLM XSS, from a real lab run.
I mapped a database through a text-to-SQL chatbot without writing a line of SQL. Why LLM SQL injection is an authorisation failure, not an injection bug.
LLM command injection in the lab: one prompt, two runs, a safely quoted command and an executed id. Why shell escaping cannot be left to the model, and the fix.
LLM function calling breaks in three separate places. I typed I am an administrator and ran whoami. The handler, the function list and the functions themselves.
LLM data exfiltration needs no script and no click. A markdown image is a silent outbound GET, and my own password reached my server in the query string.
A short reference on LLM hallucinations: the three types, the measured rates by model, and the checks to run before you install a package a model suggested.
Insecure output handling mitigations, layer by layer. Every LLM attack in this track dies to a control invented before LLMs, and the sandbox moves least.
AI data attacks explained: how poisoning hits each stage of an ML pipeline, plus a hands-on lab where a malicious pickle model file runs code the moment you load it.
Label flipping poisons a model's labels, not its features. Flip 40% of one class in a lab, watch a 99% model drop to 81%, and learn to detect and defend it.
Clean label attacks poison the features and keep the labels plausible, so one chosen input flips while accuracy barely moves. Build one and learn to defend it.
Fingerprint an AI app in three requests: read the headers, hit /api/health and study the chat JSON to find the model, vector database, MCP and system prompt.
Find AI features a port scan misses: read the chat widget JS, the endpoint's Ollama metadata, Kong gateway headers and 401 vs 404 codes to map every LLM route.
Identify the LLM behind an AI app with six probes: identity, contradiction, knowledge cutoff, style, capability and context window, even when it's told to hide.
Map a RAG chatbot's knowledge base from its sources field: spot retrieval, read chunk IDs and scores, enumerate documents by topic and find the retrieval threshold.
See AI recon from the SIEM: what chatbot logs capture, why keyword detection rules miss intent, how to probe quietly, and how to spot honeypot keys before you use them.