Models can be stolen, poisoned, fooled.
AI models are massive new intellectual assets — and new attack surfaces. Weight extraction, prompt injection, adversarial attacks, data poisoning: AI security is not yet a market standard. The AI Act requires that it become one.
A NEW ATTACK SURFACE THAT FEW KNOW HOW TO AUDIT
OUR SERVICES
QREDTEAM
ADVERSARY SIMULATION
- LLM-agent Red Team — prompt injection, jailbreak, manipulation of autonomous decisions
- Model-extraction simulation via API probing on production models
- Adversarial-robustness testing — input manipulation to force errors
- Pentest of the ML infrastructure — inference servers, APIs, data pipelines
- ML supply-chain Red Team — dataset contamination, backdoors in dependencies.
QLAB
DEEP SECURITY RESEARCH
- Vulnerability research in ML frameworks (PyTorch, TensorFlow, ONNX, Triton)
- Audit of training-data pipelines — detection of data poisoning and backdoors
- Robustness analysis of embedded models (edge ML, firmware with local inference)
- Audit of inference APIs — weight exposure, extraction of architectural information
- Reverse engineering of compiled models (ONNX, TensorRT, CoreML) for AI Act compliance.
QSHIELD
SOFTWARE PROTECTION
- Protection of ML model weights against extraction and competitive cloning
- Anti-reverse engineering of embedded models on edge devices and firmware
- Obfuscation of model architectures to protect IP from adversaries
- Protection of inference pipelines in mobile or IoT applications
- Anti-cloning for model vendors deployed in unmanaged environments.
QUARKSLAB DIFFERENTIATOR
Traditional providers test the network perimeter around the ML infrastructure — not the model itself. Quarkslab audits what runs inside the model: the weights, the architectures, the embedded inference pipelines. We publish research on ML-framework vulnerabilities and offer QShield to protect model weights — a first in Europe.
WHAT WOULD WE SAY TO EACH OTHER, FACE TO FACE
What is your AI model worth — and how long would it take a competitor to extract its parameters via your API?
A model trained on your proprietary data represents millions of dollars in compute and years of expertise. It can be extracted via your API using well-documented model-stealing techniques — with no access whatsoever to your infrastructure.