Attack icons

The 41 attack icons, described

Adversarial exampleadversarial-example

An adversarial example — looks the same to a person but classifies as something else.

Adversarial inputadversarial-input

The wide machine with an arrow that turns into a bolt — input built to make the model fail.

Attack surfaceattack-surface

The wide machine with two arrows landing on a surface — everything an attacker can touch.

Auth bypassauth-bypass

An open lock with an arrow walking through it — the login step skipped altogether.

Broken access controlbroken-access

An open lock with someone inside it — a user reaching what was not theirs to reach.

Clickjackingclickjacking

A panel with a cursor in it — a click landing on something the user could not see.

Credential leakcredential-leak

An open lock with the key still in it — a password or token that got out.

DDoSddos

A DDoS attack — a flood of traffic from many sources meant to overwhelm a service.

Dependency confusiondependency-confusion

The wide machine with two packages and a cross between them — the public one picked over the private one.

Deserialisation flawdeserialisation-flaw

A bolt landing in a tray — data unpacked into an object that does something on arrival.

Evasionevasion

Evasion — an attack that slips straight through the defence without being caught.

Exploitexploit

An exploit — the particular attack payload that uses a vulnerability to get in.

Exploit PoCexploit-poc

A panel with a prompt and a bolt — the proof that a flaw can actually be used.

Hardcoded secrethardcoded-secret

A page with a key on it — a credential written straight into the source.

Header injectionheader-injection

A panel with a header line and a bolt under it — a line break smuggled into a header.

IDORidor

An open lock with a hash in it — an object reached by guessing its id.

Injection flawinjection-flaw

The wide machine with an arrow pushed into a box — input treated as an instruction.

Insecure randominsecure-random

An open lock with a wobbling line in it — randomness an attacker can predict.

Intrusionintrusion

An intrusion — something unauthorised got through, a breach or an attack.

Jailbreak attemptjailbreak-attempt

An open lock with a bolt in it — a prompt written to get past what the model refuses.

Mass assignmentmass-assignment

An open lock with a list in it — every field in the request written straight to the model.

Model poisoningmodel-poisoning

Model poisoning — tainted data slipped into training on purpose.

Open CORSopen-cors

An open lock with an arrow pointing both ways — any origin allowed to read the response.

Open redirectopen-redirect

A panel with a path that turns off somewhere else — a link that sends users where it likes.

Path traversalpath-traversal

A folder with two chevrons climbing out of it — a path that walks up past where it should.

Privilege escalationprivilege-escalation

An upright key, an arrow climbing in its bow — privileges escalating beyond what was granted.

Prompt injectionprompt-injection

Prompt injection — malicious instructions smuggled into a model's input to hijack it.

Race conditionrace-condition-sec

The wide machine with two arrows racing — two requests arriving so close that a check is skipped.

Red teamred-team

Red team — attacking your own system before somebody else does, adversarial probing.

Red team agentred-team-agent

A red team agent — paid to break the system first, an attacking probe.

Sandbox escapesandbox-escape

A box inside a box with an arrow climbing out of the inner one — code reaching past its walls.

Session fixationsession-fixation

An open lock with a pin in it — a session id planted before the user ever logged in.

Side channelside-channel

An open lock with a signal in it — a secret read from power, cache or sound.

SQL injectionsql-injection

The database cylinder with a bolt in it — a query with an attacker's text in it.

SSRFssrf

The wide machine with an arrow that loops back into it — the server made to fetch something for the attacker.

Supply chain attacksupply-chain-attack

The delivery truck with a bolt in its cargo — something planted before it reached you.

Timing attacktiming-attack

An open lock with a clock in it — a secret read from how long a check takes.

Typosquattyposquat

A page with a line that ends in a wrong character — a package named one letter off the real one.

Weak cryptoweak-crypto

An open lock with a cross in it — a cipher or hash that no longer holds.

XSSxss

A panel with a tag and something planted in it — script slipped into a page others will load.

XXExxe

A page with a tag and a bar in it — an XML entity that reads files it should not.

In code, each is one import — import { AdversarialExample } from "@iconmind/react/icons/adversarial-example" — and the same name in Vue, Svelte, Solid, Preact, React Native, Astro, Blade and Flutter.

Tags these icons also carry