Dr. Andrew Davis is chief data scientist at HiddenLayer, developing defenses against attacks on machine-learning and generative-AI systems. His background building malware detectors informs a practical approach to adversarial machine learning: attackers adapt, exploit overlooked dependencies, and treat every exposed model as an opportunity.
Davis earned a doctorate in computer engineering from the University of Tennessee. With Itamar Arel, he investigated low-rank approximations for conditional computation, identifying neural-network units that contribute little to an output so their computation can be skipped. The research appeared in the 2014 International Conference on Learning Representations workshop program.
He subsequently worked at Cylance, Sophos, and Elastic, applying machine learning to malware detection. At Cylance, he contributed to an artificial-intelligence guide for security professionals. By 2021, as an Elastic principal data scientist, he was developing YARA rules from malicious byte sequences, translating machine-learning detections into interpretable signatures security teams could inspect and deploy.
How Davis approaches AI security
- Treat dataset provenance as a security control. Expired domains can silently change images downloaded for ImageNet, malware repositories can contain manipulated training examples, and editable Wikipedia pages can contaminate retrieval systems. Davis recommends checksum verification, careful filtering, and attention to source revision histories.
- Identify model extraction through behavioral monitoring. Repeated API queries can generate training data for a surrogate model, especially when responses expose detailed prediction values. Davis advocates requester-level logging, anomaly detection, and returning only the information an application actually needs.
- Prepare for multimodal prompt injection. Images attached to otherwise innocuous emails can potentially manipulate AI assistants even when text-based defenses succeed. Davis also warns that encoding-based safeguards can fail when attackers construct encoded strings that remain legible as instructions.
- Secure the model supply chain. Downloaded models and framework features can execute arbitrary code, making publisher verification, artifact scanning, sandboxing, and timely patching essential. His account of securing deployed machine-learning systems treats datasets, APIs, model artifacts, and infrastructure as interconnected security boundaries.
