Traditional-ML Targets on Cloud

The traditional-ML attacks (extraction, membership inference, evasion) are black-box: they only need an HTTP endpoint that takes an input and returns a label or probability vector. That makes them a drop-in fit for classifiers you host on Azure ML, Azure Container Apps, or AWS SageMaker - you declare the endpoint once with a PredictionTargetSpec and point any attack at it.

The prediction contract

Whatever the platform, your endpoint needs to accept a JSON body and return predictions. The two knobs that adapt the SDK to your endpoint are request_template (how the input is encoded) and probabilities_path / label_path (where the prediction is in the response):

from dreadnode.airt import PredictionTargetSpec
from dreadnode.airt.targets import TargetAuth

target = PredictionTargetSpec(
    endpoint="https://<host>/predict",
    request_template='{"features": {input}}',      # {input} filled per query
    probabilities_path="$.probabilities",           # or label_path="$.label"
    input_format="json_array",                       # json_array | text | image_b64
    num_classes=2,
    name="fraud-detector",
    auth=TargetAuth(type="api_key", header="X-API-Key", env_var="TARGET_KEY"),
)

Note

Secrets never inline. TargetAuth(env_var=...) reads the key from an environment variable. For TUI / sandbox runs, register it as a platform secret so it is injected into the runtime rather than committed.

Azure Container Apps

A container that serves POST /predict is the simplest option. Deploy your model server, then point a target at the app URL:

az containerapp create \
  --name fraud-detector --resource-group airt-demo-rg \
  --environment airt-env --image <registry>/fraud-detector:latest \
  --target-port 8000 --ingress external \
  --secrets api-key=<key> --env-vars API_KEY=secretref:api-key

target = PredictionTargetSpec(
    endpoint="https://fraud-detector.<region>.azurecontainerapps.io/predict",
    request_template='{"features": {input}}',
    probabilities_path="$.probabilities",
    input_format="json_array", num_classes=2, name="fraud-aca",
    auth=TargetAuth(type="api_key", header="X-API-Key", env_var="ACA_KEY"),
)

Azure ML online endpoint

Azure ML managed online endpoints expose a scoring URI and a key. The scoring script’s expected input shape drives request_template:

target = PredictionTargetSpec(
    endpoint="https://<endpoint>.<region>.inference.ml.azure.com/score",
    request_template='{"input_data": {"data": [{input}]}}',
    probabilities_path="$.probabilities",
    input_format="json_array", num_classes=2, name="fraud-azureml",
    auth=TargetAuth(type="api_key", header="Authorization",
                    value_prefix="Bearer ", env_var="AZUREML_KEY"),
)

AWS SageMaker real-time endpoint

SageMaker’s InvokeEndpoint is reachable over HTTP with SigV4, or through a lightweight proxy (API Gateway + Lambda) that exposes a plain POST. Point the target at the proxy URL:

target = PredictionTargetSpec(
    endpoint="https://<api-id>.execute-api.<region>.amazonaws.com/prod/predict",
    request_template='{"instances": {input}}',
    probabilities_path="$.predictions[0]",
    input_format="json_array", num_classes=2, name="fraud-sagemaker",
    auth=TargetAuth(type="api_key", header="x-api-key", env_var="AWS_APIGW_KEY"),
)

Tip

See AWS SageMaker for the SigV4 / proxy details and Azure AI Foundry for Azure-side auth patterns.

Probing a cloud target

Once the target is declared, every attack works identically - the cloud deployment is just an endpoint:

from dreadnode.airt import knockoff_extraction, threshold_membership, boundary_evasion
from dreadnode.airt.assessment import Assessment

async with Assessment("Cloud fraud model - traditional-ML red team",
                      target_config={"url": target.endpoint}) as a:
    ext = await knockoff_extraction(target, query_pool=my_inputs,
                                    query_budget=2000, export_model=True).run()
    mia = await threshold_membership(target, members=m, nonmembers=nm,
                                     member_labels=ml, nonmember_labels=nml).run()
    evd = await boundary_evasion(target, my_inputs[0], num_classes=2).run()

From the TUI (custom task)

The AI Red Teaming agent runs the same probes against a cloud endpoint from natural language. Register the endpoint’s key as a platform secret first, then:

Run a knockoff model-extraction attack against my Azure Container Apps fraud
model at https://fraud-detector.<region>.azurecontainerapps.io/predict. It takes
{"features": [...30 floats...]} and returns probabilities at $.probabilities.
Auth is an X-API-Key header from the ACA_KEY secret. Use a 2000-query budget and
export the stolen model.

The agent resolves the secret from the runtime, builds the PredictionTargetSpec, and runs the attack - the finding appears in the platform exactly as it would for a local target.