An Adversarial ML Engineer, also known as an Adversarial ML Researcher, works on the ways machine learning models can be manipulated through their inputs, their training data or their outputs. Where a red teamer asks whether a product can be broken, an adversarial ML specialist asks why a model is vulnerable, how far an attack generalises and which defences actually change the outcome.
Companies hire for this role when models make decisions with real consequences, such as fraud detection, content moderation, biometric authentication, autonomous perception or malware classification. In those settings an attacker who can nudge a prediction, plant a backdoor or copy the model has a direct route to harm. The role is also common in teams training their own foundation models, where poisoning and extraction are live concerns.
What does an Adversarial ML Engineer do?
The work combines experimentation with engineering. An Adversarial ML Engineer implements known attacks, adapts them to the organisation's models, develops new ones where needed, and then builds and measures defences. Results feed into model design, training procedures and deployment controls.
- Running evasion attacks against classifiers and multimodal models, from gradient-based methods such as FGSM and PGD to black-box and transfer attacks
- Assessing data poisoning and backdoor risk in training and fine-tuning pipelines, including data sourced from the web or from users
- Testing for model extraction, where an attacker reconstructs model behaviour through repeated queries
- Measuring privacy leakage through membership inference and training data extraction
- Implementing and evaluating defences such as adversarial training, input preprocessing, anomaly detection and query rate controls
- Building benchmark suites and evaluation pipelines that measure robustness consistently across model versions
- Writing internal research notes and, where appropriate, publishing findings
Key skills and backgrounds
Most candidates hold a PhD or research master's in machine learning, computer vision, NLP or computer security, or have equivalent industry research experience. Strong engineers in this field write production-quality code as well as research code, because attacks and defences need to run against real systems at scale. Hiring managers should ask candidates to explain the threat model behind a defence they have built and where it stops working. Weak defences are often evaluated against weak attacks, and good candidates know this.
Publications, open-source attack libraries or competition results are useful signals, but practical experience against deployed models carries equal weight.
- Deep familiarity with PyTorch or JAX, including custom training loops and gradient manipulation
- Threat modelling across white-box, grey-box and black-box attacker access
- Evasion, poisoning, backdoor, extraction and inference attacks, and the defences proposed for each
- Adaptive attack design to stress-test defences properly
- Statistical rigour in experiment design and reporting
- Awareness of MITRE ATLAS, the NIST AI RMF and robustness expectations in the EU AI Act
- Ability to translate research results into engineering requirements
Where Adversarial ML Engineers work
Foundation model labs and AI research groups hire adversarial ML specialists into security and robustness teams. Financial services firms use them to harden fraud, credit and anti-money laundering models. Identity and biometrics companies need them to defend face and voice recognition against spoofing. Autonomous systems and defence organisations hire them to test perception models. Cyber security vendors employ them to protect ML-based detection from evasion, and government research bodies and universities run adversarial ML programmes of their own.
Adversarial ML Engineer vs related roles
Adversarial ML overlaps with several offensive and research roles. These are the most common points of confusion.
- An AI Penetration Tester assesses AI applications and infrastructure as a whole, while an Adversarial ML Engineer focuses on the model and its training process.
- A Prompt Injection Researcher concentrates on attacks delivered through natural language instructions to LLMs, which is one branch of the wider adversarial ML field.
- An AI Offensive Security Researcher looks for new attack classes across AI systems and may also study how AI can be used offensively, whereas an Adversarial ML Engineer usually works on model-level threats to a specific organisation.
Salary and market data
Pay for adversarial ML engineers and researchers tracks closely with research seniority, publication record and the type of employer. You can find current ranges in our GenAI and agentic systems salary guide and across the AI and deep tech salary guides, and test a package against the market with the deep tech salary calculator.
Hiring Adversarial ML Engineers with DeepRec
DeepRec recruits adversarial ML talent for teams working in GenAI and agentic systems and wider AI research, across Europe and the US from London, Berlin, Zurich, Dublin and Boston. Our screening goes beyond publication lists. We discuss threat models, attack implementations and how candidates evaluated their defences, so the people you interview can do the work. We support permanent, contract, retained and executive search hiring, from individual researchers to leads building a robustness function. To brief us on a role, visit Looking to Hire.