Face recognition systems are vulnerable to composite face reconstruction attacks.
problem Vulnerability of face recognition systems to composite face reconstruction attacks.
method Assumed attacker uses composite face parts to reconstruct faces faster and more efficiently.
result Current face recognition systems are extremely vulnerable to random search attacks.
This work improves understanding of neural network reconstruction attacks and distillation.
problem Understanding and mitigating reconstruction attacks on neural networks.
method Developed a stronger dataset reconstruction attack and studied its characteristics.
result Reconstruction attacks can recover entire training sets in the infinite width regime.
New study analyzes security of neural network data reconstruction attacks.
problem Data reconstruction attacks pose a threat to private training data.
method Analyzes security boundary of data reconstruction attacks via neuron exclusivity state.
result Characterizes insecure/secure boundary of data reconstruction attacks.
Paper improves privacy for language models against reconstruction attacks.
problem Reconstruction attacks can regenerate training data from language models.
method Uses Rényi differential privacy with optimized privacy budgets.
result Better privacy guarantees for extraction of rare secrets.
New analysis shows reconstruction attacks are unreliable without prior data knowledge.
problem Privacy and security risks from neural network memorization of training data.
method Complementary analysis of reconstruction methods, proving their unreliability without prior data knowledge.
result Reconstruction attacks are fundamentally unreliable without prior data knowledge, and networks trained more extensively are less susceptible.
Optimal defenses protect FL models from gradient reconstruction attacks.
problem Gradient reconstruction attacks compromise FL models by recovering original data from shared gradients.
method Derive a theoretical lower bound of reconstruction error, customize noise and pruning defenses, and achieve optimal trade-off between leakage and utility.
result Our methods outperform Gradient Noise and Pruning in protecting training data and maintaining model utility.
Adversarial examples raise questions about whether neural network models are sensitive to the same visual features as humans. In this paper, we first detect adversarial examples or otherwise corrupted images based on a class-conditional reconstruction of the input. To specifically attack our detection mechanism, we pro…
Paper evaluates and mitigates privacy risks in deep learning models.
problem Quantifying and defending against privacy attacks in deep learning.
method Quantitative evaluation of trade-offs, reformulating attacks, and proposing a novel SPN.
result Model accuracy improved by 5-20% while maintaining data privacy.
DefenseVGAE defends graph neural networks against adversarial attacks.
problem Vulnerability of GNNs to adversarial structural perturbations.
method Variational Graph Autoencoder (VGAE) to reconstruct graph structure.
result DefenseVGAE reduces adversarial perturbations and boosts GCN performance.
New attack recovers user-level information from large batch images.
problem Recovering private information from user-level gradients in distributed learning.
method Proposes a gradient inversion attack using a denoising diffusion model as a prior.
result Demonstrates recovery of realistic facial images and private attributes.
SAPAG attacks distributed learning by reconstructing true training data from gradients.
problem Privacy attacks on distributed learning systems through gradients.
method SAPAG uses a Gaussian kernel-based gradient difference distance measure.
result SAPAG can reconstruct training data on various DNNs and at different training phases.
We present a simple technique that allows capsule models to detect adversarial images. In addition to being trained to classify images, the capsule model is trained to reconstruct the images from the pose parameters and identity of the correct top-level capsule. Adversarial images do not look like a typical member of t…
Variational autoencoders (VAEs) have recently been shown to be vulnerable to adversarial attacks, wherein they are fooled into reconstructing a chosen target image. However, how to defend against such attacks remains an open problem. We make significant advances in addressing this issue by introducing methods for produ…
Develops a new robustness criterion for VAEs and provides theoretical guarantees.
problem Lack of formalization for robustness in VAEs.
method Introduces r-robustness criterion and derives reconstruction margins. result Derives theoretical guarantees for VAE robustness.
Machine learning (ML) has progressed rapidly during the past decade and the major factor that drives such development is the unprecedented large-scale data. As data generation is a continuous process, this leads to ML model owners updating their models frequently with newly-collected data in an online learning scenario…
This paper shows the susceptibility of spectrogram-based audio classifiers to adversarial attacks and the transferability of such attacks to audio waveforms. Some commonly used adversarial attacks to images have been applied to Mel-frequency and short-time Fourier transform spectrograms, and such perturbed spectrograms…
Graph embedding leaks sensitive graph properties and subgraphs.
problem Privacy risks in graph embedding sharing.
method Three inference attacks and a defense mechanism.
result High accuracy in inferring graph properties and subgraphs.
This paper studies model-inversion attacks, in which the access to a model is abused to infer information about the training data. Since its first introduction, such attacks have raised serious concerns given that training data usually contain privacy-sensitive information. Thus far, successful model-inversion attacks …
Efficient method defends privacy in federated learning without accuracy loss.
problem Privacy attacks on federated learning by reconstructing and identifying local data.
method Random noise perturbation method that allows recovery of true gradients.
result Strong privacy protection without sacrificing learning accuracy.
New framework UIFV reconstructs private features in VFL without model details.
problem Privacy risks in VFL where adversaries can reconstruct sensitive features.
method Unified InverNet Framework (UIFV) that uses intermediate feature data.
result Significantly outperforms state-of-the-art techniques in attack precision.
New defense method protects client data privacy in federated learning.
problem Gradient leakage attacks in federated learning.
method Learning to obscure data to generate synthetic samples.
result Synthetic samples preserve predictive features and protect privacy.
Improved reliability of machine learning predictions using variational auto-encoders.
problem Individual unreliability of machine learning models.
method Modified variational auto-encoders to identify a low-dimensional space for reliable classification.
result Improved reliability of predictions and robust identification of adversarial samples.
Paper tackles model vulnerabilities by reconstructing training data.
problem Reconstructing training data from model parameters poses a security risk.
method Developed a mathematical framework and score matching method for both Bayesian and non-Bayesian models.
result First score matching framework for reconstructing data in Bayesian models.
The paper analyzes privacy leakage in federated learning using linear algebra and optimization theory.
problem Privacy leakage in federated learning despite its promise for data privacy.
method Theoretical analysis from linear algebra and optimization theory perspectives.
result Derives sufficient conditions to prevent data reconstruction attacks and establishes an upper bound on privacy leakage.
Background elimination for noisy character images or character images from real scene is still a challenging problem, due to the bewildering backgrounds, uneven illumination, low resolution and different distortions. We propose a stroke-based character reconstruction(SCR) method that use a weighted quadratic Bezier cur…
Unified bounds for DP risks reduce noise and improve accuracy.
problem Difficult interpretation and calibration of DP mechanisms.
method Hypothesis-testing interpretation of DP (f-DP) and unified bounds. result Unified bounds are tighter and tunable for specific risks.
In this paper we propose a new membership attack method called co-membership attacks against deep generative models including Variational Autoencoders (VAEs) and Generative Adversarial Networks (GANs). Specifically, membership attack aims to check whether a given instance x was used in the training data or not. A co-me…
In this paper, we address the problem of data reconstruction from privacy-protected templates, based on recent concept of sparse ternary coding with ambiguization (STCA). The STCA is a generalization of randomization techniques which includes random projections, lossy quantization, and addition of ambiguization noise t…
Paper reconstructs training data from a single gradient query.
problem Privacy threats in federated learning due to model gradients.
method Provable attack using tensor decomposition.
result Training samples can be fully reconstructed from a single gradient query.
We develop a method to factorize symmetric sparse Boolean matrices efficiently.
problem Finding a symmetric factorization of a given matrix into a sparse, Boolean matrix.
method Polynomial-time algorithm based on bootstrapping higher-order information and tensor decomposition.
result A matrix with full column rank can be recovered with high probability when the matrix size is sufficiently large.
A new method detects and corrects adversarial attacks on classifiers.
problem Detecting and correcting adversarial attacks on machine learning models.
method Unsupervised autoencoder trained with KL divergence loss to match predictions.
result Almost completely neutralizes powerful attacks on MNIST and Fashion-MNIST.
This paper analyzes how training data can be leaked from gradients in neural networks and proposes a metric for measuring model security.
problem Training data leakage from gradients in neural networks for image classification.
method Formulated the problem as an optimisation problem for each layer, involving weights, gradients, and constraints from preceding layers.
result Attributed training data leakage to the architecture of the deep network and proposed a metric for measuring model security.
New method reconstructs significant parts of training data from neural networks.
problem Understanding and reconstructing training data from neural networks.
method Proposes a novel reconstruction scheme based on recent theoretical results about neural network training.
result Shows that a significant fraction of training data can be reconstructed from neural network parameters.
New method improves model reconstruction using counterfactuals and polytope theory.
problem Reconstructing models with minimal input changes and avoiding decision boundary shifts.
method Using polytope theory to derive loss functions that treat counterfactuals differently from ordinary instances.
result Improves fidelity between target and surrogate model predictions on multiple datasets.
This paper evaluates and compares gradient leakage attacks in federated learning.
problem Gradient leakage attacks compromise client privacy in federated learning.
method Formal and experimental analysis of gradient leakage attacks, evaluation of attack effectiveness and cost.
result Gradient leakage attacks can reconstruct private local training data from shared parameter updates.
We explore methods of producing adversarial examples on deep generative models such as the variational autoencoder (VAE) and the VAE-GAN. Deep learning architectures are known to be vulnerable to adversarial examples, but previous work has focused on the application of adversarial examples to classification tasks. Deep…
Paper proposes structured semantic perturbations to improve adversarial attacks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Manipulates semantic attributes via disentangled latent codes.
result Demonstrates the effectiveness of structured semantic perturbations.
In this letter, as a proof of concept, we propose a deep learning-based approach to attack the chaos-based image encryption algorithm in \cite{guan2005chaos}. The proposed method first projects the chaos-based encrypted images into the low-dimensional feature space, where essential information of plain images has been …
New method reconstructs data subsets from limited published statistics.
problem Reconstructing tabular data from aggregate statistics when full datasets are not possible.
method Generates and verifies subsets of rows and columns that are guaranteed to be correct.
result Privacy violations can persist even with sparse published statistics.
Defense against adversarial attacks by manipulating feature thickness.
problem Vulnerability of machine learning models to adversarial attacks.
method Feature Manipulation (FM)-Defense using a combo-variational autoencoder.
result Detection and purification of adversarial examples with high accuracy.
Tensor network decomposition, originated from quantum physics to model entangled many-particle quantum systems, turns out to be a promising mathematical technique to efficiently represent and process big data in parsimonious manner. In this study, we show that tensor networks can systematically partition structured dat…
Lower bounds on query complexity for reconstructing private learner's training data.
problem Query complexity of reconstructing private learner's training data.
method Minimax analysis, Rényi DP, Metric DP framework.
result First known lower bounds on adversary's query complexity for various DP learners.
We show through theory and experiment that gradient-based explanations of a model quickly reveal the model itself. Our results speak to a tension between the desire to keep a proprietary model secret and the ability to offer model explanations. On the theoretical side, we give an algorithm that provably learns a two-la…
The level sets of neural networks represent fundamental properties such as decision boundaries of classifiers and are used to model non-linear manifold data such as curves and surfaces. Thus, methods for controlling the neural level sets could find many applications in machine learning. In this paper we present a simpl…
Deep Neural Network (DNN) workloads are quickly moving from datacenters onto edge devices, for latency, privacy, or energy reasons. While datacenter networks can be protected using conventional cybersecurity measures, edge neural networks bring a host of new security challenges. Unlike classic IoT applications, edge ne…
Improved RA detection with SNN outperforming baseline by 26.8% EER.
problem Improving RA detection systems' generalizability and discriminability.
method Multi-task learning with Siamese Neural Networks (SNN) and additional reconstruction loss.
result SNN outperforms baseline by 26.8% EER, and further improvement by 13.8% with reconstruction loss.
Certifiably robust VAEs are trained with bounds on input perturbations.
problem Ensuring VAEs are robust to adversarial attacks.
method Derive bounds on minimal perturbation size, control parameters, and train VAEs to meet criteria.
result Certifiably robust VAEs are more robust to attacks than standard VAEs.
Enhances 2D face recognition with 3D features using active illumination.
problem Improving robustness of 2D face recognition to spoofing attacks and low-light conditions.
method Projecting a high spatial frequency pattern onto the face to recover 3D information and a 2D image simultaneously.
result Significantly boosts face recognition performance and dramatically improves robustness to spoofing attacks.