Paper proposes protecting DNN models with secret key preprocessing.
problem Protecting deep learning models from unauthorized access.
method Block-wise pixel shuffling with secret key for preprocessing.
result Protected models maintain close performance to non-protected models with correct key, but accuracy drops significantly with incorrect key.
Fawkes protects images from unauthorized facial recognition models.
problem Unauthorized training of facial recognition models poses privacy risks.
method Fawkes adds imperceptible pixel-level changes (cloaks) to images before release.
result Fawkes can protect images from misidentification by 95% and 80% even when clean images are leaked.
Proposes a general deep neural network method for digital watermarking.
problem Protecting intellectual content in a massive, IoT-acquired image dataset.
method Train a neural network on an image set and use it to protect distinct test images in bulk.
result Demonstrates the robustness and practicality of the proposed method.
Paper analyzes InstaHide's security, recovering all private images with provable guarantee.
problem Protecting privacy of training data in neural networks.
method Unified framework to understand and analyze attacks on InstaHide, presenting a new algorithm to recover all private images with provable guarantee.
result InstaHide is computationally secure but not information-theoretically secure when mixing two private images.
Interpretability and fairness are critical in computer vision and machine learning applications, in particular when dealing with human outcomes, e.g. inviting or not inviting for a job interview based on application materials that may include photographs. One promising direction to achieve fairness is by learning data …
Paper proposes a method to encrypt faces while maintaining visual similarity.
problem Protecting personal data from unauthorized face recognition.
method Targeted identity-protection iterative method (TIP-IM) to generate adversarial identity masks.
result TIP-IM provides 95%+ protection success rate against face recognition models.
Improves diversity of text-to-image models without sacrificing FID.
problem Lack of diversity and tendency to recreate training set images.
method Adds sparse repellency terms to diffusion SDE to guide trajectories away from a reference set.
result Improves diversity of diffusion models with minimal impact on FID.
Paper proposes a method to protect DCNNs from adversarial attacks and poor quality images.
problem DCNNs are vulnerable to adversarial examples and perceptual quality issues.
method Combines image quality assessment with knowledge distillation.
result Detector effectively identifies poor quality and adversarial images.
A new framework reduces data upload for image classification while protecting user privacy.
problem Data upload limitations and privacy concerns in cloud-based image classification.
method Unsupervised autoencoder training at edge devices, followed by latent vector transmission to server for classifier training.
result The framework reduces communications overhead and protects user data privacy.
Study removes bias from chest X-ray embeddings using orthogonalization.
problem Reduces bias in chest X-ray embeddings due to protected features.
method Orthogonalization technique to remove protected feature effects.
result Orthogonalization removes bias and makes predictions of protected attributes infeasible.
PASS protects private attributes by stochastically substituting data.
problem Protecting private attributes in ML services while maintaining data utility.
method PASS uses stochastic data substitution with a novel loss function derived from information theory.
result PASS effectively protects private attributes across various datasets.
Proves bounds on copyright risk for generative models.
problem Generative models risk producing similar content to copyrighted data.
method Defines NAF, proves bounds, and provides learning algorithms.
result Generative models can be made less likely to produce copyrighted content.
In this paper, we address the problem of data reconstruction from privacy-protected templates, based on recent concept of sparse ternary coding with ambiguization (STCA). The STCA is a generalization of randomization techniques which includes random projections, lossy quantization, and addition of ambiguization noise t…
New algorithm mitigates bias in subset selection with noisy protected attributes.
problem Mitigating bias in subset selection when protected attributes are noisy.
method Formulated a denoised selection problem and developed a linear-programming based approximation algorithm.
result The approach can produce fairer subsets despite noisy protected attributes.
Deep learning model developers often use cloud GPU resources to experiment with large data and models that need expensive setups. However, this practice raises privacy concerns. Adversaries may be interested in: 1) personally identifiable information or objects encoded in the training images, and 2) the models trained …
Distributed Acoustic Sensing (DAS) using fiber optic cables is a promising new technology for pipeline monitoring and protection. In this work, we applied and compared two approaches for event detection using DAS: Classic machine learning approach and the approach based on image processing and deep learning. Although w…
In large-scale statistical learning, data collection and model fitting are moving increasingly toward peripheral devices---phones, watches, fitness trackers---away from centralized data collection. Concomitant with this rise in decentralized data are increasing challenges of maintaining privacy while allowing enough in…
Vanilla CNNs, as uncalibrated classifiers, suffer from classifying out-of-distribution (OOD) samples nearly as confidently as in-distribution samples. To tackle this challenge, some recent works have demonstrated the gains of leveraging available OOD sets for training end-to-end calibrated CNNs. However, a critical que…
One pixel modification can make deep models unlearnable.
problem Protecting data from unauthorized training of deep neural networks.
method Perturbing only one pixel in each image to degrade model accuracy.
result Generated One-Pixel Shortcut (OPS) cannot be erased by adversarial training and strong augmentations.
Enhances deep learning models to resist adversarial attacks.
problem Protecting deep learning models from adversarial examples.
method Combines two mechanisms: increased robustness at the cost of accuracy and improved accuracy without robustness guarantee.
result Combining mechanisms provides robustness against adversarial examples while maintaining accuracy.
Develops statistical guarantees for image-to-image regression models.
problem Current image-to-image regression models lack statistical guarantees for model mistakes and hallucinations.
method Uncertainty quantification techniques with rigorous statistical guarantees for image-to-image regression problems.
result Derives uncertainty intervals around each pixel with formal mathematical guarantees.
For a data holder, such as a hospital or a government entity, who has a privately held collection of personal data, in which the revealing and/or processing of the personal identifiable data is restricted and prohibited by law. Then, "how can we ensure the data holder does conceal the identity of each individual in the…
New method reduces copyright risks in AI-generated images.
problem Copyright issues in AI-generated images.
method Genericization method using originality estimation and PREGen technique.
result PREGen reduces likelihood of generating copyrighted characters by over half.
Generative Adversarial Networks (GANs) have made releasing of synthetic images a viable approach to share data without releasing the original dataset. It has been shown that such synthetic data can be used for a variety of downstream tasks such as training classifiers that would otherwise require the original dataset t…
We consider the problem of a neural network being requested to classify images (or other inputs) without making implicit use of a "protected concept", that is a concept that should not play any role in the decision of the network. Typically these concepts include information such as gender or race, or other contextual …
Machine learning systems have received much attention recently for their ability to achieve expert-level performance on clinical tasks, particularly in medical imaging. Here, we examine the extent to which state-of-the-art deep learning classifiers trained to yield diagnostic labels from X-ray images are biased with re…
LARP filters data to protect model performance across various learners.
problem Protecting model accuracy in public datasets with diverse learners.
method Formalizes and analyzes LARP, a robust data prefiltering method.
result LARP provides guarantees on worst-case loss over a set of learners, with some performance trade-off.
Image data has been greatly produced by individuals and commercial vendors in the daily life, and it has been used across various domains, like advertising, medical and traffic analysis. Recently, image data also appears to be greatly important in social utility, like emergency response. However, the privacy concern be…
Paper proposes a new approach to GDPR compliance using data protection analytics.
problem Lack of research on data protection risk management and difficulty in GDPR compliance.
method Quantitative approach to data protection risk-based compliance.
result Improves data protection impact assessments by integrating analytics and expert opinions.
In this paper, we introduce the Fairness GAN, an approach for generating a dataset that is plausibly similar to a given multimedia dataset, but is more fair with respect to protected attributes in allocative decision making. We propose a novel auxiliary classifier GAN that strives for demographic parity or equality of …
Pseudo rehearsal uses non-photo-realistic images to save resources without sacrificing performance.
problem Catastrophic forgetting in neural networks when learning new tasks.
method Synthetically generate non-photo-realistic images to rehearse previous tasks.
result Non-photo-realistic images can be used for rehearsal without sacrificing performance and significantly reduce resource consumption.
This paper presents a method to generate synthetic data with differential privacy to protect user privacy while maintaining data trends.
problem Protecting user privacy while using real data for AI applications.
method Develops a practical guide to generating synthetic data using differential privacy.
result Synthetic data can be generated to preserve trends of real data while ensuring strong privacy protections.
Develops methods to measure and reduce fairness in datasets with limited protected attribute labels.
problem Measuring and reducing fairness in datasets with limited protected attribute labels.
method Proposes methods to estimate fairness metrics and train models to limit fairness violations using probabilistic protected attribute labels.
result Our methods provide tighter bounds on true disparity and effectively reduce fairness violations with lesser fairness-accuracy trade-offs.
Study on privacy-preserving health care models that sacrifice accuracy for data protection.
problem Privacy-preserving models in health care neglect data from the tails, reducing accuracy for small groups.
method Used state-of-the-art differentially private learning methods for clinical prediction tasks.
result Privacy-preserving models in health care exhibit steep tradeoffs between privacy and utility, and disproportionately influence large demographic groups.
Study protects federated learning models from eavesdropping attacks.
problem Protecting client models in federated learning from eavesdropping adversaries.
method Theoretical analysis and numerical experiments examining various factors.
result Theoretical and experimental results show the effectiveness of protection methods.
Image classifiers often suffer from adversarial examples, which are generated by strategically adding a small amount of noise to input images to trick classifiers into misclassification. Over the years, many defense mechanisms have been proposed, and different researchers have made seemingly contradictory claims on the…
Fairness audits fail under missing protected labels, especially at zero access.
problem Understanding the reliability of fairness audits with incomplete protected-label data.
method Introduced a seed-calibrated stress test to separate missingness effects from seed-to-seed movement.
result Missing protected labels do not significantly alter fairness mitigation methods, but they can lead to harmful intersectional outcomes.
New methods ensure fairness in noisy protected groups.
problem Noisy or biased protected group information complicates fairness audits.
method Robust optimization techniques to enforce fairness on true groups.
result Robust approaches achieve better true group fairness guarantees.
The paper analyzes how to combine self-protection and self-insurance for risk reduction.
problem Combining self-protection and self-insurance for risk reduction when market insurance is absent.
method The approach uses Value-at-Risk and Tail Value-at-Risk to evaluate residual risk and solves the problem using isoquant geometry based on marginal-balance curves.
result The analysis identifies the conditions under which self-protection and self-insurance behave as substitutes or complements.
Researchers create topologically protected knots in a realizable system.
problem Creating topologically protected vortex knots in experimentally realizable systems.
method Investigated non-Abelian vortices in tetrahedral order in spin-2 Bose--Einstein condensates and bent-core nematic liquid crystals.
result Discovered the first topologically protected knots in an experimentally realizable system.
New attacks show ML models can be compromised even when targeting one concept.
problem Vulnerability of ML models to multi-concept attacks.
method Developed novel multi-concept attack techniques for deep learning.
result Successfully attacked one set of classifiers without impacting others.
Nowadays, CAPTCHAs are computer generated tests that human can pass but current computer systems can not. They have common usage in various web services in order to be able to detect a human from computer programs autonomously. In this way, owners can protect their web services from bots. In addition to visual CAPTCHAs…
The paper proposes methods to infer from privacy-protected data using simulation-based techniques.
problem Valid statistical inference from privacy-protected data is computationally challenging.
method Simulation-based inference methods, including sequential Monte Carlo and neural conditional density estimators.
result Valid statistical inferences can be made from privacy-protected data.
Framework for fair classification with noisy protected attributes and provable guarantees.
problem Fair classification with noisy protected attributes.
method Optimization framework for linear and linear-fractional fairness constraints, handling multiple non-binary attributes.
result Provably fair classifier with minimal accuracy loss, even with large noise.
Fair clustering under the disparate impact doctrine requires that population of each protected group should be approximately equal in every cluster. Previous work investigated a difficult-to-scale pre-processing step for k-center and k-median style algorithms for the special case of this problem when the number of …
As state-of-the-art deep neural networks are deployed at the core of more advanced Al-based products and services, the incentive for copying them (i.e., their intellectual properties) by rival adversaries is expected to increase considerably over time. The best way to extract or steal knowledge from such networks is by…
A multi-task network avoids indirect discrimination in insurance pricing.
problem Indirect discrimination in insurance pricing models based on protected characteristics.
method Multi-task neural network architecture trained with partial protected characteristic information.
result Multi-task network produces discrimination-free insurance prices with comparable accuracy to conventional models.
Split learning preserves privacy in 1D CNN models for detecting heart abnormalities.
problem Privacy leakage in 1D CNN models under split learning.
method Implemented and validated an 1D CNN model under split learning, applied privacy leakage mitigation techniques.
result Split learning alone is insufficient to maintain raw data privacy in 1D CNN models.