arXiv subjects

Dong Su

Publications and source records attributed to Dong Su.

30 records · Page 2Linked to original sources

arXiv2018

Defending Against Machine Learning Model Stealing Attacks Using Deceptive Perturbations

Machine learning models are vulnerable to simple model stealing attacks if the adversary can obtain output labels for chosen inputs. To protect against these attacks, it has been proposed to limit the information provided to the adversary by omitting probability scores, significantly impacting the utility of the provided service. In this work, we illustrate how a service provider can still provide useful, albeit misleading, class probability information, while significantly limiting the success of the attack. Our defense forces the adversary to discard the class probabilities, requiring significantly more queries before they can train a model with comparable performance. We evaluate several attack strategies, model architectures, and hyperparameters under varying adversarial models, and evaluate the efficacy of our defense against the strongest adversary. Finally, we quantify the amount of noise injected into the class probabilities to mesure the loss in utility, e.g., adding 1.26 nats per query on CIFAR-10 and 3.27 on MNIST. Our evaluation shows our defense can degrade the accuracy of the stolen model at least 20%, or require up to 64 times more queries while keeping the accuracy of the protected model almost intact.

cs.LG↗

arXiv2018

Reaching Data Confidentiality and Model Accountability on the CalTrain

Distributed collaborative learning (DCL) paradigms enable building joint machine learning models from distrusting multi-party participants. Data confidentiality is guaranteed by retaining private training data on each participant's local infrastructure. However, this approach to achieving data confidentiality makes today's DCL designs fundamentally vulnerable to data poisoning and backdoor attacks. It also limits DCL's model accountability, which is key to backtracking the responsible "bad" training data instances/contributors. In this paper, we introduce CALTRAIN, a Trusted Execution Environment (TEE) based centralized multi-party collaborative learning system that simultaneously achieves data confidentiality and model accountability. CALTRAIN enforces isolated computation on centrally aggregated training data to guarantee data confidentiality. To support building accountable learning models, we securely maintain the links between training instances and their corresponding contributors. Our evaluation shows that the models generated from CALTRAIN can achieve the same prediction accuracy when compared to the models trained in non-protected environments. We also demonstrate that when malicious training participants tend to implant backdoors during model training, CALTRAIN can accurately and precisely discover the poisoned and mislabeled training data that lead to the runtime mispredictions.

cs.CR↗

arXiv2018

Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach

The robustness of neural networks to adversarial examples has received great attention due to security implications. Despite various attack approaches to crafting visually imperceptible adversarial examples, little has been developed towards a comprehensive measure of robustness. In this paper, we provide a theoretical justification for converting robustness analysis into a local Lipschitz constant estimation problem, and propose to use the Extreme Value Theory for efficient evaluation. Our analysis yields a novel robustness metric called CLEVER, which is short for Cross Lipschitz Extreme Value for nEtwork Robustness. The proposed CLEVER score is attack-agnostic and computationally feasible for large neural networks. Experimental results on various networks, including ResNet, Inception-v3 and MobileNet, show that (i) CLEVER is aligned with the robustness indication measured by the $\ell_2$ and $\ell_\infty$ norms of adversarial examples from powerful attacks, and (ii) defended networks using defensive distillation or bounded ReLU indeed achieve better CLEVER scores. To the best of our knowledge, CLEVER is the first attack-independent robustness metric that can be applied to any neural network classifier.

stat.ML↗

arXiv2017

Atomic layer control of metal-insulator behavior in oxide quantum wells integrated directly on silicon

We present electrical and structural characterization of epitaxial LaTiO3/SrTiO3 quantum wells integrated directly on Si(100). The quantum wells exhibit metallic transport described by Fermi-liquid behavior. Carriers arise from both charge transfer from the LaTiO3 to SrTiO3 and oxygen vacancies in the latter. By reducing the thickness of the quantum wells, an enhancement in carrier-carrier scattering is observed, and insulating transport emerges. Consistent with a Mott-driven transition in bulk rare-earth titanates, the insulating behavior is described by activated transport, and the onset of insulating transport occurs near 1 electron per Ti occupation within the SrTiO3 well. We also discuss the role that structure and gradients in strain may play in enhancing the carrier density. The manipulation of metal-insulator behavior in oxides grown directly on Si opens the pathway to harnessing strongly correlated phenomena in device technologies.

cond-mat.mtrl-sci↗

arXiv2016

Understanding the Sparse Vector Technique for Differential Privacy

The Sparse Vector Technique (SVT) is a fundamental technique for satisfying differential privacy and has the unique quality that one can output some query answers without apparently paying any privacy cost. SVT has been used in both the interactive setting, where one tries to answer a sequence of queries that are not known ahead of the time, and in the non-interactive setting, where all queries are known. Because of the potential savings on privacy budget, many variants for SVT have been proposed and employed in privacy-preserving data mining and publishing. However, most variants of SVT are actually not private. In this paper, we analyze these errors and identify the misunderstandings that likely contribute to them. We also propose a new version of SVT that provides better utility, and introduce an effective technique to improve the performance of SVT. These enhancements can be applied to improve utility in the interactive setting. Through both analytical and experimental comparisons, we show that, in the non-interactive setting (but not the interactive setting), the SVT technique is unnecessary, as it can be replaced by the Exponential Mechanism (EM) with better accuracy.

cs.CR↗

arXiv2016

Degradation of Black Phosphorus (BP): The Role of Oxygen and Water

Black phosphorus (BP) has attracted significant interest as a monolayer or few-layer material with extraordinary electrical and optoelectronic properties. However, degradation in air and other environments is an unresolved issue that may limit future applications. In particular the role of different ambient species has remained controversial. Here, we report systematic experiments combined with ab-initio calculations that address the effects of oxygen and water in the degradation of BP. Our results show that BP rapidly degrades whenever oxygen is present, but is unaffected by deaerated (i.e., O2 depleted) water. This behavior is rationalized by oxidation involving a facile dissociative chemisorption of O2, whereas H2O molecules are weakly physisorbed and do not dissociate on the BP surface. Oxidation (by O2) turns the hydrophobic pristine BP surface progressively hydrophilic. Our results have implications on the development of encapsulation strategies for BP, and open new avenues for exploration of phenomena in aqueous solutions including solution-gating, electrochemistry, and solution-phase approaches for exfoliation, dispersion, and delivery of BP.

cond-mat.mtrl-sci↗

arXiv2015

Differentially Private Projected Histograms of Multi-Attribute Data for Classification

In this paper, we tackle the problem of constructing a differentially private synopsis for the classification analyses. Several the state-of-the-art methods follow the structure of existing classification algorithms and are all iterative, which is suboptimal due to the locally optimal choices and the over-divided privacy budget among many sequentially composed steps. Instead, we propose a new approach, PrivPfC, a new differentially private method for releasing data for classification. The key idea is to privately select an optimal partition of the underlying dataset using the given privacy budget in one step. Given one dataset and the privacy budget, PrivPfC constructs a pool of candidate grids where the number of cells of each grid is under a data-aware and privacy-budget-aware threshold. After that, PrivPfC selects an optimal grid via the exponential mechanism by using a novel quality function which minimizes the expected number of misclassified records on which a histogram classifier is constructed using the published grid. Finally, PrivPfC injects noise into each cell of the selected grid and releases the noisy grid as the private synopsis of the data. If the size of the candidate grid pool is larger than the processing capability threshold set by the data curator, we add a step in the beginning of PrivPfC to prune the set of attributes privately. We introduce a modified $χ^2$ quality function with low sensitivity and use it to evaluate an attribute's relevance to the classification label variable. Through extensive experiments on real datasets, we demonstrate PrivPfC's superiority over the state-of-the-art methods.

cs.CR↗

arXiv2015

Differentially Private $k$-Means Clustering

There are two broad approaches for differentially private data analysis. The interactive approach aims at developing customized differentially private algorithms for various data mining tasks. The non-interactive approach aims at developing differentially private algorithms that can output a synopsis of the input dataset, which can then be used to support various data mining tasks. In this paper we study the tradeoff of interactive vs. non-interactive approaches and propose a hybrid approach that combines interactive and non-interactive, using $k$-means clustering as an example. In the hybrid approach to differentially private $k$-means clustering, one first uses a non-interactive mechanism to publish a synopsis of the input dataset, then applies the standard $k$-means clustering algorithm to learn $k$ cluster centroids, and finally uses an interactive approach to further improve these cluster centroids. We analyze the error behavior of both non-interactive and interactive approaches and use such analysis to decide how to allocate privacy budget between the non-interactive step and the interactive step. Results from extensive experiments support our analysis and demonstrate the effectiveness of our approach.

cs.CR↗

arXiv2012

PrivBasis: Frequent Itemset Mining with Differential Privacy

The discovery of frequent itemsets can serve valuable economic and research purposes. Releasing discovered frequent itemsets, however, presents privacy challenges. In this paper, we study the problem of how to perform frequent itemset mining on transaction databases while satisfying differential privacy. We propose an approach, called PrivBasis, which leverages a novel notion called basis sets. A theta-basis set has the property that any itemset with frequency higher than theta is a subset of some basis. We introduce algorithms for privately constructing a basis set and then using it to find the most frequent itemsets. Experiments show that our approach greatly outperforms the current state of the art.

cs.DB↗

arXiv2011

On Sampling, Anonymization, and Differential Privacy: Or, k-Anonymization Meets Differential Privacy

This paper aims at answering the following two questions in privacy-preserving data analysis and publishing: What formal privacy guarantee (if any) does $k$-anonymization provide? How to benefit from the adversary's uncertainty about the data? We have found that random sampling provides a connection that helps answer these two questions, as sampling can create uncertainty. The main result of the paper is that $k$-anonymization, when done "safely", and when preceded with a random sampling step, satisfies $(ε,δ)$-differential privacy with reasonable parameters. This result illustrates that "hiding in a crowd of $k$" indeed offers some privacy guarantees. This result also suggests an alternative approach to output perturbation for satisfying differential privacy: namely, adding a random sampling step in the beginning and pruning results that are too sensitive to change of a single tuple. Regarding the second question, we provide both positive and negative results. On the positive side, we show that adding a random-sampling pre-processing step to a differentially-private algorithm can greatly amplify the level of privacy protection. Hence, when given a dataset resulted from sampling, one can utilize a much large privacy budget. On the negative side, any privacy notion that takes advantage of the adversary's uncertainty likely does not compose. We discuss what these results imply in practice.

cs.CR↗

arXiv2010

Experimental Study of Resistive Bistability in Metal Oxide Junctions

We have studied resistive bistability (memory) effects in junctions based on metal oxides, with a focus on sample-to-sample reproducibility which is necessary for the use of such junctions as crosspoint devices of hybrid CMOS/nanoelectronic circuits. Few-nm-thick layers of NbOx, CuOx and TiOx have been formed by thermal and plasma oxidation, at various deposition and oxidation conditions, both with or without rapid thermal post-annealing (RTA). The resistive bistability effect has been observed for all these materials, with particularly high endurance (over 1000 switching cycles) obtained for single-layer TiO2 junctions, and the best reproducibility reached for multi-layer junctions of the same material. Fabrication optimization has allowed us to improve the OFF/ON resistance ratio to about 1000, but the sample-to-sample reproducibility is so far lower than that required for large scale integration.

cond-mat.mes-hall↗

arXiv2001

Highlights of the SLD Physics Program at the SLAC Linear Collider

Starting in 1989, and continuing through the 1990s, high-energy physics witnessed a flowering of precision measurements in general and tests of the standard model in particular, led by e+e- collider experiments operating at the Z0 resonance. Key contributions to this work came from the SLD collaboration at the SLAC Linear Collider. By exploiting the unique capabilities of this pioneering accelerator and the SLD detector, including a polarized electron beam, exceptionally small beam dimensions, and a CCD pixel vertex detector, SLD produced a broad array of electroweak, heavy-flavor, and QCD measurements. Many of these results are one of a kind or represent the world's standard in precision. This article reviews the highlights of the SLD physics program, with an eye toward associated advances in experimental technique, and the contribution of these measurements to our dramatically improved present understanding of the standard model and its possible extensions.

hep-ph↗