arXiv subjects

Haifeng Qian

Publications and source records attributed to Haifeng Qian.

30 records · Page 2Linked to original sources

arXiv2021

An Ensemble Approach Towards Adversarial Robustness

It is a known phenomenon that adversarial robustness comes at a cost to natural accuracy. To improve this trade-off, this paper proposes an ensemble approach that divides a complex robust-classification task into simpler subtasks. Specifically, fractal divide derives multiple training sets from the training data, and fractal aggregation combines inference outputs from multiple classifiers that are trained on those sets. The resulting ensemble classifiers have a unique property that ensures robustness for an input if certain don't-care conditions are met. The new techniques are evaluated on MNIST and Fashion-MNIST, with no adversarial training. The MNIST classifier has 99% natural accuracy, 70% measured robustness and 36.9% provable robustness, within L2 distance of 2. The Fashion-MNIST classifier has 90% natural accuracy, 54.5% measured robustness and 28.2% provable robustness, within L2 distance of 1.5. Both results are new state of the art, and we also present new state-of-the-art binary results on challenging label-pairs.

cs.LG↗

arXiv2021

With Great Dispersion Comes Greater Resilience: Efficient Poisoning Attacks and Defenses for Linear Regression Models

With the rise of third parties in the machine learning pipeline, the service provider in "Machine Learning as a Service" (MLaaS), or external data contributors in online learning, or the retraining of existing models, the need to ensure the security of the resulting machine learning models has become an increasingly important topic. The security community has demonstrated that without transparency of the data and the resulting model, there exist many potential security risks, with new risks constantly being discovered. In this paper, we focus on one of these security risks -- poisoning attacks. Specifically, we analyze how attackers may interfere with the results of regression learning by poisoning the training datasets. To this end, we analyze and develop a new poisoning attack algorithm. Our attack, termed Nopt, in contrast with previous poisoning attack algorithms, can produce larger errors with the same proportion of poisoning data-points. Furthermore, we also significantly improve the state-of-the-art defense algorithm, termed TRIM, proposed by Jagielsk et al. (IEEE S&P 2018), by incorporating the concept of probability estimation of clean data-points into the algorithm. Our new defense algorithm, termed Proda, demonstrates an increased effectiveness in reducing errors arising from the poisoning dataset through optimizing ensemble models. We highlight that the time complexity of TRIM had not been estimated; however, we deduce from their work that TRIM can take exponential time complexity in the worst-case scenario, in excess of Proda's logarithmic time. The performance of both our proposed attack and defense algorithms is extensively evaluated on four real-world datasets of housing prices, loans, health care, and bike sharing services. We hope that our work will inspire future research to develop more robust learning algorithms immune to poisoning attacks.

cs.CR↗

arXiv2021

Oriole: Thwarting Privacy against Trustworthy Deep Learning Models

Deep Neural Networks have achieved unprecedented success in the field of face recognition such that any individual can crawl the data of others from the Internet without their explicit permission for the purpose of training high-precision face recognition models, creating a serious violation of privacy. Recently, a well-known system named Fawkes (published in USENIX Security 2020) claimed this privacy threat can be neutralized by uploading cloaked user images instead of their original images. In this paper, we present Oriole, a system that combines the advantages of data poisoning attacks and evasion attacks, to thwart the protection offered by Fawkes, by training the attacker face recognition model with multi-cloaked images generated by Oriole. Consequently, the face recognition accuracy of the attack model is maintained and the weaknesses of Fawkes are revealed. Experimental results show that our proposed Oriole system is able to effectively interfere with the performance of the Fawkes system to achieve promising attacking results. Our ablation study highlights multiple principal factors that affect the performance of the Oriole system, including the DSSIM perturbation budget, the ratio of leaked clean user images, and the numbers of multi-cloaks for each uncloaked image. We also identify and discuss at length the vulnerabilities of Fawkes. We hope that the new methodology presented in this paper will inform the security community of a need to design more robust privacy-preserving deep learning models.

cs.CR↗

arXiv2020

Neural Belief Reasoner

This paper proposes a new generative model called neural belief reasoner (NBR). It differs from previous models in that it specifies a belief function rather than a probability distribution. Its implementation consists of neural networks, fuzzy-set operations and belief-function operations, and query-answering, sample-generation and training algorithms are presented. This paper studies NBR in two tasks. The first is a synthetic unsupervised-learning task, which demonstrates NBR's ability to perform multi-hop reasoning, reasoning with uncertainty and reasoning about conflicting information. The second is supervised learning: a robust MNIST classifier for 4 and 9, which is the most challenging pair of digits. This classifier needs no adversarial training, and it substantially exceeds the state of the art in adversarial robustness as measured by the L2 metric, while at the same time maintains 99.1% accuracy on natural images.

cs.LG↗

arXiv2020

Joint Beamforming Design for IRS-Aided Communications with Channel Estimation Errors

This paper investigates the joint design of the beamforming scheme in intelligent reflecting surface (IRS) assisted multiuser (MU) multiple-input multiple-output (MIMO) downlink transmissions. Channel estimation errors associated with the minimum mean square error (MMSE) estimation are assumed and the weighted sum rate (WSR) is adopted as the performance metric. Low-resolution phase shifters (PSs) in practical implementations are taken into account as well. Under the constraint of the transmit power and discrete phase shifters (PSs), an optimization problem is formulated to maximize the WSR of all users. To obtain the optimal beamforming matrices at the IRS, two solutions based on the majorization-minimization (MM) and successive convex approximation (SCA) methods, respectively, are proposed. Through simulation results, both of the proposed two schemes achieve a significant improvement in WSR. Furthermore, the superiority of the SCA-based solution is demonstrated. Overall, two viable solutions to the joint beamforming design in IRS-aided MU-MIMO downlink communication systems with channel estimation errors are provided.

cs.IT↗

arXiv2020

Logical Neural Networks

We propose a novel framework seamlessly providing key properties of both neural nets (learning) and symbolic logic (knowledge and reasoning). Every neuron has a meaning as a component of a formula in a weighted real-valued logic, yielding a highly intepretable disentangled representation. Inference is omnidirectional rather than focused on predefined target variables, and corresponds to logical reasoning, including classical first-order logic theorem proving as a special case. The model is end-to-end differentiable, and learning minimizes a novel loss function capturing logical contradiction, yielding resilience to inconsistent knowledge. It also enables the open-world assumption by maintaining bounds on truth values which can have probabilistic semantics, yielding resilience to incomplete knowledge.

cs.AI↗

arXiv2020

Mimicking Full-Duplex Secure Communications for Buffer-Aided Multi-Relay Systems

This paper considers secure communication in buffer-aided cooperative wireless networks in the presence of one eavesdropper, which can intercept the data transmission from both the source and relay nodes. A new max-ratio relaying protocol is proposed, in which different relays are chosen for reception and transmission according to the ratio of the legitimate channels to the eavesdropper channels, so that the relay selected for reception and the relay selected for transmission can receive and transmit at the same time. It is worth noting that the relay employs a randomize-and-forward (RF) strategy such that the eavesdropper can only decode the signals received in the two hops independently. Theoretical analysis of the secrecy throughput of the proposed scheme is provided and the approximate closed-form expressions are derived, which are verified by simulations. Through numerical results, it is shown that the proposed scheme achieves a significant improvement in secrecy throughput compared with existing relay selection policies.

cs.IT↗

arXiv2020

Alternate Distributed Beamforming for Buffer-Aided Multi-Antenna Relay Systems

In this paper, link selection is investigated in half-duplex (HD) dual-hop cooperative systems with multiple antennas at the relays. Alternate distributed beamforming (ADB) scheme is revisited for buffer-aided multi-antenna relay systems, in which the relays are divided into two groups, with one group receiving the same information broadcast from the source and the other group transmitting the common messages to the destination via distributed beamforming in each time slot. It is worth noting that the relays used for reception and transmission are determined without the need of instantaneous channel state information (CSI). Theoretical analysis of the achievable throughput of the proposed scheme in Rayleigh fading is provided and the approximate closed-form expressions are derived. Simulation results are given to verify the theoretical analysis. Through numerical results, it is shown that compared with existing link selection policies, the fixed scheduling ADB scheme achieves a significant improvement in achievable throughput. It is also shown that for the ADB scheme, the throughput performance of increasing the number of antennas equipped at each relay is better than that of increasing the number of relays equipped with a single antenna when the total number of antennas at the relays is fixed.

cs.IT↗

arXiv2019

L2-Nonexpansive Neural Networks

This paper proposes a class of well-conditioned neural networks in which a unit amount of change in the inputs causes at most a unit amount of change in the outputs or any of the internal layers. We develop the known methodology of controlling Lipschitz constants to realize its full potential in maximizing robustness, with a new regularization scheme for linear layers, new ways to adapt nonlinearities and a new loss function. With MNIST and CIFAR-10 classifiers, we demonstrate a number of advantages. Without needing any adversarial training, the proposed classifiers exceed the state of the art in robustness against white-box L2-bounded adversarial attacks. They generalize better than ordinary networks from noisy data with partially random labels. Their outputs are quantitatively meaningful and indicate levels of confidence and generalization, among other desirable properties.

cs.AI↗

arXiv2016

A Proximity Measure using Blink Model

This paper proposes a new graph proximity measure. This measure is a derivative of network reliability. By analyzing its properties and comparing it against other proximity measures through graph examples, we demonstrate that it is more consistent with human intuition than competitors. A new deterministic algorithm is developed to approximate this measure with practical complexity. Empirical evaluation by two link prediction benchmarks, one in coauthorship networks and one in Wikipedia, shows promising results. For example, a single parameterization of this measure achieves accuracies that are 14-35% above the best accuracy for each graph of all predictors reported in the 2007 Liben-Nowell and Kleinberg survey.

cs.SI↗

arXiv2015

Broadbeam for Massive MIMO Systems

Massive MIMO has been identified as one of the promising disruptive air interface techniques to address the huge capacity requirement demanded by 5G wireless communications. For practical deployment of such systems, the control message need to be broadcast to all users reliably in the cell using broadbeam. A broadbeam is expected to have the same radiated power in all directions to cover users in any place in a cell. In this paper, we will show that there is no perfect broadbeam. Therefore, we develop a method for generating broadbeam that can allow tiny fluctuations in radiated power. Overall, this can serve as an ingredient for practical deployment of the massive MIMO systems.

cs.IT↗

arXiv2006

Stochastic Preconditioning for Iterative Linear Equation Solvers

This paper presents a new stochastic preconditioning approach. For symmetric diagonally-dominant M-matrices, we prove that an incomplete LDL factorization can be obtained from random walks, and used as a preconditioner for an iterative solver, e.g., conjugate gradient. It is argued that our factor matrices have better quality, i.e., better accuracy-size tradeoffs, than preconditioners produced by existing incomplete factorization methods. Therefore the resulting preconditioned conjugate gradient (PCG) method requires less computation than traditional PCG methods to solve a set of linear equations with the same error tolerance, and the advantage increases for larger and denser sets of linear equations. These claims are verified by numerical tests, and we provide techniques that can potentially extend the theory to more general types of matrices.

math.NA↗