Searcharxiv⌕ Search

arXiv subjects

Sumit Kumar Jha

Publications and source records attributed to Sumit Kumar Jha.

At least 37 records · Page 2Linked to original sources
arXiv2023

Neural Stochastic Differential Equations for Robust and Explainable Analysis of Electromagnetic Unintended Radiated Emissions

We present a comprehensive evaluation of the robustness and explainability of ResNet-like models in the context of Unintended Radiated Emission (URE) classification and suggest a new approach leveraging Neural Stochastic Differential Equations (SDEs) to address identified limitations. We provide an empirical demonstration of the fragility of ResNet-like models to Gaussian noise perturbations, where the model performance deteriorates sharply and its F1-score drops to near insignificance at 0.008 with a Gaussian noise of only 0.5 standard deviation. We also highlight a concerning discrepancy where the explanations provided by ResNet-like models do not reflect the inherent periodicity in the input data, a crucial attribute in URE detection from stable devices. In response to these findings, we propose a novel application of Neural SDEs to build models for URE classification that are not only robust to noise but also provide more meaningful and intuitive explanations. Neural SDE models maintain a high F1-score of 0.93 even when exposed to Gaussian noise with a standard deviation of 0.5, demonstrating superior resilience to ResNet models. Neural SDE models successfully recover the time-invariant or periodic horizontal bands from the input data, a feature that was conspicuously missing in the explanations generated by ResNet-like models. This advancement presents a small but significant step in the development of robust and interpretable models for real-world URE applications where data is inherently noisy and assurance arguments demand interpretable machine learning predictions.

cs.LG↗
arXiv2022

A Game-theoretic Understanding of Repeated Explanations in ML Models

This paper formally models the strategic repeated interactions between a system, comprising of a machine learning (ML) model and associated explanation method, and an end-user who is seeking a prediction/label and its explanation for a query/input, by means of game theory. In this game, a malicious end-user must strategically decide when to stop querying and attempt to compromise the system, while the system must strategically decide how much information (in the form of noisy explanations) it should share with the end-user and when to stop sharing, all without knowing the type (honest/malicious) of the end-user. This paper formally models this trade-off using a continuous-time stochastic Signaling game framework and characterizes the Markov perfect equilibrium state within such a framework.

cs.GT↗
arXiv2022

FAT-PIM: Low-Cost Error Detection for Processing-In-Memory

Processing In Memory (PIM) accelerators are promising architecture that can provide massive parallelization and high efficiency in various applications. Such architectures can instantaneously provide ultra-fast operation over extensive data, allowing real-time performance in data-intensive workloads. For instance, Resistive Memory (ReRAM) based PIM architectures are widely known for their inherent dot-product computation capability. While the performance of such architecture is essential, reliability and accuracy are also important, especially in mission-critical real-time systems. Unfortunately, the PIM architectures have a fundamental limitation in guaranteeing error-free operation. As a result, current methods must pay high implementation costs or performance penalties to achieve reliable execution in the PIM accelerator. In this paper, we make a fundamental observation of this reliability limitation of ReRAM based PIM architecture. Accordingly, we propose a novel solution--Falut Tolerant PIM or FAT-PIM, that can improve reliability for such systems significantly at a low cost. Our evaluation shows that we can improve the error tolerance significantly with only 4.9% performance cost and 3.9% storage overhead.

cs.AR↗
arXiv2021

An identity for $(-q^{5};\,q^{10})_{\infty}$

We prove that $$ \prod_{n=0}^{\infty}(1+q^{10n+5}) = \frac{\sum_{n=-\infty}^{\infty}q^{n^{2}}\, \sum_{n=-\infty}^{\infty}(-1)^{n}\, (-q)^{n(3n-1)/2}}{4\, \sum_{n\geq 0}(-q)^{\frac{n(n+1)}{2}}\sin \left\{\frac{(2n+1)3π}{10}\right\}\, \sum_{n\geq 0}(-q)^{\frac{n(n+1)}{2}}\sin \left\{\frac{(2n+1)π}{10}\right\}} \qquad |q|<1 $$ using identities due to Ramanujan.

math.GM↗
arXiv2021

Protein Folding Neural Networks Are Not Robust

Deep neural networks such as AlphaFold and RoseTTAFold predict remarkably accurate structures of proteins compared to other algorithmic approaches. It is known that biologically small perturbations in the protein sequence do not lead to drastic changes in the protein structure. In this paper, we demonstrate that RoseTTAFold does not exhibit such a robustness despite its high accuracy, and biologically small perturbations for some input sequences result in radically different predicted protein structures. This raises the challenge of detecting when these predicted protein structures cannot be trusted. We define the robustness measure for the predicted structure of a protein sequence to be the inverse of the root-mean-square distance (RMSD) in the predicted structure and the structure of its adversarially perturbed sequence. We use adversarial attack methods to create adversarial protein sequences, and show that the RMSD in the predicted protein structure ranges from 0.119Å to 34.162Å when the adversarial perturbations are bounded by 20 units in the BLOSUM62 distance. This demonstrates very high variance in the robustness measure of the predicted structures. We show that the magnitude of the correlation (0.917) between our robustness measure and the RMSD between the predicted structure and the ground truth is high, that is, the predictions with low robustness measure cannot be trusted. This is the first paper demonstrating the susceptibility of RoseTTAFold to adversarial attacks.

q-bio.BM↗
arXiv2021

CrossedWires: A Dataset of Syntactically Equivalent but Semantically Disparate Deep Learning Models

The training of neural networks using different deep learning frameworks may lead to drastically differing accuracy levels despite the use of the same neural network architecture and identical training hyperparameters such as learning rate and choice of optimization algorithms. Currently, our ability to build standardized deep learning models is limited by the availability of a suite of neural network and corresponding training hyperparameter benchmarks that expose differences between existing deep learning frameworks. In this paper, we present a living dataset of models and hyperparameters, called CrossedWires, that exposes semantic differences between two popular deep learning frameworks: PyTorch and Tensorflow. The CrossedWires dataset currently consists of models trained on CIFAR10 images using three different computer vision architectures: VGG16, ResNet50 and DenseNet121 across a large hyperparameter space. Using hyperparameter optimization, each of the three models was trained on 400 sets of hyperparameters suggested by the HyperSpace search algorithm. The CrossedWires dataset includes PyTorch and Tensforflow models with test accuracies as different as 0.681 on syntactically equivalent models and identical hyperparameter choices. The 340 GB dataset and benchmarks presented here include the performance statistics, training curves, and model weights for all 1200 hyperparameter choices, resulting in 2400 total models. The CrossedWires dataset provides an opportunity to study semantic differences between syntactically equivalent models across popular deep learning frameworks. Further, the insights obtained from this study can enable the development of algorithms and tools that improve reliability and reproducibility of deep learning frameworks. The dataset is freely available at https://github.com/maxzvyagin/crossedwires through a Python API and direct download link.

cs.LG↗
arXiv2020

An identity for the sum of inverses of odd divisors of $n$ in terms of the number of representations of $n$ as a sum of $r$ squares

Let $$\sum_{\substack{d|n\\ d\equiv 1 (2)}}\frac{1}{d}$$ denote the sum of inverses of odd divisors of a positive integer $n$, and let $c_{r}(n)$ be the number of representations of $n$ as a sum of $r$ squares where representations with different orders and different signs are counted as distinct. The aim is of this note is to prove the following interesting combinatorial identity: $$ \sum_{\substack{d|n\\ d\equiv 1 (2)}}\frac{1}{d}=\frac{1}{2}\,\sum_{r=1}^{n}\frac{(-1)^{n+r}}{r}\,\binom{n}{r}\, c_{r}(n). $$

math.GM↗
arXiv2020

An Extension of Fano's Inequality for Characterizing Model Susceptibility to Membership Inference Attacks

Deep neural networks have been shown to be vulnerable to membership inference attacks wherein the attacker aims to detect whether specific input data were used to train the model. These attacks can potentially leak private or proprietary data. We present a new extension of Fano's inequality and employ it to theoretically establish that the probability of success for a membership inference attack on a deep neural network can be bounded using the mutual information between its inputs and its activations. This enables the use of mutual information to measure the susceptibility of a DNN model to membership inference attacks. In our empirical evaluation, we show that the correlation between the mutual information and the susceptibility of the DNN model to membership inference attacks is 0.966, 0.996, and 0.955 for CIFAR-10, SVHN and GTSRB models, respectively.

cs.LG↗
arXiv2020

Quantifying Membership Inference Vulnerability via Generalization Gap and Other Model Metrics

We demonstrate how a target model's generalization gap leads directly to an effective deterministic black box membership inference attack (MIA). This provides an upper bound on how secure a model can be to MIA based on a simple metric. Moreover, this attack is shown to be optimal in the expected sense given access to only certain likely obtainable metrics regarding the network's training and performance. Experimentally, this attack is shown to be comparable in accuracy to state-of-art MIAs in many cases.

cs.LG↗
arXiv2020

A formula for the $r$-coloured partition function in terms of the sum of divisors function and its inverse

Let $p_{-r}(n)$ denote the $r$-coloured partition function, and $σ(n)=\sum_{d|n}d$ denote the sum of positive divisors of $n$. The aim of this note is to prove the following $$ p_{-r}(n)=θ(n)+\,\sum_{k=1}^{n-1}\frac{r^{k+1}}{(k+1)!} \sum_{α_1\,= k}^{n-1} \, \sum_{α_2\,= k-1}^{α_1-1} \cdots \sum_{α_k\, = 1}^{α_{k-1}-1}θ(n-α_1) θ(α_1 -α_2) \cdots θ(α_{k-1}-α_k) θ(α_k) $$ where $θ(n)=n^{-1}\, σ(n)$, and its inverse $$σ(n) = n\,\sum_{r=1}^n \frac{(-1)^{r-1}}{r}\, \binom{n}{r}\, p_{-r}(n). $$

math.GM↗