The arms race between attacks and defenses for machine learning models has come to a forefront in recent years, in both the security community and the privacy community. However, one big limitation ...of previous research is that the security domain and the privacy domain have typically been considered separately. It is thus unclear whether the defense methods in one domain will have any unexpected impact on the other domain. In this paper, we take a step towards resolving this limitation by combining the two domains. In particular, we measure the success of membership inference attacks against six state-of-the-art defense methods that mitigate the risk of adversarial examples (i.e., evasion attacks). Membership inference attacks determine whether or not an individual data record has been part of a model's training set. The accuracy of such attacks reflects the information leakage of training algorithms about individual members of the training set. Adversarial defense methods against adversarial examples influence the model's decision boundaries such that model predictions remain unchanged for a small area around each input. However, this objective is optimized on training data. Thus, individual data records in the training set have a significant influence on robust models. This makes the models more vulnerable to inference attacks. To perform the membership inference attacks, we leverage the existing inference methods that exploit model predictions. We also propose two new inference methods that exploit structural properties of robust models on adversarially perturbed data. Our experimental evaluation demonstrates that compared with the natural training (undefended) approach, adversarial defense methods can indeed increase the target model's risk against membership inference attacks. When using adversarial defenses to train the robust models, the membership inference advantage increases by up to 4.5 times compared to the naturally undefended models. Beyond revealing the privacy risks of adversarial defenses, we further investigate the factors, such as model capacity, that influence the membership information leakage.
Process modeling and optimization of polymerization processes with long chain branching is currently an area of extensive research owing to the advantages and growing popularity of branched polymers. ...The highly complex nature of these reaction networks results in a large set of stiff ordinary differential equations to model them mathematically with adequate precision and accuracy. In such a scenario, where execution time of the model is expensive, the idea of going for online optimization and control of such processes seems to be a near impossible task. Catering these problems in the ongoing research, optimization using surrogate model obtained from a novel algorithm is proposed in this work as a solution. A Sobol set assisted artificial neural network replaces the computationally expensive kinetic model of long chain branched poly vinyl acetate as the fast and efficient surrogate model. The proposed multi-objective methodology allows the computationally expensive first principle model to determine the configuration of the neural network, which can emulate it with maximum accuracy along with sample size required. The algorithm introduces a logical way of designing ANN architectures where the outperformance of multiple layer networks justifies the elimination of heuristics approach to consider only single layer. The results of the proposed algorithm are compared with the results obtained using Kriging interpolator based another surrogate approach, for testing, validation and scope of improvement. The use of fast and efficient Sobol assisted ANN surrogate model makes the optimization process ~10 times more efficient as compared to the case of optimization with computationally expensive kinetic model. The proposed ANN based surrogate is nearly 1.5 times as efficient as Kriging model in terms of number of expensive function evaluations.
•Intelligently designed Sobol-ANN: A step towards online optimization of PVAc-LCB.•Configuration of parsimonious Sobol-ANN obtained using novel MOOP formulation.•Novel algorithm eliminates heuristic based bias towards monolayer perceptron NN.•Parameter free ANN designing algorithm: requires only the model data as input.•Sobol-ANN surrogate reduces 90% function evaluations; 1.5 times faster than KI.
Full text
Available for:
GEOZS, IJS, IMTLJ, KILJ, KISLJ, NUK, OILJ, PNG, SAZU, SBCE, SBJE, UL, UM, UPCLJ, UPUK, ZRSKP
Website Fingerprinting in the Age of QUIC Smith, Jean-Pierre; Mittal, Prateek; Perrig, Adrian
Proceedings on Privacy Enhancing Technologies,
04/2021, Volume:
2021, Issue:
2
Journal Article
Peer reviewed
Open access
With the meteoric rise of the QUIC protocol, the supremacy of TCP as the de facto transport protocol underlying web traffic will soon cease. HTTP/3, the next version of the HTTP protocol, will not ...support TCP. Current website-fingerprinting literature has ignored the introduction of this new protocol to all modern browsers. In this work, we investigate whether classifiers trained in the TCP setting generalise to QUIC traces, whether QUIC is inherently more difficult to fingerprint than TCP, how feature importance changes between these protocols, and how to jointly classify QUIC and TCP traces. Experiments using four state-of-theart website-fingerprinting classifiers and our combined QUIC-TCP dataset of ~117,000 traces show that while QUIC is not inherently more difficult to fingerprint than TCP, TCP-trained classifiers may fail to detect up to 96% of QUIC visits to monitored URLs. Furthermore, classifiers that take advantage of the common information between QUIC and TCP traces for the same URL may outperform ensembles of protocol-specific classifiers in limited data settings.
Optical encryption, key generation, and optical stealth transmission techniques for protecting the privacy of communication in optical networks are proposed and summarized. The signal processing ...methods based on fiber components provide ways to encrypt data and generate encryption keys at the speed of data transmission in optical fibers. Private and confidential communication is achieved without compromising the capacity and bandwidth of the optical network. Optical stealth transmission can hide the signal in plain sight. Because an eavesdropper can neither read the data nor detect the existence of the transmitted signal, optical stealth transmission provides a higher level of privacy. A hybrid system which includes both the public channels and stealth channels can effectively provide anonymous communication and defend against traffic analysis.
Variations in wind states are generally ignored while designing the wind farm layouts. As a result, given the highly uncertain nature of wind the ability of the wind farms to produce power on a ...sustained basis gets severely affected in the long run. In this study, a robust optimization methodology has been proposed and successfully adopted to design wind farm layouts (optimum number and location of wind turbines) that are immune to varying wind state conditions. Assuming different realizations of wind state uncertainty distributions of wind speeds and directions, the proposed methodology provides uncertainty resilient robust solutions for the conservative worst case and the optimistic best case situations by adopting maximum and minimum extent of variations in uncertain parameters, respectively. Additionally, the flexibility introduced in the formulation enables a designer to create solution anywhere between these two extremes. This set of robust solutions provide with a realistic envelope for the farm performance parameters under uncertainty helping meeting the guaranteed service levels. It has been observed that the turbine layout corresponds to the worst case can produce an average of ∼49% more power than the guaranteed value and provide with 100% success rate on meeting the service levels under changing wind conditions. Representing the wind farm by uniform set of coarse grids initially, need based grids of variable resolution along with novel repair operator are adopted to generate Pareto solutions for the multi-objective cost-power trade-off problem. The proposed grid based technique is validated against other techniques of no-grid and grid with fixed resolution and improvements of ∼9.0% in power production and ∼1.7% in the ratio of cost and power can be seen. Furthermore, improvements of 75.7% in produced power as compared to rigorously explored benchmark case study and 1–10% in cost to power ratio compared to other techniques presented in literature, show the merits of the proposed technique.
Display omitted
•Robust optimization of power-cost-reliability trade-off objectives studied.•Novel formulation provides robust layouts with flexible levels of uncertainty.•Variable resolution grid based methodology adopted to find an efficient solution.•Pros of adopting robust worst case immune to all uncertain scenarios demonstrated.•Superiority of the proposed approach established using benchmark case study.
Full text
Available for:
GEOZS, IJS, IMTLJ, KILJ, KISLJ, NLZOH, NUK, OILJ, PNG, SAZU, SBCE, SBJE, UL, UM, UPCLJ, UPUK, ZRSKP
A novel suite of algorithms, exploiting the concept of Space And Variable decomposition based Evolutionary (SAVE) formulations, has been proposed while addressing the wind farm micro-siting. The ...efficacies of these algorithms are further enhanced by designing novel repair strategies for the evolutionary operators and adopting intermediate rejuvenation of solution pool with fresh seeding. Optimal placement of wind turbines towards achieving the target of maximization of power (in kW) and minimization of cost avoiding wake effects has been approached through the multi-objective cost-power formulation. Significant improvements in the power production (61–70%) and cost to power ratio (∼14%) have been recorded not only as compared to the most popular benchmark case study reported in the literature, but also as compared to many other improved results reported on the same case study. The decomposition based approaches have been demonstrated to provide better quality Pareto fronts, in terms of uniformity of spread as well as the convergence of the solutions, over their continuous variable solution methodologies. Moreover, the use of repair strategy helped to improve solution quality to the tune of 9% improvement in generated power on another realistic case study as compared to the case when repair is not used. The approach is extremely generic and can be applied to other optimization problems of interest.
•Decomposition based strategy has been adopted for solving complex micro-siting problems.•Repair strategy and intermediate rejuvenation assisted evolutionary algorithms were proposed for enhanced search.•Results report better cost-power ratio for the most popular benchmark case study.•Proposed grid based approach provided consistently better results than the no-grid approach.
Full text
Available for:
GEOZS, IJS, IMTLJ, KILJ, KISLJ, NLZOH, NUK, OILJ, PNG, SAZU, SBCE, SBJE, UL, UM, UPCLJ, UPUK, ZRSKP
State-of-the-art object detectors are vulnerable to localized patch hiding attacks, where an adversary introduces a small adversarial patch to make detectors miss the detection of salient objects. ...The patch attacker can carry out a physical-world attack by printing and attaching an adversarial patch to the victim object; thus, it imposes a challenge for the safe deployment of object detectors. In this paper, we propose DetectorGuard as the first general framework for building provably robust object detectors against localized patch hiding attacks. DetectorGuard is inspired by recent advancements in robust image classification research; we ask: can we adapt robust image classifiers for robust object detection? Unfortunately, due to their task difference, an object detector naively adapted from a robust image classifier 1) may not necessarily be robust in the adversarial setting or 2) even maintain decent performance in the clean setting. To address these two issues and build a high-performance robust object detector, we propose an objectness explaining strategy: we adapt a robust image classifier to predict objectness (i.e., the probability of an object being present) for every image location and then explain each objectness using the bounding boxes predicted by a conventional object detector. If all objectness is well explained, we output the predictions made by the conventional object detector; otherwise, we issue an attack alert. Notably, our objectness explaining strategy enables provable robustness for "free": 1) in the adversarial setting, we formally prove the end-to-end robustness of DetectorGuard on certified objects, i.e., it either detects the object or triggers an alert, against any patch hiding attacker within our threat model; 2) in the clean setting, we have almost the same performance as state-of-the-art object detectors. Our evaluation on the PASCAL VOC, MS COCO, and KITTI datasets further demonstrates that DetectorGuard achieves the first provable robustness against localized patch hiding attacks at a negligible cost (< 1%) of clean performance.
Over the last decade, differential privacy (DP) has emerged as the gold standard of a rigorous and provable privacy framework. However, there are very few practical guidelines on how to apply ...differential privacy in practice, and a key challenge is how to set an appropriate value for the privacy parameter ɛ. In this work, we employ a statistical tool called
for discovering useful and interpretable guidelines for the state-of-the-art privacy-preserving frameworks. We formalize and implement hypothesis testing in terms of an adversary’s capability to infer mutually exclusive sensitive information about the input data (such as whether an individual has participated or not) from the output of the privacy-preserving mechanism. We quantify the success of the hypothesis testing using the
, which provides an interpretable and natural guideline for practitioners and researchers on selecting ɛ. Our key results include a quantitative analysis of how hypothesis testing can guide the choice of the privacy parameter ɛ in an interpretable manner for a differentially private mechanism and its variants. Importantly, our findings show that an adversary’s auxiliary information - in the form of prior distribution of the database and correlation across records and time - indeed influences the proper choice of ɛ. Finally, we also show how the perspective of hypothesis testing can provide useful insights on the relationships among a broad range of privacy frameworks including differential privacy, Pufferfish privacy, Blowfish privacy, dependent differential privacy, inferential privacy, membership privacy and mutual-information based differential privacy.
Wind energy is running well ahead of its peers to deal with the demand–supply and environmental crisis due to fossil fuels. However, continuous exploitation of land led wind farms built in close ...proximity of dwellings of human beings, restricted zones, causing adverse effect on health and the environment. In this work, using a widely used model for wake and acoustic model (ISO‐9613‐2), the optimal number and locations of turbines in a farm has been determined while meeting several conflicting objectives such as noise propagation, energy, and cost. An index‐based decomposition and repair strategy (iDRS) using different indices for grid locations and performing repair on chromosomes to enhance the performance of convergence has been proposed as solution methodology. Comparing with a well‐established case study, the methodology is applied next to another realistic case, where the effects of the presence of practical constraints on the optimal layout are demonstrated. A designer can select a layout from several choices from the obtained Pareto set of solutions based on the permissible noise limits, cost obligations, and the extent of harnessed energy.
Full text
Available for:
FZAB, GIS, IJS, KILJ, NLZOH, NUK, OILJ, SAZU, SBCE, SBMB, UL, UM, UPUK
PDF
