Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

Deep Learning Model Security: Threats and Defenses

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A survey of deep learning model security identifies four recurring threat classes—adversarial examples, data poisoning, model theft, and privacy leakage—and pairs each with concrete defenses and PyTorch implementations.

desk verdict A beginner-friendly but uneven survey; the flagship adversarial-training snippet crashes, and the promised CW chapter never appears. read the letter →

arxiv 2412.08969 v2 pith:2LIXIRM5 submitted 2024-12-12 cs.CR cs.LGcs.SE

Tianyang Wang , Ziqian Bi , Yichao Zhang , Ming Liu , Weiche Hsieh , Pohsun Feng , Lawrence K.Q. Yan , Yizhu Wen
show 19 more authors
Benji Peng Junyu Liu Keyu Chen Sen Zhang Ming Li Chuanqi Jiang Xinyuan Song Junjie Yang Bowen Jing Jintao Ren Junhao Song Hong-Ming Tseng Silin Chen Yunze Wang Chia Xin Liang Jiawei Xu Xuanhe Pan Jinlang Wang Qian Niu
This is my paper · ORCID
classification cs.CRcs.LGcs.SE
keywords deeplearningsecurityadversarialexamplesdatapoisoningmodeltheftprivacyleakagebackdoorattacksdifferentialfederated
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This survey argues that deep learning systems face a recurring set of security failures—adversarial examples, data poisoning, model theft, and privacy leakage—and that each can be countered with families of defenses. The authors map each threat to its mechanism, walk through PyTorch implementations of attacks such as FGSM, PGD, the Carlini-Wagner attack, label flipping, and backdoors, and pair them with defenses such as adversarial training, differential privacy, federated learning, and contrastive or self-supervised representation learning. A sympathetic reader should come away seeing model security as a design dimension with measurable trade-offs rather than a single patchable vulnerability.

What carries the argument

The organizing device is a paired taxonomy: each attack chapter describes the mechanism of an attack and then the same threat reappears as a defense target, with PyTorch code as the common notation. Named mechanisms include the Fast Gradient Sign Method and Projected Gradient Descent for gradient-based adversarial examples, the Carlini-Wagner optimization formulation, label flipping as a form of data poisoning, BadNet-style trigger injection for backdoors, and membership inference for privacy leakage. The code demonstrations carry the practical argument, showing that attacks and defenses are not abstract but implementable operations on tensors and gradients.

What would settle it

Train a clean binary classifier on separable data, flip 10% of the labels as the paper describes, and measure test accuracy; if accuracy does not drop, the paper's account of label-flipping poisoning is contradicted. Implementing the Section 16.2.1 adversarial-training loop exactly as printed will fail because data.grad is accessed before requires_grad is set.

Watch

Extended reading notes

Core claim

The paper's central claim is that four threat classes—adversarial manipulation, data poisoning, model theft, and privacy leakage—capture most of what can go wrong with a deployed deep learning model, and that defenses exist at each stage of the model life cycle: cleaning and robust training for data, adversarial training and input filtering for inference, API control and output noising for interface abuse, and differential privacy and federated learning for data confidentiality. The account also identifies backdoor attacks as a cross-cutting poisoning-plus-trigger mechanism and presents contrastive and self-supervised learning as emerging robustness tools. Read in good faith, the paper is a threat-and-defense map with examples written to be reproducible.

Load-bearing premise

The load-bearing premise is that the included PyTorch snippets actually run as demonstrations, so a reader with the code can reproduce the attacks and defenses described.

Editorial extensions

If this is right

  • If adversarial training, noise injection, and detection are used together, gradient-based adversarial examples become harder to craft against a deployed model.
  • Differential privacy and federated learning, applied in combination, can bound what an attacker learns about whether a specific record was in the training set.
  • API rate limiting, randomized outputs, and encrypted weights make black-box and white-box model theft more costly for the attacker.
  • Backdoor triggers can be caught by activation and input anomaly analysis, so a model can be screened before deployment.
  • Performance and security trade off against each other; no single defense covers all threat classes.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that the same taxonomy could become a routine security checklist: evaluate any new model against adversarial examples, poisoning, theft, and leakage before deployment.
  • A natural extension is to combine the listed defenses into benchmark suites that compare attacks and defenses under fixed threat models, something the survey describes only in outline.
  • Given the survey's emphasis on automated defenses and zero-trust architectures, its direction points to treating security as a continuous property of the deployment environment rather than a fixed property of the model.
  • The practical chapters need one correction to hold up as written: the adversarial-training example in Section 16.2.1 reads data.grad without setting data.requires_grad=True, so the snippet as printed would crash; this is an editorial check, not a criticism of the survey's taxonomy.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper is a broad survey of deep learning model security, covering adversarial examples, data poisoning, model stealing, privacy leakage, backdoor attacks, and corresponding defenses, with many PyTorch code examples. The first parts provide background on deep learning and PyTorch and a taxonomy of threats; later parts contain practical implementation chapters for attacks and defenses; final chapters discuss future directions such as automated defenses and zero-trust architectures. The contribution is primarily educational/survey-style and does not present new empirical results or formal analysis.

Significance. If its practical code were correct and complete, this survey could serve as a useful introductory map of the field for practitioners: the high-level threat taxonomy (adversarial examples, poisoning, model theft, privacy leakage, backdoors) and the standard defense families (adversarial training, differential privacy, federated learning, detection/filtering) are broadly consistent with the literature. However, the paper's distinctive value proposition—practical, runnable implementations—is undermined by a crash in the flagship adversarial-training code, a promised Carlini & Wagner implementation that never appears, a model-inversion 'demonstration' that does not implement inversion, and at least one conceptually incorrect defense. The code is not reproducible in its current form, and the survey lacks systematic comparison or critical synthesis. The conceptual outline is defensible, but the practical chapters need substantial repair.

major comments (4)
  1. [Section 16.2.1] In train_adversarial, the input tensor data is never assigned requires_grad=True before loss.backward() is called, so data.grad is None and the line data_grad = data.grad.data raises AttributeError on the first batch. This is not a typo in an auxiliary snippet: §16.2.1 is the paper's main demonstration of adversarial training, and the surrounding text says the model 'is updated using both clean and adversarial examples.' The fix is to set data.requires_grad = True before the clean forward pass (as is correctly done in §16.1.1 and §16.1.2). Additionally, the code does not call optimizer.zero_grad() between the clean backward pass and the adversarial backward pass, so gradients from the clean example and the adversarial example accumulate before optimizer.step(); if the intended update is the sum of the two losses, the code should state this, and if not, a zero_grad is needed. The printed loss also refers to the clean loss, not the adversarial loss, which misreports training progress.
  2. [Section 16.1.3] The section is titled 'Carlini & Wagner (CW) Attack' and the chapter introduction lists CW as one of three methods that will be implemented, but the body states, 'Implementing the CW attack is more complex and beyond the scope of this chapter. We will cover this attack in more detail in a later chapter.' No later chapter provides the promised implementation, and the abstract's claim of 'practical implementations' of adversarial examples is therefore only partially fulfilled. Either provide a CW implementation (or a clear pointer to where it is implemented) or remove the promise from the introduction and abstract.
  3. [Section 19.1.3] The subsection is titled 'Demonstrating Model Inversion Attack,' but the code only defines and trains a simple CNN on MNIST; no inversion procedure is implemented or demonstrated. The chapter title, 'Privacy Leakage Attack Implementations,' is not satisfied by the material presented: the reader never sees an actual reconstruction attempt or membership-inference experiment. Add a real inversion or membership-inference demonstration, or revise the chapter title/section title to reflect that the code only builds the victim model.
  4. [Section 17.2.2] The proposed robust-training defense replaces the binary cross-entropy loss with nn.SmoothL1Loss (Huber loss), but Huber loss is designed for regression, not classification. The model uses a sigmoid output and binary labels, so minimizing a regression loss between a probability-like output and 0/1 labels is not a principled label-noise-robust classification loss, and the text's claim that this 'helps reduce the influence of outliers (including poisoned data)' is not supported. A robust classification loss, such as a trimmed loss, generalized cross-entropy, or a loss derived from label-noise models, should be used instead.
minor comments (5)
  1. [Section 16.2.1] The progress-report line prints loss.item() after the adversarial backward pass, but loss is the clean-batch loss; it should print loss_adv.item() (or a combined loss) to report the value that was actually used for the adversarial update.
  2. [Section 13.1.1] In train_with_differential_privacy, the parameter epsilon is accepted but never used; the noise scale is fixed by the module-level NOISE_STD. Either use epsilon to control the privacy budget/noise scale or remove the parameter to avoid implying a dependence.
  3. [Section 15.1.1] The contrastive_loss function computes a batch-wide softmax over cosine similarities rather than a standard InfoNCE loss with explicit positive pairs; as written, the denominator sums over all samples in the batch, which is not a properly normalized contrastive objective. The code and the textual description of pulling positive pairs together while pushing negatives apart do not fully agree.
  4. [Section 10.4.1] The adversarial-example detector returns a batch-level mean of per-sample differences and compares it to 0.5; this is a very coarse heuristic and should be labeled as a toy illustration, not a recommended detection method, since a single anomalous sample will be diluted by the batch.
  5. [Multiple practice chapters] Several code snippets are not runnable as printed because they depend on undefined variables or use incorrect API calls: for example, Section 11.3.1 attempts torch.tensor(cipher.decrypt(v)) on bytes without np.frombuffer, and Section 13.2.1 refers to clients as a list without defining it, while Section 18.1.2 uses images.numpy() under a no_grad context that may be on the wrong device. The paper should either present these as pseudocode with explicit warnings or supply complete, runnable examples.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the survey summarizes external threats and defenses and derives no quantities from fitted parameters or self-referential definitions.

full rationale

This manuscript is a tutorial survey of deep learning security threats and defenses. It contains no derivation chain, no fitted parameters, and no prediction that is statistically forced by construction. Concepts such as FGSM, PGD, adversarial training, differential privacy, and backdoor attacks are presented with citations to external literature and with illustrative PyTorch snippets; none of the presented equations defines a claimed output in terms of itself, and no load-bearing argument reduces to a self-citation. The only notable technical defect found, the adversarial-training snippet in Section 16.2.1 reading data.grad without first setting data.requires_grad = True, is a code-correctness issue rather than a circularity pattern, since the surrounding attack implementations in Sections 1.6.1, 5.2.1, and 16.1.1 correctly enable gradient tracking. Because the central claim is simply accurate mapping of existing threats and defenses onto external sources, the circularity burden is effectively zero.

Assumptions & free parameters 0 free parameters · 2 assumptions · 0 invented entities

No free parameters or invented entities exist in this survey. The two axioms capture the load-bearing background assumptions: accurate representation of external work and runnable code. The paper introduces no equations with fitted constants and no new objects.

assumptions (2)
  • domain assumption The external prior work summarized in this survey is accurately represented.
    A survey's value depends on faithfully rendering cited results; no attempt is made to verify these.
  • ad hoc to paper The provided PyTorch code snippets are runnable demonstrations of the described attacks and defenses.
    Practical chapters rely on the snippets working; Section 16.2.1 violates this by reading data.grad without enabling requires_grad.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Deep Learning Model Security: Threats and Defenses." pith.science (2026). https://pith.science/paper/2LIXIRM5

@misc{pith2026241208969,
  author       = {Pith},
  title        = {Pith review of: Deep Learning Model Security: Threats and Defenses},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2LIXIRM5}},
  note         = {Machine review of arXiv:2412.08969}
}
read the original abstract

Deep learning has transformed AI applications but faces critical security challenges, including adversarial attacks, data poisoning, model theft, and privacy leakage. This survey examines these vulnerabilities, detailing their mechanisms and impact on model integrity and confidentiality. Practical implementations, including adversarial examples, label flipping, and backdoor attacks, are explored alongside defenses such as adversarial training, differential privacy, and federated learning, highlighting their strengths and limitations. Advanced methods like contrastive and self-supervised learning are presented for enhancing robustness. The survey concludes with future directions, emphasizing automated defenses, zero-trust architectures, and the security challenges of large AI models. A balanced approach to performance and security is essential for developing reliable deep learning systems.

Figures

Figures reproduced from arXiv: 2412.08969 by the authors.

Figure 5.1
Figure 5.1. Adversarial Attack Demonstration 5.1.2 How Are Adversarial Examples Created? Adversarial examples are created by applying small, carefully calculated perturbations to the input data. The goal is to manipulate the model’s prediction while ensuring that the modifications to the input remain minimal. This can be achieved through various optimization techniques, some of which we’ll explore in detail in this chapter. The… view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. FedCausal-Dyn: A Causal-Dynamic Paradigm for Federated Learning under Dynamic Feature Drift

    cs.LG 2026-06 conditional novelty 4.0 of 10

    A federated framework that adversarially separates causal vs. spurious features, reliability-weights class prototypes, and contrastively aligns them, reporting SOTA accuracy on Office-10, Digits, and PACS.

Reference graph

Works this paper leans on

84 extracted references · 50 canonical work pages · cited by 1 Pith paper

  1. [1]

    Deep learning.nature, 521(7553):436–444, 2015

    Y ann LeCun, Y oshua Bengio, and Geoffrey Hinton. Deep learning.nature, 521(7553):436–444, 2015

    2015

  2. [2]

    MIT Press, 2016

    Ian Goodfellow, Y oshua Bengio, and Aaron Courville.Deep Learning. MIT Press, 2016

    2016

  3. [3]

    Deep learning , volume 1

    Y oshua Bengio, Ian Goodfellow, and Aaron Courville. Deep learning , volume 1. MIT press Cambridge, MA, USA, 2017

    2017

  4. [4]

    Atoms of recognition in human and computer vision

    Shimon Ullman, Liav Assif, Ethan Fetaya, and Daniel Harari. Atoms of recognition in human and computer vision. Proceedings of the National Academy of Sciences, 113(10):2744–2749, 2016

    2016

  5. [5]

    Understanding natural language

    Terry Winograd. Understanding natural language. Cognitive psychology, 3(1):1–191, 1972

    1972

  6. [6]

    Playing games

    J Patrick Williams. Playing games. In Popular Culture as Everyday Life, pages 115–124. Rout- ledge, 2015

    work page 2015

  7. [7]

    An introduction to Python

    Guido Van Rossum and Fred L Drake. An introduction to Python. Network Theory Ltd. Bristol, 2003

    work page 2003

  8. [8]

    Pytorch: An imperative style, high-performance deep learning library

    Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems, 32, 2019

    2019

Show all 84 references
  1. [9]

    Deep learning using rectified linear units (relu)

    AF Agarap. Deep learning using rectified linear units (relu). arXiv preprint arXiv:1803.08375 , 2018

    2018 arXiv

  2. [10]

    Stochastic gradient descent tricks

    Léon Bottou. Stochastic gradient descent tricks. In Neural Networks: Tricks of the Trade: Second Edition, pages 421–436. Springer, 2012

    2012

  3. [11]

    Deep learning and machine learning – object detection and semantic segmentation: From theory to applications

    Jintao Ren, Ziqian Bi, Qian Niu, Junyu Liu, Benji Peng, Sen Zhang, Xuanhe Pan, Jinlang Wang, Keyu Chen, Caitlyn Heqi Yin, Pohsun Feng, Yizhu Wen, Tianyang Wang, Silin Chen, Ming Li, Jiawei Xu, and Ming Liu. Deep learning and machine learning – object detection and semantic seg...

  4. [12]

    Deep learning and machine learning – python data structures and math- ematics fundamental: From theory to practice

    Silin Chen, Ziqian Bi, Junyu Liu, Benji Peng, Sen Zhang, Xuanhe Pan, Jiawei Xu, Jinlang Wang, Keyu Chen, Caitlyn Heqi Yin, Pohsun Feng, Yizhu Wen, Tianyang Wang, Ming Li, Jintao Ren, Qian Niu, and Ming Liu. Deep learning and machine learning – python data structures and math- ...

  5. [13]

    Review on methods to fix number of hidden neurons in neural networks

    K Gnana Sheela and Subramaniam N Deepa. Review on methods to fix number of hidden neurons in neural networks. Mathematical problems in engineering, 2013(1):425740, 2013

    2013

  6. [14]

    The influence of the sigmoid function parameters on the speed of backpropagation learning

    Jun Han and Claudio Moraga. The influence of the sigmoid function parameters on the speed of backpropagation learning. In International workshop on artificial neural networks, pages 195–

  7. [15]

    Learning both weights and connections for efficient neural network

    Song Han, Jeff Pool, John Tran, and William Dally. Learning both weights and connections for efficient neural network. Advances in neural information processing systems, 28, 2015

    2015

  8. [16]

    Deep learning, machine learning – digital signal and image processing: From theory to application

    Weiche Hsieh, Ziqian Bi, Junyu Liu, Benji Peng, Sen Zhang, Xuanhe Pan, Jiawei Xu, Jinlang Wang, Keyu Chen, Caitlyn Heqi Yin, Pohsun Feng, Yizhu Wen, Tianyang Wang, Ming Li, Jintao Ren, Qian Niu, Silin Chen, and Ming Liu. Deep learning, machine learning – digital signal and ima...

  9. [17]

    Adversarial attacks on neural network policies

    Sandy Huang, Nicolas Papernot, Ian Goodfellow, Y an Duan, and Pieter Abbeel. Adversarial attacks on neural network policies. arXiv preprint arXiv:1702.02284, 2017

    2017 arXiv

  10. [18]

    Certified defenses for data poisoning attacks

    Jacob Steinhardt, Pang Wei W Koh, and Percy S Liang. Certified defenses for data poisoning attacks. Advances in neural information processing systems, 30, 2017

    2017

  11. [19]

    Ensemble machine learning models for the detection of energy theft

    Sravan Kumar Gunturi and Dipu Sarkar. Ensemble machine learning models for the detection of energy theft. Electric Power Systems Research, 192:106904, 2021

    2021

  12. [20]

    Fast gradient non-sign methods

    Y aya Cheng, Jingkuan Song, Xiaosu Zhu, Qilong Zhang, Lianli Gao, and Heng Tao Shen. Fast gradient non-sign methods. arXiv preprint arXiv:2110.12734, 2021

    2021 arXiv

  13. [21]

    Model inversion attacks that exploit confidence information and basic countermeasures

    Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pages 1322–1333, 2015

    2015

  14. [22]

    A survey on data poisoning attacks and defenses

    Jiaxin Fan, Qi Y an, Mohan Li, Guanqun Qu, and Y ang Xiao. A survey on data poisoning attacks and defenses. In2022 7th IEEE International Conference on Data Science in Cyberspace (DSC), pages 48–55. IEEE, 2022

    2022

  15. [23]

    Sagar Imambi, Kolla Bhanu Prakash, and G. R. Kanagachidambaresan. Pytorch. In Program- ming with TensorFlow: Solution for Edge Computing Applications , pages 87–104. Springer, 2021

    2021

  16. [24]

    Securing large language models: Addressing bias, misinformation, and prompt attacks

    Benji Peng, Keyu Chen, Ming Li, Pohsun Feng, Ziqian Bi, Junyu Liu, and Qian Niu. Securing large language models: Addressing bias, misinformation, and prompt attacks. arXiv, 2409.08087, 2024

    2024

  17. [25]

    Deep learning and machine learning with gpgpu and cuda: Unlocking the power of parallel computing

    Ming Li, Ziqian Bi, Tianyang Wang, Yizhu Wen, Qian Niu, Junyu Liu, Benji Peng, Sen Zhang, Xuanhe Pan, Jiawei Xu, Jinlang Wang, Keyu Chen, Caitlyn Heqi Yin, Pohsun Feng, and Ming Liu. Deep learning and machine learning with gpgpu and cuda: Unlocking the power of parallel comput...

  18. [26]

    Deep learning and machine learning, advancing big data analytics and management: Unveiling BIBLIOGRAPHY 173 ai’s potential through tools, techniques, and applications

    Pohsun Feng, Ziqian Bi, Yizhu Wen, Xuanhe Pan, Benji Peng, Ming Liu, Jiawei Xu, Keyu Chen, Junyu Liu, Caitlyn Heqi Yin, Sen Zhang, Jinlang Wang, Qian Niu, Ming Li, and Tianyang Wang. Deep learning and machine learning, advancing big data analytics and management: Unveiling BIB...

  19. [27]

    Fashion-mnist: a novel image dataset for bench- marking machine learning algorithms

    Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for bench- marking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017

    2017 arXiv

  20. [28]

    Deep learning based vulnerability detection: Are we there yet? IEEE Transactions on Software Engineering , 48(9):3280–3296, 2021

    Saikat Chakraborty, Rahul Krishna, Y angruibo Ding, and Baishakhi Ray. Deep learning based vulnerability detection: Are we there yet? IEEE Transactions on Software Engineering , 48(9):3280–3296, 2021

    2021

  21. [29]

    An empirical study of deep learning models for vulnerability detection

    Benjamin Steenhoek, Md Mahbubur Rahman, Richard Jiles, and Wei Le. An empirical study of deep learning models for vulnerability detection. In 2023 IEEE/ACM 45th International Confer- ence on Software Engineering (ICSE), pages 2237–2248. IEEE, 2023

    2023

  22. [30]

    Shallow or deep? an empirical study on detecting vulnerabilities using deep learning

    Alejandro Mazuera-Rozo, Anamaria Mojica-Hanke, Mario Linares-Vásquez, and Gabriele Bavota. Shallow or deep? an empirical study on detecting vulnerabilities using deep learning. In 2021 IEEE/ACM 29th International Conference on Program Comprehension (ICPC) , pages 276–287. IEEE, 2021

    2021

  23. [31]

    Adversarial manipulation of deep representations

    Sara Sabour, Y anshuai Cao, Fartash Faghri, and David J Fleet. Adversarial manipulation of deep representations. arXiv preprint arXiv:1511.05122, 2015

    2015 arXiv

  24. [32]

    A survey of the implementations of model inversion attacks

    Junzhe Song and Dmitry Namiot. A survey of the implementations of model inversion attacks. In International Conference on Distributed Computer and Communication Networks , pages 3–16. Springer, 2022

    2022

  25. [33]

    Practical black-box attacks against machine learning

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Anan- thram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference on computer and communications security, pages 506–519, 2017

    2017

  26. [34]

    Survey on white-box attacks and solutions

    V Porkodi, M Sivaram, Amin Salih Mohammed, and V Manikandan. Survey on white-box attacks and solutions. Asian Journal of Computer Science and Technology, 7(3):28–32, 2018

    2018

  27. [35]

    Query efficient black-box adversarial attack on deep neural networks

    Y ang Bai, Yisen Wang, Yuyuan Zeng, Y ong Jiang, and Shu-Tao Xia. Query efficient black-box adversarial attack on deep neural networks. Pattern Recognition, 133:109037, 2023

    2023

  28. [36]

    Transferability in machine learn- ing: from phenomena to black-box attacks using adversarial samples

    Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. Transferability in machine learn- ing: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277, 2016

    2016 arXiv

  29. [37]

    Logit pairing methods can fool gradient-based attacks

    Marius Mosbach, Maksym Andriushchenko, Thomas Trost, Matthias Hein, and Dietrich Klakow. Logit pairing methods can fool gradient-based attacks. arXiv preprint arXiv:1810.12042, 2018

    2018 arXiv

  30. [38]

    Adversarial attacks and defenses against deep neural networks: a survey

    Mesut Ozdag. Adversarial attacks and defenses against deep neural networks: a survey. Pro- cedia Computer Science, 140:152–161, 2018

    2018

  31. [39]

    Adversarial examples that fool detectors.arXiv preprint arXiv:1712.02494, 2017

    Jiajun Lu, Hussein Sibai, and Evan Fabry. Adversarial examples that fool detectors.arXiv preprint arXiv:1712.02494, 2017

    2017 arXiv

  32. [40]

    Hands-on machine learning on google cloud platform: Implementing smart and efficient analytics using cloud ml engine

    Giuseppe Ciaburro, V Kishore Ayyadevara, and Alexis Perrier. Hands-on machine learning on google cloud platform: Implementing smart and efficient analytics using cloud ml engine . Packt Publishing Ltd, 2018. 174 BIBLIOGRAPHY

    2018

  33. [41]

    Gpt understands, too

    Xiao Liu, Y anan Zheng, Zhengxiao Du, Ming Ding, Yujie Qian, Zhilin Y ang, and Jie Tang. Gpt understands, too. AI Open, 2023

    2023

  34. [42]

    Recent advances in convolutional neural networks

    Jiuxiang Gu, Zhenhua Wang, Jason Kuen, Lianyang Ma, Amir Shahroudy, Bing Shuai, Ting Liu, Xingxing Wang, Gang Wang, Jianfei Cai, et al. Recent advances in convolutional neural networks. Pattern recognition, 77:354–377, 2018

    2018

  35. [43]

    A comprehensive survey on poisoning attacks and countermeasures in machine learning

    Zhiyi Tian, Lei Cui, Jie Liang, and Shui Yu. A comprehensive survey on poisoning attacks and countermeasures in machine learning. ACM Computing Surveys, 55(8):1–35, 2022

    2022

  36. [44]

    Deep model poisoning attack on feder- ated learning

    Xingchen Zhou, Ming Xu, Yiming Wu, and Ning Zheng. Deep model poisoning attack on feder- ated learning. Future Internet, 13(3):73, 2021

    2021

  37. [45]

    A huber loss minimization approach to byzantine ro- bust federated learning

    Puning Zhao, Fei Yu, and Zhiguo Wan. A huber loss minimization approach to byzantine ro- bust federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 21806–21814, 2024

    2024

  38. [46]

    Rethinking label flipping attack: From sample masking to sample thresholding

    Qianqian Xu, Zhiyong Y ang, Yunrui Zhao, Xiaochun Cao, and Qingming Huang. Rethinking label flipping attack: From sample masking to sample thresholding. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(6):7668–7685, 2022

    2022

  39. [47]

    Adversarial learning targeting deep neural network classification: A comprehensive review of defenses against attacks

    David J Miller, Zhen Xiang, and George Kesidis. Adversarial learning targeting deep neural network classification: A comprehensive review of defenses against attacks. Proceedings of the IEEE, 108(3):402–433, 2020

    2020

  40. [48]

    Generative adversarial nets

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Y oshua Bengio. Generative adversarial nets. Advances in neural informa- tion processing systems, 27, 2014

    2014

  41. [49]

    Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    Aleksander Madry. Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  42. [50]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017

    2017

  43. [51]

    Reflections on trusting trust

    Ken Thompson. Reflections on trusting trust. Communications of the ACM , 27(8):761–763, 1984

    1984

  44. [52]

    Badnets: Identifying vulnerabilities in the machine learning model supply chain

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017

    2017 arXiv

  45. [53]

    An assessment by the statin intolerance panel: 2014 update

    John R Guyton, Harold E Bays, Scott M Grundy, and Terry A Jacobson. An assessment by the statin intolerance panel: 2014 update. Journal of clinical lipidology, 8(3):S72–S81, 2014

    2014

  46. [54]

    Explaining and harnessing adver- sarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adver- sarial examples. arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  47. [55]

    The limitations of deep learning in adversarial settings

    Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Anan- thram Swami. The limitations of deep learning in adversarial settings. In 2016 IEEE European symposium on security and privacy (EuroS&P), pages 372–387. IEEE, 2016. BIBLIOGRAPHY 175

    2016

  48. [56]

    Poisoning attacks and defenses on artificial intelligence: A survey

    Miguel A Ramirez, Song-Kyoo Kim, Hussam Al Hamadi, Ernesto Damiani, Y oung-Ji Byon, Tae- Y eon Kim, Chung-Suk Cho, and Chan Y eob Y eun. Poisoning attacks and defenses on artificial intelligence: A survey. arXiv preprint arXiv:2202.10276, 2022

    2022 arXiv

  49. [57]

    Robust nonparametric regression under poisoning attack

    Puning Zhao and Zhiguo Wan. Robust nonparametric regression under poisoning attack. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 17007–17015, 2024

    2024

  50. [58]

    Calibrating noise to sensitivity in private data analysis

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New Y ork, NY , USA, March 4-7, 2006. Proceedings 3 , pages 265–284. Springer, 2006

    2006

  51. [59]

    Robust federated learning with realistic corruption

    Puning Zhao, Jiafei Wu, and Zhe Liu. Robust federated learning with realistic corruption. In Asia-Pacific Web (APWeb) and Web-Age Information Management (WAIM) Joint International Conference on Web and Big Data, pages 228–242. Springer, 2024

    2024

  52. [60]

    High dimensional distributed gradient descent with arbitrary number of byzantine attackers

    Puning Zhao and Zhiguo Wan. High dimensional distributed gradient descent with arbitrary number of byzantine attackers. arXiv preprint arXiv:2307.13352, 2023

    2023

  53. [61]

    Protocols for secure computations

    Andrew C Y ao. Protocols for secure computations. In23rd annual symposium on foundations of computer science (sfcs 1982), pages 160–164. IEEE, 1982

    1982

  54. [62]

    Privacy preserving generative adversarial networks to model electronic health records

    Rohit Venugopal, Noman Shafqat, Ishwar Venugopal, Benjamin Mark John Tillbury, Harry Demetrios Stafford, and Aikaterini Bourazeri. Privacy preserving generative adversarial networks to model electronic health records. Neural Networks, 153:339–348, 2022

    2022

  55. [63]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks

    Bolun Wang, Yuanshun Y ao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE symposium on security and privacy (SP), pages 707–723. IEEE, 2019

    2019

  56. [64]

    A survey on contrastive self-supervised learning

    Ashish Jaiswal, Ashwin Ramesh Babu, Mohammad Zaki Zadeh, Debapriya Banerjee, and Fillia Makedon. A survey on contrastive self-supervised learning. Technologies, 9(1):2, 2020

    2020

  57. [65]

    Unsupervised visual representation learning by context prediction

    Carl Doersch, Abhinav Gupta, and Alexei A Efros. Unsupervised visual representation learning by context prediction. In Proceedings of the IEEE international conference on computer vision , pages 1422–1430, 2015

    2015

  58. [66]

    Distilling the knowledge in a neural network

    Geoffrey Hinton. Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531, 2015

    2015 arXiv

  59. [67]

    Adversarial attack on graph structured data

    Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. Adversarial attack on graph structured data. In International conference on machine learning , pages 1115–1124. PMLR, 2018

    2018

  60. [68]

    Poisoning attacks against support vector ma- chines

    Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector ma- chines. arXiv preprint arXiv:1206.6389, 2012

    2012 arXiv

  61. [69]

    Protecting sensitive knowledge by data sanitization

    Stanley RM Oliveira and Osmar R Zaïane. Protecting sensitive knowledge by data sanitization. In Third IEEE International conference on data mining, pages 613–616. IEEE, 2003

    2003

  62. [70]

    Defending model inversion and membership inference attacks via prediction purification

    Ziqi Y ang, Bin Shao, Bohan Xuan, Ee-Chien Chang, and Fan Zhang. Defending model inversion and membership inference attacks via prediction purification. arXiv preprint arXiv:2005.03915, 2020. 176 BIBLIOGRAPHY

    2005 arXiv

  63. [71]

    Differential privacy: A survey of results

    Cynthia Dwork. Differential privacy: A survey of results. In International conference on theory and applications of models of computation, pages 1–19. Springer, 2008

    2008

  64. [72]

    A survey on poisoning attacks against supervised machine learning

    Wenjun Qiu. A survey on poisoning attacks against supervised machine learning. arXiv preprint arXiv:2202.02510, 2022

    2022 arXiv

  65. [73]

    Robust loss functions under label noise for deep neural networks

    Aritra Ghosh, Himanshu Kumar, and P Shanti Sastry. Robust loss functions under label noise for deep neural networks. In Proceedings of the 31st AAAI Conference on Artificial Intelligence, pages 1919–1925. AAAI Press, 2017

    1919

  66. [74]

    Online anomaly detection under adversarial impact

    Marius Kloft and Pavel Laskov. Online anomaly detection under adversarial impact. In Pro- ceedings of the thirteenth international conference on artificial intelligence and statistics , pages 405–412. JMLR Workshop and Conference Proceedings, 2010

    2010

  67. [75]

    Face recognition systems: A survey

    Y assin Kortli, Maher Jridi, Ayman Al Falou, and Mohamed Atri. Face recognition systems: A survey. Sensors, 20(2):342, 2020

    2020

  68. [76]

    A comprehensive review on malware detection approaches

    Ömer Aslan Aslan and Refik Samet. A comprehensive review on malware detection approaches. IEEE access, 8:6249–6271, 2020

    2020

  69. [77]

    A review of network traffic analysis and prediction techniques

    Manish Joshi and Theyazn Hassn Hadi. A review of network traffic analysis and prediction techniques. arXiv preprint arXiv:1507.05722, 2015

    2015 arXiv

  70. [78]

    Automated cyber defence: A review

    Sanyam Vyas, John Hannay, Andrew Bolton, and Professor Pete Burnap. Automated cyber defence: A review. arXiv preprint arXiv:2303.04926, 2023

    2023 arXiv

  71. [79]

    No more chewy centers: Introducing the zero trust model of information security

    John Kindervag, S Balaouras, et al. No more chewy centers: Introducing the zero trust model of information security. Forrester Research, 3, 2010

    2010

  72. [80]

    Generative adversarial networks

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Y oshua Bengio. Generative adversarial networks. Communications of the ACM, 63(11):139–144, 2020

    2020

  73. [81]

    Dynamical variational autoencoders: A comprehensive review

    Laurent Girin, Simon Leglaive, Xiaoyu Bie, Julien Diard, Thomas Hueber, and Xavier Alameda- Pineda. Dynamical variational autoencoders: A comprehensive review. arXiv preprint arXiv:2008.12595, 2020

    2008 arXiv

  74. [82]

    Secure multi-party computation: theory, practice and applications

    Chuan Zhao, Shengnan Zhao, Minghao Zhao, Zhenxiang Chen, Chong-Zhi Gao, Hongwei Li, and Yu-an Tan. Secure multi-party computation: theory, practice and applications. Information Sciences, 476:357–372, 2019

    2019

  75. [83]

    Homomorphic encryption

    Xun Yi, Russell Paulet, Elisa Bertino, Xun Yi, Russell Paulet, and Elisa Bertino. Homomorphic encryption. Springer, 2014

    2014

  76. [84]

    A review of applications in federated learning

    Li Li, Yuxi Fan, Mike Tse, and Kuo-Yi Lin. A review of applications in federated learning. Com- puters & Industrial Engineering, 149:106854, 2020

    2020

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.