Pith. sign in

REVIEW 4 major objections 5 minor 191 references

Combining Machine Learning Defenses without Conflicts

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Def\Con claims a four-step flowchart can tell whether two machine-learning defenses conflict, matching 90% of known combinations and 81% of 30 previously untested ones.

desk verdict Useful screening heuristic and systematization, but the headline accuracy is inflated—the 90% is on the design set and Table 4's labels are implementation-specific, so the generalization claim doesn't hold. read the letter →

arxiv 2411.09776 v2 pith:DCC754PH submitted 2024-11-14 cs.CR cs.LG

Vasisht Duddu , Rui Zhang , N. Asokan This is my paper · ORCID
classification cs.CRcs.LG
keywords machinelearningdefensesdefensecombinationconflictpredictionadversarialtrainingwatermarkingdifferentialprivacygroupfairnessmodelfingerprinting
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that whether two defenses can be combined without modifying either can be decided from three facts about each defense: its pipeline stage, whether its changes are global, local, or none, and whether it uses or protects against a particular risk. It packages this into Def\Con, a flowchart that flags a combination as conflicting only when a later defense would override the first defense's changes or mitigate the risk the first defense relies on. On eight combinations previously studied, Def\Con's predictions match the reported result 90% of the time, versus 40% for the common rule of placing defenses in different pipeline stages. On 30 previously unstudied combinations the authors evaluated, it matches empirical outcomes 81% of the time, rising to 86% after hyperparameter tuning. If this holds, practitioners can screen defense combinations cheaply before paying for the experiments.

What carries the argument

The central object is the Def\Con flowchart, a four-step decision procedure that maps each defense to a stage (pre-, in-, or post-training), a change type (global, local, or none), a risk it uses, and a risk it protects against. The flowchart answers four questions in sequence: same stage, whether the second defense makes only local or no changes, whether the first defense uses a risk, and whether the second defense protects that risk. This turns combination effectiveness into a binary prediction without running the defenses together, and it extends to three or more defenses by decomposing the combination into pairwise checks and pruning conflicting permutations.

What would settle it

Take a defense pair with a known empirical outcome, assign the Table 4 attributes, and check whether Def\Con's prediction matches; repeating this with a defense not in the paper, such as certified robustness or a language-model watermarking scheme, would test whether the two conflict mechanisms generalize. A more direct check is to perturb the labels—for example, marking MdlWM.Pre as global instead of local—and observe whether the accuracy on the paper's own 30 combinations shifts, which would show the result is label-sensitive rather than mechanism-driven.

Watch

Extended reading notes

Core claim

The central claim is that the two underlying conflict mechanisms, not stage separation, are what make defense combinations fail: a later-stage defense can mitigate a risk that an earlier-stage defense uses as its mechanism, or a later-stage defense can globally override changes made by the earlier defense. Def\Con predicts alignment when a same-stage second defense makes only local or no changes, when different-stage defenses do not involve a protected risk, or when the second defense does not protect against the risk the first one uses. It predicts conflict when a later global change overrides an earlier defense or when the second defense protects against a risk used by the first. On this basis the paper reports a balanced accuracy of 90% on eight prior combinations, 81% on 30 unexplored combinations, and 86% after tuning false-positive cases, with the naïve stage-based technique at 40% and 36% respectively.

Load-bearing premise

The accuracy of Def\Con rests on the hand-assigned labels in Table 4—each defense has one pipeline stage, one change type, and binary risk-use and risk-protection relations—and on the rule that a combination conflicts if any defense metric on any dataset falls below its single-defense baseline; if those labels or that threshold are wrong or incomplete, the reported accuracy is an artifact of the labeling scheme.

Editorial extensions

If this is right

  • Practitioners can pre-screen pairwise and multi-way defense combinations without training runs, reserving expensive empirical evaluation for combinations Def\Con predicts as aligned.
  • The 30 previously unexplored combinations can serve as a benchmark for future conflict-prediction techniques, since the paper supplies per-defense metrics and ground-truth labels for each.
  • Because Def\Con is non-invasive, existing deployed defenses can be combined without reimplementation, which lowers the adoption cost for real systems needing simultaneous protection.
  • The same flowchart extends beyond two defenses by decomposing multi-way combinations into pairwise checks, and the paper demonstrates effective triple combinations on five illustrative cases.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension is to replace the hand-assigned Table 4 labels with automatically derived property cards for each defense; if such labels can be produced reliably, Def\Con becomes a cheaper advisory tool for new defenses.
  • The two conflict mechanisms likely transfer to other modalities, such as language models, where fine-tuning, pruning, and watermarking occupy similar pipeline stages, but that transfer needs its own empirical validation.
  • The paper's conflict rule treats any metric falling below its single-defense baseline as a conflict, so Def\Con may over-reject combinations with small, acceptable degradations; a graded notion of conflict could improve practical usefulness.
  • The taxonomy of conflict causes is explicitly incomplete; extending it with mechanisms such as lp-norm mismatches or utility-effect entanglement could raise accuracy on the false-positive cases the paper observed.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper systematizes prior work on combining ML defenses and proposes DefCon, a rule-based technique that predicts whether two defenses can be combined without modifying them. DefCon's flowchart (S1-S4) records each defense's pipeline stage, whether it makes global/local/no changes, whether it uses a risk, and whether it protects against a risk. The authors report a balanced accuracy of 90% on eight combinations taken from prior work and 81% on 30 previously unexplored combinations, rising to 86% after hyperparameter tuning for one false-positive combination. They also provide illustrative three-defense combinations and argue that DefCon satisfies accuracy, scalability, non-invasiveness, and generality.

Significance. If the accuracy and generality claims were fully supported, DefCon would be a useful practical screening tool: a practitioner could decide whether two off-the-shelf defenses can be combined without empirical evaluation. The paper's main strengths are its broad systematization of the defense-combination literature, its effort to evaluate 30 previously unexplored combinations, the public availability of code, and the explicit treatment of multi-way combinations. However, the headline accuracy figures are weaker than presented: the 90% figure is measured on the same prior-work combinations used to iteratively design DefCon, and the 86% figure is obtained only after post hoc hyperparameter tuning of a single combination. More importantly, the paper's own C7 discussion shows that the DefCon labels in Table 4 are implementation-dependent, contradicting the generality claim in Section 7.5. The empirical evaluation is still a real contribution, but the central claims need to be substantially qualified.

major comments (4)
  1. [§7.2, C7; §6.4; §7.5] The Table 4 tuple for DtWM.Pre (S3=Yes) and DiffPriv.In (S4=Yes) predicts a conflict, but C7 is classified as an effective combination in prior work because the radioactive/adversarial-example watermarks used by Szyller and Asokan are inliers not suppressed by DPSGD. This is the single false negative that lowers the eight-combination accuracy to 7/8. In the 30-combination evaluation, DtWM.Pre is implemented with BadNets 5x5 backdoor watermarks (§6.4), which are indeed suppressed by poison/DP defenses. Consequently, the 81%/86% accuracy validates DefCon only for the specific implementations tested, not for 'dataset watermarking' as a general defense category. The statement in §7.5 that 'other implementations can be used and should not effect our conclusions' is therefore not supported by the paper's own evidence. The authors need either to make the variant level part of the defense representation or to explicitly restrict the claims to the tested implementations.
  2. [§5.3; §7.2] The 90% accuracy is not an independent validation. Section 5.3 states that the authors 'iterate over the design of DefCon using prior work from §4,' and Section 7.2 then evaluates DefCon on eight combinations drawn from that same prior work. This makes the eight-combination result in-sample. The authors should present the 90% figure as a training-set accuracy or, preferably, derive the rules without using the eight C1-C8 combinations and then test on those combinations as a held-out set. The 30-combination evaluation in §7.3 is less circular, but the headline comparison against the naïve technique should not be based on the in-sample 90% figure.
  3. [§7.3] The empirical ground-truth rule is a single arbitrary threshold: a combination is called a conflict if 'at least one dataset has at least one metric marked as orange or red,' where orange means worse than the single-defense baseline but better than no defense. This rule can classify a combination as conflicting because of one degraded metric among several, and it takes the worst outcome across two datasets with different random seeds. The accuracy numbers in §7.3 are directly contingent on this labeling rule, but no sensitivity analysis is provided. The authors should justify the threshold, report results under alternative rules (e.g., requiring at least two metrics to fail, or treating orange as non-conflict), and state how sensitive the 81%/86% figures are to this choice.
  4. [§7.4; Abstract] The 86% figure in the Abstract is post hoc. Section 7.3 reports 81% on the 30 unexplored combinations; Section 7.4 then tunes hyperparameters for the three false positives (C17, C32, C35), finds one configuration for C32 that removes the conflict, and re-computes accuracy as 86%. This is an exploratory search for a successful configuration, not an out-of-the-box prediction accuracy. If the 86% figure is kept, the paper must state explicitly that it is achieved after hyperparameter tuning of one combination, and the Abstract should not present it as the accuracy of DefCon as a screening rule. The same issue applies to the contribution list in Section 1.
minor comments (5)
  1. [Table 5, C36-C38] In several rows the value reported for 'wmacc' is identical to the value reported for 'ASR' (e.g., C36 wmacc 10.18±0.46, C37 wmacc 71.31±14.10, C38 wmacc 58.65±19.23). This appears to be a copy-and-paste error in the table and should be corrected, because the empirical conflict labels for these combinations should depend on the actual watermark accuracy.
  2. [Appendix B] The appendix is titled 'Formal Analysis of DefCon,' but only the consistency claim is a proof; soundness is argued by citing empirical accuracy, and completeness is conditional on an assumption stated in the text. The authors should either provide a real formal statement with assumptions made explicit or rename the appendix to avoid overclaiming.
  3. [Abstract vs. §7.3/§7.4] The Abstract says '86% in 30 unexplored combinations,' whereas §7.3 reports 81% and §7.4 obtains 86% only after tuning a single combination. Please align the abstract and the contribution list with the methodology actually used.
  4. [Table 1] Table 1 uses the same symbol for alignment, conflict, and unexplored combinations, relying on color/text that may not be distinguishable in black-and-white printing. Distinct glyphs for the three interaction types would improve readability.
  5. [Table 7] The three-defense combinations C39-C44 are reported on only one dataset for some rows (e.g., C42-C44 have no FMNIST column), and the text says these are illustrative. This is acceptable, but the table should clearly mark where a value is omitted by design and where it was not run, so that readers do not misinterpret the absence as a failed experiment.

Circularity Check

3 steps flagged · score 6.0 of 10

The headline 90% is a development-set fit: DefCon's flowchart and Table 4 labels were iterated on the same eight prior-work combinations later scored in §7.2; the 81%/86% on 30 unexplored combinations is structurally independent, but its category-level generality is undercut by the paper's own C7.

  1. fitted input called prediction [§5.3 (Methodology to Derive DefCon) and §7.2 (Accuracy: using Prior Work)]
    "We start with the naïve technique and modify it to include the underlying causes for conflicts among defenses. We iterate over the design of Def\Con using prior work from §4, and evaluate the final design on unexplored combinations (see §7). ... We identify eight combinations (C1-C8) whose results can be used as ground truth to compare the predictions of Def\Con and the naïve technique."

    The 90% figure of §7.2 is a development-set statistic. §5.3 states the design was iterated on prior work from §4, and Table 4's labeling rules (S2/S3/S4 per defense) are read off those same findings; e.g., Table 4 assigns EvsnRob.In S4=Yes in direct restatement of §4.2's 'Adversarial training, as EvsnRob.In, suppresses the influence of backdoors which are used for MdlWM.Pre', and C4-C6 then 'predict' conflict for exactly those combos. Each C1-C8 outcome is a logical readout of labels that were fitted to the prior-work conclusions being scored, so the reported 90% (TP=4, TN=3, FP=0, FN=1) measures fit to the eight cases rather than predictive accuracy; the only truly forward-looking evaluation is the 30 unexplored combinations.

  2. self citation load bearing [§1 (Introduction) and §7.2 (C2-C7), both citing Szyller & Asokan (2023)]
    "Def\Con is inspired by mutually exclusive placement (aka naïve technique), but overcomes its limitations by explicitly addressing the reasons that underlie conflicts among defenses: a later-stage defense either (a) mitigates a risk re-purposed as a defense by an early-stage defense, or (b) overrides changes made by an early-stage defense (Szyller & Asokan, 2023)."

    The two causes of conflict that constitute DefCon's entire decision mechanism are attributed to Szyller & Asokan (2023), whose author list overlaps with this paper (N. Asokan), and six of the eight §7.2 ground-truth combinations (C2-C7) are taken from that same self-cited work. The load-bearing premise of the design, and roughly half the development-set ground truth, therefore trace to a single citation shared with the present authors. Severity is bounded: Szyller & Asokan is an externally peer-reviewed, empirically grounded AAAI paper, and the 30-combination evaluation (81%/86%) does not rely on it; the self-citation is not used to forbid alternatives (no uniqueness theorem is invoked).

1 more flagged steps
  1. self definitional [§6.3-§6.4 (implementation selection), §7.2 (C7), §7.5 (R4 Generality)]
    "Unlike backdoor-based watermarks used in our work, adversarial example-based watermarks used by Szyller and Asokan (Szyller & Asokan, 2023), are inliers which are not suppressed by DiffPriv.In. Hence, Def\Con's prediction differs. ... Furthermore, we select specific defense implementations based on their availability (see §6.4). However, other implementations can be used and should not effect our conclusions."

    DefCon predicts conflicts from category-level Table 4 tuples — DtWM.Pre is labeled S3=Yes ('uses backdoors') — and §6.4 instantiates exactly that category (DtWM.Pre as BadNets 5x5 backdoor watermarks) in the 30-combination evaluation. For the risk-use × risk-protection cells (C21, C23, C36-C38), the 'conflict' outcome is then nearly entailed: a poison defense that removes backdoors removes a backdoor watermark by definition, so empirical agreement partly restates the category definitions rather than testing them.

full rationale

DefCon's derivation chain is: §4 systematization → §5.3 flowchart rules plus Table 4 labels → §7 predictions vs ground truth. The chain contains two genuinely circular joints. First, §5.3 states the design was iterated on prior work from §4, and §7.2 scores the technique against eight combinations culled from that same prior work; the S2-S4 labels that generate each C1-C8 prediction were populated from the very findings being 'predicted' (e.g., Table 4's EvsnRob.In S4=Yes restates §4's statement that adversarial training suppresses backdoor watermarks, which is exactly C4-C6's ground truth). The 90% figure is thus a development-set fit statistic, not predictive accuracy, and is presented in the abstract without that caveat. Second, the two conflict causes that define DefCon's mechanism are imported from Szyller & Asokan (2023), a paper overlapping with the present authors, which also supplies six of the eight §7.2 ground-truth outcomes; this is load-bearing for the design, though the citation is to an externally published empirical study and the 30-combination evaluation does not depend on it. Mitigations: (i) the paper honestly retains C7 as a false negative, showing the rules were not reverse-engineered to perfection; (ii) the 30 previously unexplored combinations provide structurally independent evidence — predictions are read off Table 4 while ground truth is measured empirically, and the §7.3 conflict criterion (any metric on any dataset below single-defense baseline) is not derived from DefCon; (iii) no uniqueness theorem is invoked. Appendix B itself concedes that 'the soundness of DefCon is conditional on the assumption that these rules perfectly represent all conflict and alignment scenarios', an assumption that the §7.2 evaluation cannot test since the rules were built from the same corpus. The remaining weakness is category/implementation coupling: Table 4 tuples are category-level, §6.4 instantiates each category with an implementation matching its tuple, and the paper's own C7 shows the tuple flips with the choice of watermark scheme, so the 81%/86% and the §7.5 generality claim are implementation-contingent. On balance: the headline 90% claim partially reduces by construction (fitted input called prediction), while the core 81%/86% claim on unexplored combinations has independent empirical content; score 6.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

DefCon does not introduce new entities or fitted constants, but it postulates a complete and correct labeling of defenses (Table 4) and a conflict criterion that determines all accuracy numbers. These are hand-made modeling choices, not independently verified benchmarks.

free parameters (1)
  • Conflict labeling rule = Not numeric; rule = any metric on any dataset below single-defense baseline is a conflict
    The authors define a combination as conflicting if at least one metric on at least one dataset is marked orange or red (§7.3). This hand-chosen threshold determines the reported accuracy numbers.
assumptions (3)
  • domain assumption Each defense can be mapped to exactly one pipeline stage and one change type (global/local/none), plus binary risk-use and risk-protection relations as in Table 4.
    DefCon's S1-S4 questions require these labels, but they are assigned by the authors from their reading of prior work and are not independently measured or validated.
  • domain assumption A defense combination is effective iff every defense metric is at least as good as its single-defense baseline on every dataset, and conflicting otherwise.
    This threshold in §7.3 defines the ground truth for the 30-combination accuracy estimate; changing it changes all reported accuracy values.
  • domain assumption Applying a defense after differential privacy does not consume additional privacy budget, and modifications to Dtr stay within the privacy boundary.
    Used in §5.3 Note on DiffPriv to predict DiffPriv-containing combinations; the post-processing argument is standard but its application to combined training-time defenses is asserted rather than proven.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Combining Machine Learning Defenses without Conflicts." pith.science (2026). https://pith.science/paper/DCC754PH

@misc{pith2026241109776,
  author       = {Pith},
  title        = {Pith review of: Combining Machine Learning Defenses without Conflicts},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DCC754PH}},
  note         = {Machine review of arXiv:2411.09776}
}
read the original abstract

Machine learning (ML) defenses protect against various risks to security, privacy, and fairness. Real-life models need simultaneous protection against multiple different risks which necessitates combining multiple defenses. But combining defenses with conflicting interactions in an ML model can be ineffective, incurring a significant drop in the effectiveness of one or more defenses being combined. Practitioners need a way to determine if a given combination can be effective. Experimentally identifying effective combinations can be time-consuming and expensive, particularly when multiple defenses need to be combined. We need an inexpensive, easy-to-use combination technique to identify effective combinations. Ideally, a combination technique should be (a) accurate (correctly identifies whether a combination is effective or not), (b) scalable (allows combining multiple defenses), (c) non-invasive (requires no change to the defenses being combined), and (d) general (is applicable to different types of defenses). Prior works have identified several ad-hoc techniques but none satisfy all the requirements above. We propose a principled combination technique, Def\Con, to identify effective defense combinations. Def\Con meets all requirements, achieving 90% accuracy on eight combinations explored in prior work and 81% in 30 previously unexplored combinations that we empirically evaluate in this paper.

Figures

Figures reproduced from arXiv: 2411.09776 by the authors.

Figure 1
Figure 1. Flowchart depicting various steps in Def\Con to identify conflict between D1 and D2 (D2 is applied after D1). Methodology to Derive Def\Con. We start with the naïve technique and modify it to include the underlying causes for conflicts among defenses. We iterate over the design of Def\Con using prior work from §4, and evaluate the final design on unexplored combinations (see §7). Def\Con Description. We describe Def… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

191 extracted references · 66 canonical work pages

  1. [1]

    Papernot et al., `` SoK : Security and privacy in machine learning,'' in EuroS&P, 2018, pp

    N. Papernot et al., `` SoK : Security and privacy in machine learning,'' in EuroS&P, 2018, pp. 399--414

    2018

  2. [2]

    Tian et al., ``A comprehensive survey on poisoning attacks and countermeasures in machine learning,'' ACM Computing Surveys, vol

    Z. Tian et al., ``A comprehensive survey on poisoning attacks and countermeasures in machine learning,'' ACM Computing Surveys, vol. 55, pp. 1--35, 2022

    2022

  3. [3]

    De Cristofaro, ``A critical overview of privacy in machine learning,'' IEEE Security & Privacy, vol

    E. De Cristofaro, ``A critical overview of privacy in machine learning,'' IEEE Security & Privacy, vol. 19, no. 04, pp. 19--27, Jul. 2021

    2021

  4. [4]

    H. Hu, Z. Salcic, L. Sun, G. Dobbie, P. S. Yu, and X. Zhang, ``Membership inference attacks on machine learning: A survey,'' ACM Computing Surveys, vol. 54, pp. 1--35, 2022

    2022

  5. [5]

    Mehrabi et al., ``A survey on bias and fairness in machine learning,'' ACM Computing Surveys, vol

    N. Mehrabi et al., ``A survey on bias and fairness in machine learning,'' ACM Computing Surveys, vol. 54, pp. 1--35, 2021

    2021

  6. [6]

    Pessach and E

    D. Pessach and E. Shmueli, ``A review on fairness in machine learning,'' ACM Computing Surveys, vol. 55, pp. 1--44, 2022

    2022

  7. [7]

    Li et al., `` SoK : Certified robustness for deep neural networks,'' in SP, 2023, pp

    L. Li et al., `` SoK : Certified robustness for deep neural networks,'' in SP, 2023, pp. 1289--1310

    2023

  8. [8]

    G. R. Machado et al., ``Adversarial machine learning in image classification: A survey toward the defender’s perspective,'' ACM Computing Surveys, vol. 55, pp. 1--35, 2021

    2021

Show all 191 references
  1. [9]

    Duddu et al., `` SoK : Unintended interactions among machine learning defenses and risks,'' SP, 2024

    V. Duddu et al., `` SoK : Unintended interactions among machine learning defenses and risks,'' SP, 2024

    2024

  2. [10]

    Szyller and N

    S. Szyller and N. Asokan, ``Conflicting interactions among protection mechanisms for machine learning models,'' in AAAI, 2023, pp. 15\,179--15\,187

    2023

  3. [11]

    Gittens et al., ``An adversarial perspective on accuracy, robustness, fairness, and privacy: Multilateral-tradeoffs in trustworthy ml,'' IEEE Access, vol

    A. Gittens et al., ``An adversarial perspective on accuracy, robustness, fairness, and privacy: Multilateral-tradeoffs in trustworthy ml,'' IEEE Access, vol. 10, pp. 120\,850--120\,865, 2022

    2022

  4. [12]

    Liu et al., ``Towards trustworthy and aligned machine learning: A data-centric survey with causality perspectives,'' in arXiv:2307.16851, 2023

    H. Liu et al., ``Towards trustworthy and aligned machine learning: A data-centric survey with causality perspectives,'' in arXiv:2307.16851, 2023

    2023 arXiv

  5. [13]

    Datta, D

    T. Datta, D. Nissani, M. Cembalest, A. Khanna, H. Massa, and J. Dickerson, ``Tensions between the proxies of human values in ai,'' in SatML, 2023, pp. 678--689

    2023

  6. [14]

    Alves et al., ``Survey on fairness notions and related tensions,'' in EURO Journal on Decision Processes, 2023

    G. Alves et al., ``Survey on fairness notions and related tensions,'' in EURO Journal on Decision Processes, 2023

    2023

  7. [15]

    Chen et al., ``Privacy and fairness in federated learning: On the perspective of tradeoff,'' ACM Computing Surveys, vol

    H. Chen et al., ``Privacy and fairness in federated learning: On the perspective of tradeoff,'' ACM Computing Surveys, vol. 56, no. 2, 2023

    2023

  8. [16]

    Fioretto et al., ``Differential privacy and fairness in decisions and learning tasks: A survey,'' in IJCAI, 2022, pp

    F. Fioretto et al., ``Differential privacy and fairness in decisions and learning tasks: A survey,'' in IJCAI, 2022, pp. 5470--5477

    2022

  9. [17]

    Noppel and C

    M. Noppel and C. Wressnegger, `` SoK : Explainable machine learning in adversarial environments,'' in SP, 2024, pp. 21--21

    2024

  10. [18]

    Ferry, U

    J. Ferry, U. A \"i vodji, S. Gambs, M.-J. Huguet, and M. Siala, `` SoK: Taming the Triangle - On the Interplays between Fairness, Interpretability and Privacy in Machine Learning ,'' in https://hal.science/hal-04359832, 2023

    2023

  11. [19]

    Yaghini et al., ``Learning with impartiality to walk on the pareto frontier of fairness, privacy, and utility,'' in Workshop on Regulatable ML@NeurIPS, 2023

    M. Yaghini et al., ``Learning with impartiality to walk on the pareto frontier of fairness, privacy, and utility,'' in Workshop on Regulatable ML@NeurIPS, 2023

    2023

  12. [20]

    Madry et al., ``Towards deep learning models resistant to adversarial attacks,'' in ICLR, 2018

    A. Madry et al., ``Towards deep learning models resistant to adversarial attacks,'' in ICLR, 2018

    2018

  13. [21]

    S. Yun, D. Han, S. Chun, S. Oh, Y. Yoo, and J. Choe, ``Cutmix: Regularization strategy to train strong classifiers with localizable features,'' in ICCV, 2019, pp. 6022--6031

    2019

  14. [22]

    Zhang et al., ``mixup: Beyond empirical risk minimization,'' in ICLR, 2018

    H. Zhang et al., ``mixup: Beyond empirical risk minimization,'' in ICLR, 2018

    2018

  15. [23]

    DeVries and G

    T. DeVries and G. W. Taylor, ``Improved regularization of convolutional neural networks with cutout,'' in arXiv:1708.04552, 2017

    2017 arXiv

  16. [24]

    Rebuffi et al., ``Data augmentation can improve robustness,'' in NeurIPS, 2021, pp

    S.-A. Rebuffi et al., ``Data augmentation can improve robustness,'' in NeurIPS, 2021, pp. 29\,935--29\,948

    2021

  17. [25]

    Zhang et al., ``Theoretically principled trade-off between robustness and accuracy,'' in ICML, 2019, pp

    H. Zhang et al., ``Theoretically principled trade-off between robustness and accuracy,'' in ICML, 2019, pp. 7472--7482

    2019

  18. [26]

    Cohen et al., ``Certified adversarial robustness via randomized smoothing,'' in ICML, 2019, pp

    J. Cohen et al., ``Certified adversarial robustness via randomized smoothing,'' in ICML, 2019, pp. 1310--1320

    2019

  19. [27]

    Lecuyer et al., ``Certified robustness to adversarial examples with differential privacy,'' in SP, 2019, pp

    M. Lecuyer et al., ``Certified robustness to adversarial examples with differential privacy,'' in SP, 2019, pp. 656--672

    2019

  20. [28]

    Tsipras et al., ``Robustness may be at odds with accuracy,'' in ICLR, 2019

    D. Tsipras et al., ``Robustness may be at odds with accuracy,'' in ICLR, 2019

    2019

  21. [29]

    Nie et al., ``Diffusion models for adversarial purification,'' in ICML, 2022

    W. Nie et al., ``Diffusion models for adversarial purification,'' in ICML, 2022

    2022

  22. [30]

    Song et al., ``Pixeldefend: Leveraging generative models to understand and defend against adversarial examples,'' in ICLR, 2018

    Y. Song et al., ``Pixeldefend: Leveraging generative models to understand and defend against adversarial examples,'' in ICLR, 2018

    2018

  23. [31]

    Buckman et al., ``Thermometer encoding: One hot way to resist adversarial examples,'' in ICLR, 2018

    J. Buckman et al., ``Thermometer encoding: One hot way to resist adversarial examples,'' in ICLR, 2018

    2018

  24. [32]

    Guo et al., ``Countering adversarial images using input transformations,'' in ICLR, 2018

    C. Guo et al., ``Countering adversarial images using input transformations,'' in ICLR, 2018

    2018

  25. [33]

    Das et al., ``Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression,'' in arXiv abs/1705.02900, 2017

    N. Das et al., ``Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression,'' in arXiv abs/1705.02900, 2017

    2017 arXiv

  26. [34]

    Grosse et al., ``On the (statistical) detection of adversarial examples,'' in arXiv:1702.06280, 2017

    K. Grosse et al., ``On the (statistical) detection of adversarial examples,'' in arXiv:1702.06280, 2017

    2017 arXiv

  27. [35]

    Li et al., ``Backdoor learning: A survey,'' IEEE TNNLS, vol

    Y. Li et al., ``Backdoor learning: A survey,'' IEEE TNNLS, vol. 35, pp. 5 -- 22, 2022

    2022

  28. [36]

    Jia et al., ``Scalability vs

    R. Jia et al., ``Scalability vs. utility: Do we have to sacrifice one for the other in data importance quantification?'' in CVPR, 2021, pp. 8239--8247

    2021

  29. [37]

    ------, ``Efficient task-specific data valuation for nearest neighbor algorithms,'' in VLDB, 2019

    2019

  30. [38]

    B. G. Doan et al., ``Februus: Input purification defense against trojan attacks on deep neural network systems,'' in ACSAC, 2020, pp. 897--912

    2020

  31. [39]

    G. F. Cretu et al., ``Casting out demons: Sanitizing training data for anomaly sensors,'' in SP, 2008, pp. 81--95

    2008

  32. [40]

    Paudice et al., ``Detection of adversarial training examples in poisoning attacks through anomaly detection,'' in arXiv:1802.03041, 2018

    A. Paudice et al., ``Detection of adversarial training examples in poisoning attacks through anomaly detection,'' in arXiv:1802.03041, 2018

    2018 arXiv

  33. [41]

    Tran et al., ``Spectral signatures in backdoor attacks,'' in NeurIPS, 2018, p

    B. Tran et al., ``Spectral signatures in backdoor attacks,'' in NeurIPS, 2018, p. 8011–8021

    2018

  34. [42]

    Barreno et al., ``The security of machine learning,'' Machine Learning, vol

    M. Barreno et al., ``The security of machine learning,'' Machine Learning, vol. 81, p. 121–148, 2010

    2010

  35. [43]

    Chen et al., ``Detecting backdoor attacks on deep neural networks by activation clustering,'' in SafeAI@AAAI, 2018

    B. Chen et al., ``Detecting backdoor attacks on deep neural networks by activation clustering,'' in SafeAI@AAAI, 2018

    2018

  36. [44]

    Borgnia et al., ``Strong data augmentation sanitizes poisoning and backdoor attacks without an accuracy tradeoff,'' in ICASSP, 2021, pp

    E. Borgnia et al., ``Strong data augmentation sanitizes poisoning and backdoor attacks without an accuracy tradeoff,'' in ICASSP, 2021, pp. 3855--3859

    2021

  37. [45]

    Qiu et al., ``Deepsweep: An evaluation framework for mitigating dnn backdoor attacks using data augmentation,'' in AsiaCCS, 2021, p

    H. Qiu et al., ``Deepsweep: An evaluation framework for mitigating dnn backdoor attacks using data augmentation,'' in AsiaCCS, 2021, p. 363–377

    2021

  38. [46]

    Li et al., ``Learning from noisy labels with distillation,'' in ICCV, 2017, pp

    Y. Li et al., ``Learning from noisy labels with distillation,'' in ICCV, 2017, pp. 1928--1936

    2017

  39. [47]

    Diakonikolas et al., ``Sever: A robust meta-algorithm for stochastic optimization,'' in ICML, 2019, pp

    I. Diakonikolas et al., ``Sever: A robust meta-algorithm for stochastic optimization,'' in ICML, 2019, pp. 1596--1606

    2019

  40. [48]

    Zhu et al., ``Neural polarizer: A lightweight and effective backdoor defense via purifying poisoned features,'' in NeurIPS, 2023

    M. Zhu et al., ``Neural polarizer: A lightweight and effective backdoor defense via purifying poisoned features,'' in NeurIPS, 2023

    2023

  41. [49]

    Xu et al., ``L\_dmi: An information-theoretic noise-robust loss function,'' in NeurIPS, 2019

    Y. Xu et al., ``L\_dmi: An information-theoretic noise-robust loss function,'' in NeurIPS, 2019

    2019

  42. [50]

    Liu and H

    Y. Liu and H. Guo, ``Peer loss functions: Learning from noisy labels without knowing noise rates,'' in ICML, 2020, pp. 6226--6236

    2020

  43. [51]

    Patrini et al., ``Making deep neural networks robust to label noise: A loss correction approach,'' in CVPR, 2017, pp

    G. Patrini et al., ``Making deep neural networks robust to label noise: A loss correction approach,'' in CVPR, 2017, pp. 1944--1952

    2017

  44. [52]

    Liu et al., ``Fine-pruning: Defending against backdooring attacks on deep neural networks,'' in RAID, 2018, pp

    K. Liu et al., ``Fine-pruning: Defending against backdooring attacks on deep neural networks,'' in RAID, 2018, pp. 273--294

    2018

  45. [53]

    Wu and Y

    D. Wu and Y. Wang, ``Adversarial neuron pruning purifies backdoored deep models,'' in NeurIPS, 2021

    2021

  46. [54]

    Zheng et al., ``Pre-activation distributions expose backdoor neurons,'' in NeurIPS, 2022

    R. Zheng et al., ``Pre-activation distributions expose backdoor neurons,'' in NeurIPS, 2022

    2022

  47. [55]

    175--191

    ------, ``Data-free backdoor removal based on channel lipschitzness,'' in ECCV, 2022, pp. 175--191

    2022

  48. [56]

    Li et al., ``Reconstructive neuron pruning for backdoor defense,'' in ICML, 2023, pp

    Y. Li et al., ``Reconstructive neuron pruning for backdoor defense,'' in ICML, 2023, pp. 19\,837--19\,854

    2023

  49. [57]

    Orekondy et al., ``Knockoff nets: Stealing functionality of black-box models,'' in CVPR, 2019, pp

    T. Orekondy et al., ``Knockoff nets: Stealing functionality of black-box models,'' in CVPR, 2019, pp. 4954--4963

    2019

  50. [58]

    Adi et al., ``Turning your weakness into a strength: Watermarking deep neural networks by backdooring,'' in USENIX Security, 2018, pp

    Y. Adi et al., ``Turning your weakness into a strength: Watermarking deep neural networks by backdooring,'' in USENIX Security, 2018, pp. 1615--1631

    2018

  51. [59]

    Zhang et al., ``Protecting intellectual property of deep neural networks with watermarking,'' in AsiaCCS, 2018, p

    J. Zhang et al., ``Protecting intellectual property of deep neural networks with watermarking,'' in AsiaCCS, 2018, p. 159–172

    2018

  52. [60]

    Jia et al., ``Entangled watermarks as a defense against model extraction,'' in USENIX Security, 2021, pp

    H. Jia et al., ``Entangled watermarks as a defense against model extraction,'' in USENIX Security, 2021, pp. 1937--1954

    2021

  53. [61]

    Uchida et al., ``Embedding watermarks into deep neural networks,'' in ICMR, 2017, p

    Y. Uchida et al., ``Embedding watermarks into deep neural networks,'' in ICMR, 2017, p. 269–277

    2017

  54. [62]

    Bansal et al., ``Certified neural network watermarks with randomized smoothing,'' in ICML, 2022, pp

    A. Bansal et al., ``Certified neural network watermarks with randomized smoothing,'' in ICML, 2022, pp. 1450--1465

    2022

  55. [63]

    Bagdasaryan and V

    E. Bagdasaryan and V. Shmatikov, ``Blind backdoors in deep learning models,'' in USENIX Security, 2021, pp. 1505--1521

    2021

  56. [64]

    Szyller et al., ``Dawn: Dynamic adversarial watermarking of neural networks,'' in MM, 2021, p

    S. Szyller et al., ``Dawn: Dynamic adversarial watermarking of neural networks,'' in MM, 2021, p. 4417–4425

    2021

  57. [65]

    Cao et al., ``Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary,'' in AsiaCCS, 2021, p

    X. Cao et al., ``Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary,'' in AsiaCCS, 2021, p. 14–25

    2021

  58. [66]

    Peng et al., ``Fingerprinting deep neural networks globally via universal adversarial perturbations,'' in CVPR, 2022, pp

    Z. Peng et al., ``Fingerprinting deep neural networks globally via universal adversarial perturbations,'' in CVPR, 2022, pp. 13\,430--13\,439

    2022

  59. [67]

    Lukas et al., ``Deep neural network fingerprinting by conferrable adversarial examples,'' in ICLR, 2021

    N. Lukas et al., ``Deep neural network fingerprinting by conferrable adversarial examples,'' in ICLR, 2021

    2021

  60. [68]

    Zheng et al., ``A dnn fingerprint for non-repudiable model ownership identification and piracy detection,'' IEEE TIFS, vol

    Y. Zheng et al., ``A dnn fingerprint for non-repudiable model ownership identification and piracy detection,'' IEEE TIFS, vol. 17, pp. 2977--2989, 2022

    2022

  61. [69]

    Maini et al., ``Dataset inference: Ownership resolution in machine learning,'' in ICLR, 2021

    P. Maini et al., ``Dataset inference: Ownership resolution in machine learning,'' in ICLR, 2021

    2021

  62. [70]

    Sablayrolles et al., ``Radioactive data: tracing through training,'' in ICML, 2020, pp

    A. Sablayrolles et al., ``Radioactive data: tracing through training,'' in ICML, 2020, pp. 8326--8335

    2020

  63. [71]

    Huang et al., ``Unlearnable examples: Making personal data unexploitable,'' in ICLR, 2021

    H. Huang et al., ``Unlearnable examples: Making personal data unexploitable,'' in ICLR, 2021

    2021

  64. [72]

    Wenger et al., `` SoK : Anti-facial recognition technology,'' in SP, 2023, pp

    E. Wenger et al., `` SoK : Anti-facial recognition technology,'' in SP, 2023, pp. 864--881

    2023

  65. [73]

    B. G. A. Tekgul and N. Asokan, ``On the effectiveness of dataset watermarking in adversarial settings,'' in IWSPA, 2022

    2022

  66. [74]

    Liu et al., ``Your model trains on my data? protecting intellectual property of training data via membership fingerprint authentication,'' IEEE TIFS, vol

    G. Liu et al., ``Your model trains on my data? protecting intellectual property of training data via membership fingerprint authentication,'' IEEE TIFS, vol. 17, pp. 1024--1037, 2022

    2022

  67. [75]

    Fredrikson et al., ``Model inversion attacks that exploit confidence information and basic countermeasures,'' in CCS, 2015, p

    M. Fredrikson et al., ``Model inversion attacks that exploit confidence information and basic countermeasures,'' in CCS, 2015, p. 1322–1333

    2015

  68. [76]

    Abadi et al., ``Deep learning with differential privacy,'' in CCS, 2016, pp

    M. Abadi et al., ``Deep learning with differential privacy,'' in CCS, 2016, pp. 308--318

    2016

  69. [77]

    Hu et al., `` SoK : Privacy-preserving data synthesis,'' in SP, 2024

    Y. Hu et al., `` SoK : Privacy-preserving data synthesis,'' in SP, 2024

    2024

  70. [78]

    Xie et al., ``Differentially private generative adversarial network,'' in ArXiv abs/1802.06739, 2018

    L. Xie et al., ``Differentially private generative adversarial network,'' in ArXiv abs/1802.06739, 2018

    2018 arXiv

  71. [79]

    Torkzadehmahani et al., ``Dp-cgan: Differentially private synthetic data and label generation,'' in CVPR, 2019

    R. Torkzadehmahani et al., ``Dp-cgan: Differentially private synthetic data and label generation,'' in CVPR, 2019

    2019

  72. [80]

    Zheng and B

    T. Zheng and B. Li, ``Differentially private dataset condensation,'' in AISCC--NDSS, 2023

    2023

  73. [81]

    Papernot et al., ``Semi-supervised knowledge transfer for deep learning from private training data,'' in ICLR, 2017

    N. Papernot et al., ``Semi-supervised knowledge transfer for deep learning from private training data,'' in ICLR, 2017

    2017

  74. [82]

    Jayaraman and D

    B. Jayaraman and D. Evans, ``Evaluating differentially private machine learning in practice,'' in USENIX Security, 2019

    2019

  75. [83]

    Chaudhuri et al., ``Differentially private empirical risk minimization.'' JMLR, vol

    K. Chaudhuri et al., ``Differentially private empirical risk minimization.'' JMLR, vol. 12, no. 3, 2011

    2011

  76. [84]

    M. B. Zafar et al., ``Fairness constraints: A flexible approach for fair classification,'' Journal of Machine Learning Research, vol. 20, no. 75, pp. 1--42, 2019

    2019

  77. [85]

    Hardt, E

    M. Hardt, E. Price, and N. Srebro, ``Equality of opportunity in supervised learning,'' in NeurIPS, 2016

    2016

  78. [86]

    Kamiran and T

    F. Kamiran and T. Calders, ``Data pre-processing techniques for classification without discrimination,'' Knowledge and Information Systems, vol. 33, 2011

    2011

  79. [87]

    Calmon et al., ``Optimized pre-processing for discrimination prevention,'' in NeurIPS, 2017

    F. Calmon et al., ``Optimized pre-processing for discrimination prevention,'' in NeurIPS, 2017

    2017

  80. [88]

    Zemel et al., ``Learning fair representations,'' in ICML, 2013, pp

    R. Zemel et al., ``Learning fair representations,'' in ICML, 2013, pp. 325--333

    2013

  81. [89]

    Feldman, S

    M. Feldman, S. A. Friedler, J. Moeller, C. Scheidegger, and S. Venkatasubramanian, ``Certifying and removing disparate impact,'' in KDD, 2015, pp. 259--268

    2015

  82. [90]

    Agarwal et al., ``A reductions approach to fair classification,'' in ICML, 2018, pp

    A. Agarwal et al., ``A reductions approach to fair classification,'' in ICML, 2018, pp. 60--69

    2018

  83. [91]

    120--129

    ------, ``Fair regression: Quantitative definitions and reduction-based algorithms,'' in ICML, 2019, pp. 120--129

    2019

  84. [92]

    L. E. Celis et al., ``Classification with fairness constraints: A meta-algorithm with provable guarantees,'' in FaccT, 2019, pp. 319--328

    2019

  85. [93]

    Kamishima et al., ``Fairness-aware classifier with prejudice remover regularizer,'' in Machine Learning and Knowledge Discovery in Databases, 2012, pp

    T. Kamishima et al., ``Fairness-aware classifier with prejudice remover regularizer,'' in Machine Learning and Knowledge Discovery in Databases, 2012, pp. 35--50

    2012

  86. [94]

    B. H. Zhang, B. Lemoine, and M. Mitchell, ``Mitigating unwanted biases with adversarial learning,'' in AIES, 2018, pp. 335--340

    2018

  87. [95]

    Louppe et al., ``Learning to pivot with adversarial networks,'' in NeurIPS, 2017

    G. Louppe et al., ``Learning to pivot with adversarial networks,'' in NeurIPS, 2017

    2017

  88. [96]

    Pinz\' o n, C

    C. Pinz\' o n, C. Palamidessi, P. Piantanida, and F. Valencia, ``On the incompatibility of accuracy and equal opportunity,'' Machine Learning, vol. 113, p. 2405–2434, 2023

    2023

  89. [97]

    Pleiss et al., ``On fairness and calibration,'' in NeurIPS, 2017

    G. Pleiss et al., ``On fairness and calibration,'' in NeurIPS, 2017

    2017

  90. [98]

    Kamiran, A

    F. Kamiran, A. Karim, and X. Zhang, ``Decision theory for discrimination-aware classification,'' in ICDM, 2012, pp. 924--929

    2012

  91. [99]

    S. C. Geyik and Aothers, ``Fairness-aware ranking in search & recommendation systems with application to linkedin talent search,'' in KDD, 2019, pp. 2221--2231

    2019

  92. [100]

    Salvador et al., ``Faircal: Fairness calibration for face verification,'' in ICLR, 2022

    T. Salvador et al., ``Faircal: Fairness calibration for face verification,'' in ICLR, 2022

    2022

  93. [101]

    Kull et al., `` Beta calibration: a well-founded and easily implemented improvement on logistic calibration for binary classifiers ,'' in AISTATS, 2017, pp

    M. Kull et al., `` Beta calibration: a well-founded and easily implemented improvement on logistic calibration for binary classifiers ,'' in AISTATS, 2017, pp. 623--631

    2017

  94. [102]

    Hebert-Johnson et al., ``Multicalibration: Calibration for the ( C omputationally-identifiable) masses,'' in ICML, 2018, pp

    U. Hebert-Johnson et al., ``Multicalibration: Calibration for the ( C omputationally-identifiable) masses,'' in ICML, 2018, pp. 1939--1948

    2018

  95. [103]

    Paudice et al., ``Label sanitization against label flipping poisoning attacks,'' in ECML PKDD, 2019, pp

    A. Paudice et al., ``Label sanitization against label flipping poisoning attacks,'' in ECML PKDD, 2019, pp. 5--15

    2019

  96. [104]

    Kearns et al., ``Preventing fairness gerrymandering: Auditing and learning for subgroup fairness,'' in ICML, 2018, pp

    M. Kearns et al., ``Preventing fairness gerrymandering: Auditing and learning for subgroup fairness,'' in ICML, 2018, pp. 2564--2572

    2018

  97. [105]

    100--109

    ------, ``An empirical study of rich subgroup fairness for machine learning,'' in FaccT, 2019, pp. 100--109

    2019

  98. [106]

    A. A. Ismail et al., ``Improving deep learning interpretability by saliency guided training,'' in NeurIPS, 2021

    2021

  99. [107]

    Smilkov et al., ``Smoothgrad: removing noise by adding noise,'' in ArXiv abs/1706.03825, 2017

    D. Smilkov et al., ``Smoothgrad: removing noise by adding noise,'' in ArXiv abs/1706.03825, 2017

    2017 arXiv

  100. [108]

    Sundararajan et al., ``Axiomatic attribution for deep networks,'' in ICML, 2017, p

    M. Sundararajan et al., ``Axiomatic attribution for deep networks,'' in ICML, 2017, p. 3319–3328

    2017

  101. [109]

    P. W. Koh and P. Liang, ``Understanding black-box predictions via influence functions,'' in ICML, 2017, pp. 1885--1894

    2017

  102. [110]

    Wachter et al., ``Counterfactual explanations without opening the black box: Automated decisions and the gdpr,'' Cybersecurity, 2017

    S. Wachter et al., ``Counterfactual explanations without opening the black box: Automated decisions and the gdpr,'' Cybersecurity, 2017

    2017

  103. [111]

    R. R. Selvaraju et al., ``Grad-cam: Visual explanations from deep networks via gradient-based localization,'' in ICCV, 2017, pp. 618--626

    2017

  104. [112]

    Kim et al., ``Interpretability beyond feature attribution: Quantitative testing with concept activation vectors (tcav),'' in ICML, 2018, pp

    B. Kim et al., ``Interpretability beyond feature attribution: Quantitative testing with concept activation vectors (tcav),'' in ICML, 2018, pp. 2668--2677

    2018

  105. [113]

    Guidotti et al., ``A survey of methods for explaining black box models,'' ACM Computing Surveys, vol

    R. Guidotti et al., ``A survey of methods for explaining black box models,'' ACM Computing Surveys, vol. 51, pp. 1 -- 42, 2018

    2018

  106. [114]

    Aalmoes et al., ``On the alignment of group fairness with attribute privacy,'' in WISE, 2024

    J. Aalmoes et al., ``On the alignment of group fairness with attribute privacy,'' in WISE, 2024

    2024

  107. [115]

    Xin et al., ``On the connection between invariant learning and adversarial training for out-of-distribution generalization,'' in AAAI, 2023, pp

    S. Xin et al., ``On the connection between invariant learning and adversarial training for out-of-distribution generalization,'' in AAAI, 2023, pp. 10\,519--10\,527

    2023

  108. [116]

    Hu et al., ``Outlier robust adversarial training,'' in ACML, 2023

    S. Hu et al., ``Outlier robust adversarial training,'' in ACML, 2023

    2023

  109. [117]

    Thakkar, G

    J. Thakkar, G. Zizzo, and S. Maffeis, ``Elevating defenses: Bridging adversarial training and watermarking for model resilience,'' in Workshop on Deployable AI@AAAI, 2023

    2023

  110. [118]

    Bu et al., ``Practical adversarial training with differential privacy for deep learning,'' 2022

    Z. Bu et al., ``Practical adversarial training with differential privacy for deep learning,'' 2022

    2022

  111. [119]

    Wu et al., ``Augment then smooth: Reconciling differential privacy with certified robustness,'' in TMLR, 2024

    J. Wu et al., ``Augment then smooth: Reconciling differential privacy with certified robustness,'' in TMLR, 2024

    2024

  112. [120]

    Phan et al., ``Heterogeneous gaussian mechanism: Preserving differential privacy in deep learning with provable robustness,'' in arXiv:1906.01444, 2019

    N. Phan et al., ``Heterogeneous gaussian mechanism: Preserving differential privacy in deep learning with provable robustness,'' in arXiv:1906.01444, 2019

    1906 arXiv

  113. [121]

    Phan et al., ``Scalable differential privacy with certified robustness in adversarial learning,'' in ICML, 2020, pp

    H. Phan et al., ``Scalable differential privacy with certified robustness in adversarial learning,'' in ICML, 2020, pp. 7683--7694

    2020

  114. [122]

    Zhang and Z

    Y. Zhang and Z. Bu, ``Differentially private optimizers can learn adversarially robust models,'' TMLR, 2024

    2024

  115. [123]

    He et al., ``Robustness, privacy, and generalization of adversarial training,'' in arXiv:2012.13573, 2020

    F. He et al., ``Robustness, privacy, and generalization of adversarial training,'' in arXiv:2012.13573, 2020

    2012 arXiv

  116. [124]

    Xu et al., ``Mitigating data poisoning in text classification with differential privacy,'' in EMNLP, 2021, pp

    C. Xu et al., ``Mitigating data poisoning in text classification with differential privacy,'' in EMNLP, 2021, pp. 4348--4356

    2021

  117. [125]

    Vos et al., ``Differentially-private decision trees with probabilistic robustness to data poisoning,'' in arXiv:2305.15394, 2023

    D. Vos et al., ``Differentially-private decision trees with probabilistic robustness to data poisoning,'' in arXiv:2305.15394, 2023

    2023 arXiv

  118. [126]

    Y. Ma, X. Zhu, and J. Hsu, ``Data poisoning against differentially-private learners: Attacks and defenses,'' in IJCAI, 2019

    2019

  119. [127]

    Tran et al., ``On the effects of fairness to adversarial vulnerability,'' in IJCAI, 2024

    C. Tran et al., ``On the effects of fairness to adversarial vulnerability,'' in IJCAI, 2024

    2024

  120. [128]

    Ali Mousavi et al., ``Farmur: Fair adversarial retraining to mitigate unfairness in robustness,'' in Advances in Databases and Information Systems, 2023, pp

    S. Ali Mousavi et al., ``Farmur: Fair adversarial retraining to mitigate unfairness in robustness,'' in Advances in Databases and Information Systems, 2023, pp. 133--145

    2023

  121. [129]

    Benz et al., ``Robustness may be at odds with fairness: An empirical study on class-wise accuracy,'' in NeurIPS 2020 Workshop on Pre-registration in Machine Learning, 2021

    P. Benz et al., ``Robustness may be at odds with fairness: An empirical study on class-wise accuracy,'' in NeurIPS 2020 Workshop on Pre-registration in Machine Learning, 2021

    2020

  122. [130]

    X. Ma, Z. Wang, and W. Liu, ``On the tradeoff between robustness and fairness,'' in NeurIPS, 2022, pp. 26\,230--26\,241

    2022

  123. [131]

    Nanda et al., ``Fairness through robustness: Investigating robustness disparity in deep learning,'' in FaccT, 2021, pp

    V. Nanda et al., ``Fairness through robustness: Investigating robustness disparity in deep learning,'' in FaccT, 2021, pp. 466--477

    2021

  124. [132]

    Xu et al., ``To be robust or to be fair: Towards fairness in adversarial training,'' in ICML, 2021, pp

    H. Xu et al., ``To be robust or to be fair: Towards fairness in adversarial training,'' in ICML, 2021, pp. 3000--3008

    2021

  125. [133]

    Sun et al., ``Towards fair and robust classification,'' in EuroS&P, 2022, pp

    H. Sun et al., ``Towards fair and robust classification,'' in EuroS&P, 2022, pp. 356--376

    2022

  126. [134]

    Li and W

    B. Li and W. Liu, ``Wat: improve the worst-class robustness in adversarial training,'' in AAAI, 2023, pp. 14\,982--14\,990

    2023

  127. [135]

    Lee et al., `` DAFA : Distance-aware fair adversarial training,'' in ICLR, 2024

    H. Lee et al., `` DAFA : Distance-aware fair adversarial training,'' in ICLR, 2024

    2024

  128. [136]

    Wei et al., ``Cfa: Class-wise calibrated fair adversarial training,'' in CVPR, 2023, pp

    Z. Wei et al., ``Cfa: Class-wise calibrated fair adversarial training,'' in CVPR, 2023, pp. 8193--8201

    2023

  129. [137]

    D. P and S. Abraham, ``Fairlof: Fairness in outlier detection,'' Data Science and Engineering, vol. 6, 2021

    2021

  130. [138]

    Liu et al., ``Fairness-aware outlier ensemble,'' in arXiv:2103.09419, 2021

    H. Liu et al., ``Fairness-aware outlier ensemble,'' in arXiv:2103.09419, 2021

    2021 arXiv

  131. [139]

    Shekhar et al., ``Fairod: Fairness-aware outlier detection,'' in AIES, 2021, pp

    S. Shekhar et al., ``Fairod: Fairness-aware outlier detection,'' in AIES, 2021, pp. 210--220

    2021

  132. [140]

    Zhang and I

    H. Zhang and I. Davidson, ``Towards fair deep anomaly detection,'' in FaccT, 2021, pp. 138--148

    2021

  133. [141]

    Tran et al., ``Differentially private and fair deep learning: A lagrangian dual approach,'' in AAAI, 2021, pp

    C. Tran et al., ``Differentially private and fair deep learning: A lagrangian dual approach,'' in AAAI, 2021, pp. 9932--9939

    2021

  134. [142]

    Liu et al., ``Mitigating disparate impact on model accuracy in differentially private learning,'' Information Sciences, vol

    W. Liu et al., ``Mitigating disparate impact on model accuracy in differentially private learning,'' Information Sciences, vol. 616, pp. 108--126, 2022

    2022

  135. [143]

    Lowy et al., ``Stochastic differentially private and fair learning,'' in ICLR, 2023, pp

    A. Lowy et al., ``Stochastic differentially private and fair learning,'' in ICLR, 2023, pp. 86--119

    2023

  136. [144]

    Jagielski et al., ``Differentially private fair learning,'' in ICML, 2019

    M. Jagielski et al., ``Differentially private fair learning,'' in ICML, 2019

    2019

  137. [145]

    Tran et al., ``Differentially private empirical risk minimization under the fairness lens,'' in NeurIPS, 2021, pp

    C. Tran et al., ``Differentially private empirical risk minimization under the fairness lens,'' in NeurIPS, 2021, pp. 27\,555--27\,565

    2021

  138. [146]

    Yaghini et al., ``Regulation games for trustworthy machine learning,'' in Workshop on Regulatable ML@NeurIPS, 2023

    M. Yaghini et al., ``Regulation games for trustworthy machine learning,'' in Workshop on Regulatable ML@NeurIPS, 2023

    2023

  139. [147]

    Ding et al., ``Differentially private and fair classification via calibrated functional mechanism,'' in AAAI, 2020, pp

    J. Ding et al., ``Differentially private and fair classification via calibrated functional mechanism,'' in AAAI, 2020, pp. 622--629

    2020

  140. [148]

    D. Xu, S. Yuan, and X. Wu, ``Achieving differential privacy and fairness in logistic regression,'' in WWW, 2019, p. 594–599

    2019

  141. [149]

    Zhang et al., ``Balancing learning model privacy, fairness, and accuracy with early stopping criteria,'' IEEE TNNLS, 2021

    T. Zhang et al., ``Balancing learning model privacy, fairness, and accuracy with early stopping criteria,'' IEEE TNNLS, 2021

    2021

  142. [150]

    M. S. Esipova et al., ``Disparate impact in differential privacy from gradient misalignment,'' in ICLR, 2023

    2023

  143. [151]

    Xu et al., ``Removing disparate impact of differentially private stochastic gradient descent on model accuracy,'' in KDD, 2021

    D. Xu et al., ``Removing disparate impact of differentially private stochastic gradient descent on model accuracy,'' in KDD, 2021

    2021

  144. [152]

    K. Tran, F. Fioretto, I. Khalil, M. T. Thai, and N. Phan, ``Fairdp: Certified fairness with differential privacy,'' in arXiv:2305.16474, 2023

    2023 arXiv

  145. [153]

    Lakkaraju et al., ``Robust and stable black box explanations,'' in ICML, 2020, pp

    H. Lakkaraju et al., ``Robust and stable black box explanations,'' in ICML, 2020, pp. 5628--5638

    2020

  146. [154]

    Chen et al., ``Robust attribution regularization,'' in NeurIPS, 2019

    J. Chen et al., ``Robust attribution regularization,'' in NeurIPS, 2019

    2019

  147. [155]

    Li et al., ``Are data-driven explanations robust against out-of-distribution data?'' in CVPR, 2023, pp

    T. Li et al., ``Are data-driven explanations robust against out-of-distribution data?'' in CVPR, 2023, pp. 3821--3831

    2023

  148. [156]

    Yang et al., ``Differentially private counterfactuals via functional mechanism,'' in arXiv:2208.02878, 2022

    F. Yang et al., ``Differentially private counterfactuals via functional mechanism,'' in arXiv:2208.02878, 2022

    2022 arXiv

  149. [157]

    Patel, R

    N. Patel, R. Shokri, and Y. Zick, ``Model explanations with differential privacy,'' in FaccT, 2022, p. 1895–1904

    2022

  150. [158]

    Hayes et al., ``Learning to be adversarially robust and differentially private,'' in PPML Workshop, 2021

    J. Hayes et al., ``Learning to be adversarially robust and differentially private,'' in PPML Workshop, 2021

    2021

  151. [159]

    Hu et al., ``Understanding the impact of adversarial robustness on accuracy disparity,'' in ICML, 2023, pp

    Y. Hu et al., ``Understanding the impact of adversarial robustness on accuracy disparity,'' in ICML, 2023, pp. 13\,679--13\,709

    2023

  152. [160]

    Chalasani et al., ``Concise explanations of neural networks using adversarial training,'' in ICML, 2020, pp

    P. Chalasani et al., ``Concise explanations of neural networks using adversarial training,'' in ICML, 2020, pp. 1383--1391

    2020

  153. [161]

    Jagielski and A

    M. Jagielski and A. Oprea, ``Does differential privacy defeat data poisoning?'' ICLR, 2021

    2021

  154. [162]

    Bagdasaryan et al., ``Differential privacy has disparate impact on model accuracy,'' in NeurIPS, 2019

    E. Bagdasaryan et al., ``Differential privacy has disparate impact on model accuracy,'' in NeurIPS, 2019

    2019

  155. [163]

    Cummings et al., ``On the compatibility of privacy and fairness,'' in UMAP, 2019, p

    R. Cummings et al., ``On the compatibility of privacy and fairness,'' in UMAP, 2019, p. 309–315

    2019

  156. [164]

    Agarwal, ``Trade-offs between fairness and privacy in machine learning,'' in IJCAI Workshop on AI for Social Good, 2021

    S. Agarwal, ``Trade-offs between fairness and privacy in machine learning,'' in IJCAI Workshop on AI for Social Good, 2021

    2021

  157. [165]

    Mozannar, M

    H. Mozannar, M. Ohannessian, and N. Srebro, ``Fair learning with private demographic data,'' in ICML, 2020, pp. 7066--7075

    2020

  158. [166]

    Banisar, ``The right to information and privacy: Balancing rights and managing conflicts,'' SSRN Electronic Journal, 2011

    D. Banisar, ``The right to information and privacy: Balancing rights and managing conflicts,'' SSRN Electronic Journal, 2011

    2011

  159. [167]

    Kemker, M

    R. Kemker, M. McClure, A. Abitino, T. Hayes, and C. Kanan, ``Measuring catastrophic forgetting in neural networks,'' in AAAI, 2018

    2018

  160. [168]

    Dwork and A

    C. Dwork and A. Roth, ``The algorithmic foundations of differential privacy,'' Found. Trends Theor. Comput. Sci., vol. 9, no. 3–4, p. 211–407, Aug. 2014

    2014

  161. [169]

    Kang et al., ``Diffattack: Evasion attacks against diffusion-based adversarial purification,'' in NeurIPS, 2024

    M. Kang et al., ``Diffattack: Evasion attacks against diffusion-based adversarial purification,'' in NeurIPS, 2024

    2024

  162. [170]

    P. W. Koh, J. Steinhardt, and P. Liang, ``Stronger data poisoning attacks break data sanitization defenses,'' Machine Learning, vol. 111, pp. 1--47, 2022

    2022

  163. [171]

    Gu et al., ``Badnets: Identifying vulnerabilities in the machine learning model supply chain,'' in arXiv:1708.06733, 2017

    T. Gu et al., ``Badnets: Identifying vulnerabilities in the machine learning model supply chain,'' in arXiv:1708.06733, 2017

    2017 arXiv

  164. [172]

    Z. Sha, X. He, P. Berrang, M. Humbert, and Y. Zhang, ``Fine-tuning is all you need to mitigate backdoor attacks,'' in arXiv preprint arXiv:2212.09067, 2022

    2022 arXiv

  165. [173]

    Y. Li, Z. Zhang, J. Bai, B. Wu, Y. Jiang, and S.-T. Xia, ``Open-sourced dataset protection via backdoor watermarking,'' in NeurIPS Workshop on Dataset Curation and Security, 2020

    2020

  166. [174]

    Yousefpour et al., ``Opacus: User-friendly differential privacy library in pytorch,'' in arXiv:2109.12298, 2021

    A. Yousefpour et al., ``Opacus: User-friendly differential privacy library in pytorch,'' in arXiv:2109.12298, 2021

    2021 arXiv

  167. [175]

    Han et al., `` FFB : A fair fairness benchmark for in-processing group fairness methods,'' in ICLR, 2024

    X. Han et al., `` FFB : A fair fairness benchmark for in-processing group fairness methods,'' in ICLR, 2024

    2024

  168. [176]

    Kokhlikyan et al., ``Captum: A unified and generic model interpretability library for pytorch,'' in arXiv:2009.07896, 2020

    N. Kokhlikyan et al., ``Captum: A unified and generic model interpretability library for pytorch,'' in arXiv:2009.07896, 2020

    2009 arXiv

  169. [177]

    Shrikumar et al., ``Learning important features through propagating activation differences,'' in ICML, 2017, pp

    A. Shrikumar et al., ``Learning important features through propagating activation differences,'' in ICML, 2017, pp. 3145--3153

    2017

  170. [178]

    Y.-Y. Yang, C. Rashtchian, H. Zhang, R. R. Salakhutdinov, and K. Chaudhuri, ``A closer look at accuracy vs. robustness,'' in NeurIPS, 2020, pp. 8588--8601

    2020

  171. [179]

    T. Pang, M. Lin, X. Yang, J. Zhu, and S. Yan, ``Robustness and accuracy could be reconcilable by (proper) definition,'' in ICML, 2022, pp. 17\,258--17\,277

    2022

  172. [180]

    Raghunathan, S

    A. Raghunathan, S. M. Xie, F. Yang, J. Duchi, and P. Liang, ``Understanding and mitigating the tradeoff between robustness and accuracy,'' ICML, 2020

    2020

  173. [181]

    J. Ye, Z. Zhu, F. Liu, R. Shokri, and V. Cevher, ``Initialization matters: Privacy-utility analysis of overparameterized neural networks,'' in NeurIPS, 2023, pp. 5419--5446

    2023

  174. [182]

    Papernot, A

    N. Papernot, A. Thakurta, S. Song, S. Chien, and \'U . Erlingsson, ``Tempered sigmoid activations for deep learning with differential privacy,'' in AAAI, 2021, pp. 9312--9321

    2021

  175. [183]

    Tram \`e r and D

    F. Tram \`e r and D. Boneh, ``Differentially private learning needs better features (or much more data),'' in ICLR, 2020

    2020

  176. [184]

    Dwork et al., ``Fairness through awareness,'' in ITCS, 2012, p

    C. Dwork et al., ``Fairness through awareness,'' in ITCS, 2012, p. 214–226

    2012

  177. [185]

    Xu and S

    H. Xu and S. Mannor, ``Robustness and generalization,'' Machine learning, vol. 86, pp. 391--423, 2012

    2012

  178. [186]

    Ehyaei, G

    A.-R. Ehyaei, G. Farnadi, and S. Samadi, ``Causal fair metric: Bridging causality, individual fairness, and adversarial robustness,'' in arXiv:2310.19391, 2023

    2023 arXiv

  179. [187]

    Kleinberg and S

    J. Kleinberg and S. Mullainathan, ``Simplicity creates inequity: implications for fairness, stereotypes, and interpretability,'' in EC, 2019, pp. 807--808

    2019

  180. [188]

    Agarwal, ``Trade-offs between fairness and interpretability in machine learning,'' in IJCAI Workshop on AI for Social Good, 2021

    S. Agarwal, ``Trade-offs between fairness and interpretability in machine learning,'' in IJCAI Workshop on AI for Social Good, 2021

    2021

  181. [189]

    Nori et al., ``Accuracy, interpretability, and differential privacy via explainable boosting,'' in ICML, 2021, pp

    H. Nori et al., ``Accuracy, interpretability, and differential privacy via explainable boosting,'' in ICML, 2021, pp. 8227--8237

    2021

  182. [190]

    Harder et al., ``Interpretable and differentially private predictions,'' AAAI, pp

    F. Harder et al., ``Interpretable and differentially private predictions,'' AAAI, pp. 4083--4090, 2020

    2020

  183. [191]

    Duddu et al., ``Fault tolerance of neural networks in adversarial settings,'' Journal of Intelligent & Fuzzy Systems, vol

    V. Duddu et al., ``Fault tolerance of neural networks in adversarial settings,'' Journal of Intelligent & Fuzzy Systems, vol. 38, no. 5, pp. 5897--5907, 2020

    2020

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.