Pith. sign in

REVIEW 4 major objections 6 minor 68 references

Learning from the Good Ones: Risk Profiling-Based Defenses Against Evasion Attacks on DNNs

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A risk-profiling framework selects resilient patients to train anomaly detectors, lifting recall by up to 27.5%.

desk verdict A plausible risk-profiling idea for training static anomaly detectors, but the headline recall gain rests on an evaluation protocol that likely includes training patients in the test set, so the central claim is not yet established. read the letter →

arxiv 2505.06477 v1 pith:SF3YBOEM submitted 2025-05-10 cs.CR

Mohammed Elnawawy , Gargi Mitra , Shahrear Iqbal , Karthik Pattabiraman This is my paper · ORCID
classification cs.CR
keywords evasionattacksanomalydetectionriskprofilingselectivetrainingbloodglucosemanagementdeepneuralnetworksfalsenegativesrecall
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a risk profiling framework that decides which data to use when training static anomaly detectors against evasion attacks on deep neural networks. Instead of training on all available instances, it simulates the attack, scores each victim's exposure over time, clusters victims by vulnerability, and trains the detector only on the least vulnerable ones. On a blood glucose management system for Type-1 diabetes, this selective training raises recall (true attack detection) by up to 27.5% for kNN and 16.8% for OneClassSVM over indiscriminate training, with little or no precision loss. The authors argue this matters because in safety-critical settings false negatives (missed attacks) can be life-threatening, so even a modest recall gain is worth pursuing.

What carries the argument

The central object is the risk profile, a time series of instantaneous risk values $R_t = S * Z_t$, where $Z_t$ is the squared difference between benign and adversarial glucose predictions and $S$ is a hand-assigned severity coefficient for the state transition (e.g., hypoglycemia to hyperglycemia gets 64). These profiles are computed for every patient, then clustered with hierarchical clustering to separate 'less vulnerable' from 'more vulnerable' victims. The framework's final step trains existing anomaly detectors (kNN, OneClassSVM, MAD-GAN) only on the data of the less-vulnerable cluster. The risk profile and clustering carry the argument because they identify which instances the defense should learn from.

What would settle it

Train the same three anomaly detectors on the 'less vulnerable' patients identified using a different severity-coefficient set (e.g., linear coefficients or values from a clinician) and a different clustering threshold; if the recall gain over indiscriminate training disappears or reverses, the result is an artifact of the specific coefficient and clustering choices rather than of vulnerability-based selective training.

Watch

Extended reading notes

Core claim

The central discovery is that training static anomaly detectors on the instances least vulnerable to a specific evasion attack improves their ability to catch that attack, compared with training on the full dataset. The paper demonstrates this on the OhioT1DM blood glucose dataset using the URET attack: patients whom the risk framework labels 'less vulnerable' produce detectors with recall increases of 27.5% (kNN), 16.8% (OneClassSVM), and unchanged perfect recall for MAD-GAN at 75% less training data. The authors interpret this as evidence that less vulnerable instances better represent typical benign data, so detectors learn to distinguish benign from malicious abnormalities.

Load-bearing premise

The hand-picked exponential severity coefficients and the hierarchical clustering cut decide which patients are called 'less vulnerable,' and the entire recall improvement depends on those choices marking out the same patients that are actually hardest to attack.

Editorial extensions

If this is right

  • Static anomaly detectors can become more adaptable to evolving attacks without the computational cost of dynamic defenses, by retraining on freshly profiled low-risk instances.
  • In safety-critical medical settings, reducing false negatives through selective training may prevent missed attack detections that could lead to insulin overdose or underdose.
  • Training on a smaller, curated subset can cut training cost and data requirements; the MAD-GAN result shows maintained recall with a 75% reduction in training-set size.
  • The framework's reliance on attack simulation means the selected 'less vulnerable' instances are attack-specific, so the defense is tied to the threat model used in profiling.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same selective-training principle could apply beyond healthcare: any static detector facing evasion attacks in cyber-physical systems (e.g., autonomous driving) might benefit from profiling instances for vulnerability and training on the most typical ones.
  • The paper validates its clusters against the very attack success rates the defense is meant to detect; a cleaner future test would profile with one attack and evaluate with a different attack, to see whether the identified 'less vulnerable' instances generalize.
  • If the risk coefficients are clinician-specified, the framework could become a practical tool for personalized medicine, where each patient's physiology determines their training weight.
  • The reported recall gains might partly reflect a decrease in training-set noise rather than vulnerability per se; an ablation that trains on random small subsets of equal size would isolate the effect of the risk-based selection.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a risk profiling framework for selectively training static anomaly detectors on victim instances (patients) judged less vulnerable to evasion attacks, with the goal of reducing false negatives while retaining precision. The framework simulates a URET evasion attack, computes an instantaneous risk R_t = S * Z_t (Eq. 1), constructs patient risk profiles, hierarchically clusters the profiles, labels clusters by cross-checking against attack success percentages, and trains kNN, OneClassSVM, and MAD-GAN detectors on the less-vulnerable cluster. On an OhioT1DM blood-glucose case study, the authors report recall increases of 27.5% for kNN and 16.8% for OneClassSVM with small precision penalty, and unchanged recall for MAD-GAN at a 75% training-set reduction.

Significance. Selective data selection for training anomaly detectors is a practical and under-explored idea, and the risk-profiling formulation is a plausible way to identify a 'robust subset' without modifying the underlying DNN. The paper extends prior work by reproducing the URET attack on Subset A and by comparing three detectors under four training regimes. If the reported recall gains survive a clean held-out evaluation, the approach would be an inexpensive complement to dynamic defenses for safety-critical systems. However, the current evaluation protocol and the circular cluster labeling leave the central quantitative claim unsupported; the contribution is best described as a promising approach needing validation rather than an established result.

major comments (4)
  1. [Section IV, Step 5 / Appendix D] The evaluation protocol does not establish an out-of-sample test. The text says detectors were trained on the less vulnerable patients and 'independently tested the entire set of patients and then averaged the results'; this test set includes the training patients, so for kNN, OneClassSVM, and MAD-GAN, memorization of training points can inflate recall. The claim that testing only on the held-out more vulnerable patients gives 'similar' rates is asserted without a figure, table, or numeric result. Please report recall, precision, and F1 separately for (i) the less-vulnerable training patients alone, (ii) the more-vulnerable held-out patients alone, and (iii) the pooled test set, and clearly identify which of these supports the 27.5% recall-increase figure.
  2. [Section IV, Step 4] The vulnerability labels are derived from the very attack outcomes the detectors are meant to catch. The clusters are labeled 'less vulnerable' by cross-checking with URET misclassification percentages, and the subsequent evaluation measures detection of URET adversarial samples on the same patients. This selection circularity means the reported improvement partly reflects the selection criterion rather than a general property of the resulting detector. Please validate the cluster labels on a held-out condition (e.g., a different attack budget, a different attack algorithm, or unseen patients) and justify how the method would be applied when ground-truth attack success is not available at deployment time.
  3. [Appendix B] The kNN detector is implemented via KNeighborsClassifier, which is a supervised classifier, not a standard anomaly detector; the paper never states what training labels are used for this classifier or what decision rule (distance threshold, k-neighborhood density, etc.) flags a test point as adversarial. Without this specification, the recall and precision values for the headline kNN result are not interpretable and cannot be compared with OneClassSVM and MAD-GAN. Please specify the detection rule and how it maps to anomaly detection.
  4. [Equations (1)-(2) and Table I] The risk profiles and hence the less-vulnerable clusters depend on hand-picked exponential severity coefficients; Section V concedes this as a validity threat, but no sensitivity analysis is provided. Since the central selection step is driven by these coefficients, a small perturbation of Table I could change which patients fall into the less-vulnerable cluster and potentially erase the claimed 27.5% recall increase. Please report robustness of the clusters and of the downstream recall to alternative coefficient sets and to different cuts of the hierarchical clustering dendrogram.
minor comments (6)
  1. [Equation (1)] Equation (1) uses 't ⊂ N'; this should be 't ∈ N' (or the intended set membership should be stated clearly).
  2. [Figure 3] The dendrograms lack a distance axis and clear cluster labels; readers cannot verify the 'maximum distance' cut that produces the two-cluster split.
  3. [Figures 7, 8, and 11] The box plots do not state whether they summarize per-patient or per-sample recall and precision, nor the number of replicates; please specify the aggregation unit and sample size.
  4. [Section III] In the description of the target glucose model, 'Rubine-Falcone et al.' should be 'Rubin-Falcone et al.'
  5. [References] Reference [65] appears incomplete, consisting only of the text 'Hypoglycemia (low blood sugar)'; please provide full bibliographic details.
  6. [Throughout] The paper uses 'indiscriminately trained on the entire dataset' without specifying whether the 'entire set' means all 12 patients or all training samples from all patients; please clarify the baseline training set.

Circularity Check

3 steps flagged · score 6.0 of 10

The 'less vulnerable' training subset is labeled using URET attack success rates and then evaluated on the same URET attack and the same patients, so the headline recall gains are partially forced by construction.

  1. fitted input called prediction [Section IV, Step 4 (Cluster Labeling), after Figure 3]
    "By cross-checking the resulting clusters with the misclassification percentages due to the attack reported in Elnawawy et al. [49], on Subset B and our extended experiments on Subset A (Appendix A), we notice that patient 5 from Subset A and patients 1 and 2 from Subset B (placed in separate clusters by our risk profiling framework) tend to have the lowest misclassification percentage, meaning that these patients were less vulnerable to the URET attack. ..."

    The 'less vulnerable' training subset is defined by the URET attack's success rates (misclassification percentages). The same URET attack is then used to generate the malicious samples whose detection recall is reported (Figure 7: recall increase of 27.5% for kNN, 16.8% for OneClassSVM). Thus the selection of training patients is not an independent first-principles risk model; it is fitted to the very attack outcomes the detectors are supposed to catch. Training on patients known to be hard for URET and then measuring URET detection on those patients makes the recall gain partly an artifact of the selection oracle rather than a prediction about detector generalization.

  2. fitted input called prediction [Appendix D (Discussion)]
    "In our experiments, we trained anomaly detectors on the less vulnerable patients and independently tested the entire set of patients and then averaged the results to aggregate them in box plots. That means that we conducted experiments where the test set consisted of only the more vulnerable patients that were not seen during the training stage."

    The main-text recall figures lack a stated test split, and this appendix states that the test set was 'the entire set of patients'—which includes the less-vulnerable patients used for training. For kNN, OneClassSVM, and MAD-GAN, evaluating on training instances can reward memorization rather than a better decision boundary, so the headline 27.5% recall improvement is not a held-out prediction. The appendix's unsupported assertion that testing only on unseen more-vulnerable patients gave 'similar' rates cannot repair the reported numbers, which are the paper's central evidence.

1 more flagged steps
  1. self citation load bearing [Section IV, Step 1 (Attack Simulation) and Step 4 (Cluster Labeling)]
    "In their demonstration of the URET evasion attack on the OhioT1DM dataset using the attack settings presented earlier, Elnawawy et al. [49] show that patients respond differently to the same attack settings as they show different vulnerability levels to the attack. In particular, Elnawawy et al. [49] report attack success rates ... This suggests that it is more challenging for URET to attack specific patients who show more resilience to the attack [49]."

    The framework's load-bearing premise—that patients divide into less/more vulnerable groups—and the actual cluster labels for Subset B are taken from the authors' own prior paper [49], not from an independent or machine-checked source. The current paper's Appendix A extends URET experiments to Subset A, but for Subset B the labels rest entirely on [49]. Because [49] is by the same research group and is used to define 'less vulnerable' before the same attack is used for evaluation, the self-citation is load-bearing rather than independent support.

full rationale

The derivation chain for the headline claim has two points where an input is reused as the predicted output. First, the 'less vulnerable' clusters are labeled using URET misclassification percentages from the authors' prior paper [49] and their own Appendix A; this label is then used to select training data, and the evaluation measures recall on URET-generated attacks. This makes the vulnerability grouping an oracle informed by the attack outcomes rather than an independent risk model. Second, Appendix D states the detectors were tested on the entire set of patients, which includes the training patients, so the reported 27.5% recall improvement is not a clean out-of-sample prediction; for memory-based detectors (kNN, OneClassSVM, MAD-GAN) this can inflate the result. The severity coefficients in Eq. (1) are hand-set and acknowledged as a threat to validity, but they are not circular—they are a stated assumption. The framework's clustering step is unsupervised and not itself circular, and the detectors are standard external methods, so the paper is not wholly reducible to its inputs. Overall, partial circularity: the central claim is partly forced by construction and by self-citation. Score 6.

Assumptions & free parameters 4 free parameters · 5 assumptions · 2 invented entities

The framework's central claim rests on hand-chosen severity coefficients, a clustering step whose labels are validated with the same attack outcomes used in evaluation, and an unverified implementation of the anomaly detectors. The free parameters are not fitted to data in a conventional sense but are chosen by the authors and directly affect which patients are selected for training. The risk profile construct is introduced internally and lacks independent evidence.

free parameters (4)
  • Severity coefficients S for state transitions = 64, 32, 16, 8, 4, 2
    Chosen by hand as exponential powers of 2 to reflect assumed nonlinear clinical risk; directly shape the risk profiles and the resulting clusters, with no sensitivity analysis provided (Section IV, Table I).
  • Number of vulnerability clusters = 2
    Chosen by pruning the dendrogram at the maximum distance (Figure 3); a different pruning would change the less-vulnerable training set.
  • Exponent in deviation term Z_t = 2
    The squared error is chosen 'inspired by the mean squared error'; other exponents would change the risk profiles and cluster assignments.
  • Less-vulnerable training subset size = 3 patients
    The clustering naturally yields exactly three less-vulnerable patients; the random baseline uses the same size for fairness, but the size is a consequence of the clustering choices rather than a principled selection.
assumptions (5)
  • domain assumption The OhioT1DM dataset and the Rubin-Falcone LSTM model accurately represent a real BGMS for evaluation purposes.
    The paper uses a prior model [48] as a stand-in for confidential commercial glucose predictors and assumes the dataset is representative (Section III).
  • domain assumption The URET attack with glucose constraints (125-499 mg/dL fasting, 180-499 mg/dL postprandial) is a valid model of realistic evasion attacks on CGM systems.
    The threat model assumes the attacker can only alter CGM measurements via Bluetooth exploits and that manipulated values must remain in physiological ranges (Section III).
  • domain assumption The three anomaly detectors are correctly implemented and can be trained in the described selective manner.
    The paper uses standard libraries but does not describe how kNN is used as an anomaly detector (e.g., the classification rule or threshold); the central results depend on these implementations (Section IV, Appendix B).
  • ad hoc to paper Hierarchical clustering with the chosen distance metric and linkage produces meaningful risk groups.
    The distance metric and linkage criterion are not specified; the dendrograms are pruned by visual inspection (Section IV, Step 4).
  • ad hoc to paper Exponential severity coefficients reflect the true clinical risk ordering of state transitions.
    The coefficients are not derived from clinical data or specialists; the paper itself lists this as a threat to validity in Section V.
invented entities (2)
  • Victim risk profile
    purpose: A time-series of instantaneous risk values R_t for each patient, used to cluster patients by vulnerability and select training data.
    The risk profile is defined entirely by the paper's own risk formula and hand-chosen severity coefficients; no external benchmark validates that it measures real-world vulnerability to evasion attacks.
  • Less-vulnerable cluster
    purpose: The set of patients with the most resilient features, used as the selective training set for anomaly detectors.
    Cluster membership is labeled using attack success rates from the same URET simulation used for evaluation, so it is not an independently measured property of the patients.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Learning from the Good Ones: Risk Profiling-Based Defenses Against Evasion Attacks on DNNs." pith.science (2026). https://pith.science/paper/SF3YBOEM

@misc{pith2026250506477,
  author       = {Pith},
  title        = {Pith review of: Learning from the Good Ones: Risk Profiling-Based Defenses Against Evasion Attacks on DNNs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SF3YBOEM}},
  note         = {Machine review of arXiv:2505.06477}
}
read the original abstract

Safety-critical applications such as healthcare and autonomous vehicles use deep neural networks (DNN) to make predictions and infer decisions. DNNs are susceptible to evasion attacks, where an adversary crafts a malicious data instance to trick the DNN into making wrong decisions at inference time. Existing defenses that protect DNNs against evasion attacks are either static or dynamic. Static defenses are computationally efficient but do not adapt to the evolving threat landscape, while dynamic defenses are adaptable but suffer from an increased computational overhead. To combine the best of both worlds, in this paper, we propose a novel risk profiling framework that uses a risk-aware strategy to selectively train static defenses using victim instances that exhibit the most resilient features and are hence more resilient against an evasion attack. We hypothesize that training existing defenses on instances that are less vulnerable to the attack enhances the adversarial detection rate by reducing false negatives. We evaluate the efficacy of our risk-aware selective training strategy on a blood glucose management system that demonstrates how training static anomaly detectors indiscriminately may result in an increased false negative rate, which could be life-threatening in safety-critical applications. Our experiments show that selective training on the less vulnerable patients achieves a recall increase of up to 27.5\% with minimal impact on precision compared to indiscriminate training.

Figures

Figures reproduced from arXiv: 2505.06477 by the authors.

Figure 1
Figure 1. The five steps of the proposed risk profiling framework. II. PROPOSED FRAMEWORK In this section, we present our risk profiling framework for selective training of existing anomaly detectors to improve their detection capabilities. We rely on anomaly detectors that work in conjunction with the main DNN prediction model. The main DNN model remains unmodified since our proposed risk profiling framework is only used to … view at source ↗
Figure 2
Figure 2. A BGMS that uses a glucometer, insulin pump, DNN for insulin [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The results of hierarchically clustering the risk profiles from (a) [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: We find that patient 5 from Subset A and patient 2 from Subset B, who belong to the less vulnerable cluster shown in Table II, show the highest benign normal to abnormal [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: kNN anomaly detection on sample glucose traces of patients 5 and 2 from Subset A. Indiscriminately training the detector yields a higher false negative rate on patient 2 (more vulnerable) than patient 5 (less vulnerable). Benign Abnormal Benign Normal Malicious Abnorma…
Figure 7
Figure 7. Figure 7: Recall results using kNN, OneClassSVM, and MAD-GAN. Less vulnerable training achieves a recall increase of 27.5% (kNN), and 16.8% (OneClassSVM) over indiscriminate training [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]
Figure 8
Figure 8. Figure 8: Precision results using kNN, OneClassSVM, and MAD-GAN. Less vulnerable training yields a precision drop of 5% (kNN), and an increase of 7.5% (OneClassSVM) over indiscriminate training. show that despite potential increases in the false positive rate resulting from the …
Figure 9
Figure 9. Figure 9: Percentage of originally normal glucose instances that are misdi [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]
Figure 10
Figure 10. Figure 10: Percentage of originally hypoglycemic glucose instances that [PITH_FULL_IMAGE:figures/full_fig_p009_10.png]
Figure 11
Figure 11. Figure 11: F1-score results using kNN, OneClassSVM, and MAD-GAN. Less vulnerable training achieves an F1-score increase of 7.3% (kNN), and 10.9% (OneClassSVM) over indiscriminate training. APPENDIX D DISCUSSION In our experiments, we trained anomaly detectors on the less vulnera…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

68 extracted references · 60 canonical work pages

  1. [1]

    Using machine learning for healthcare challenges and opportunities

    Abdullah Alanazi. Using machine learning for healthcare challenges and opportunities. Informatics in Medicine Unlocked , 30:100924, 2022

    work page 2022

  2. [2]

    Machine learning in healthcare

    Hafsa Habehh and Suril Gohel. Machine learning in healthcare. Current genomics, 22(4):291, 2021

    work page 2021

  3. [3]

    Machine learning for healthcare: on the verge of a major shift in healthcare epidemiology

    Jenna Wiens and Erica S Shenoy. Machine learning for healthcare: on the verge of a major shift in healthcare epidemiology. Clinical infectious diseases, 66(1):149–153, 2018

    work page 2018

  4. [4]

    Deep neural networks in healthcare systems

    Biswajit R Bhowmik, Shrinidhi Anil Varna, Adarsh Kumar, and Rahul Kumar. Deep neural networks in healthcare systems. In Machine learning and deep learning in efficacy improvement of healthcare systems, pages 195–226. CRC Press, 2022

    work page 2022

  5. [5]

    U.S. FDA. AI-Rad Companion (Cardiovascular). URL: https://www. accessdata.fda.gov/scripts/cdrh/cfdocs/cfpmn/pmn.cfm?ID=K183268, Last accessed: Dec 20, 2023

    work page 2023

  6. [6]

    Autonomous driving ar- chitectures: insights of machine learning and deep learning algorithms

    Mrinal R Bachute and Javed M Subhedar. Autonomous driving ar- chitectures: insights of machine learning and deep learning algorithms. Machine Learning with Applications , 6:100164, 2021

    work page 2021

  7. [7]

    Exploring the mechanism of crashes with autonomous vehi- cles using machine learning

    Hengrui Chen, Hong Chen, Ruiyu Zhou, Zhizhen Liu, and Xiaoke Sun. Exploring the mechanism of crashes with autonomous vehi- cles using machine learning. Mathematical problems in engineering , 2021(1):5524356, 2021

    work page 2021

  8. [8]

    Deep neural networks with koopman operators for modeling and control of autonomous vehicles

    Yongqian Xiao, Xinglong Zhang, Xin Xu, Xueqing Liu, and Jiahang Liu. Deep neural networks with koopman operators for modeling and control of autonomous vehicles. IEEE transactions on intelligent vehicles , 8(1):135–146, 2022

    work page 2022

Show all 68 references
  1. [9]

    Simple black- box adversarial attacks on deep neural networks

    Nina Narodytska and Shiva Prasad Kasiviswanathan. Simple black- box adversarial attacks on deep neural networks. In CVPR Workshops, volume 2, 2017

    2017

  2. [10]

    Adversarial attacks on deep neural networks for time series classification

    Hassan Ismail Fawaz, Germain Forestier, Jonathan Weber, Lhassane Idoumghar, and Pierre-Alain Muller. Adversarial attacks on deep neural networks for time series classification. In 2019 International Joint Conference on Neural Networks (IJCNN) , pages 1–8. IEEE, 2019

    2019

  3. [11]

    Fast adversarial attacks to deep neural networks through gradual sparsifica- tion

    Sajjad Amini, Alireza Heshmati, and Shahrokh Ghaemmaghami. Fast adversarial attacks to deep neural networks through gradual sparsifica- tion. Engineering Applications of Artificial Intelligence , 127:107360, 2024

    2024

  4. [12]

    Goodfellow, and Samy Bengio

    Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning at scale. CoRR, abs/1611.01236, 2016

    2016 arXiv

  5. [13]

    Are self-driving cars secure? evasion attacks against deep neural networks for steering angle prediction

    Alesia Chernikova, Alina Oprea, Cristina Nita-Rotaru, and BaekGyu Kim. Are self-driving cars secure? evasion attacks against deep neural networks for steering angle prediction. In 2019 IEEE Security and Privacy Workshops (SPW), pages 132–137. IEEE, 2019

    2019

  6. [14]

    Real-time evasion attacks against deep learning-based anomaly detection from distributed system logs

    J Dinal Herath, Ping Yang, and Guanhua Yan. Real-time evasion attacks against deep learning-based anomaly detection from distributed system logs. In Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy , pages 29–40, 2021

    2021

  7. [15]

    What is adversarial machine learning? attack methods in 2024, June 2024

    Gaudenz Boesch. What is adversarial machine learning? attack methods in 2024, June 2024

    2024

  8. [16]

    Evasion attacks against machine-learning based behavioral authentication

    Marco Farinetti. Evasion attacks against machine-learning based behavioral authentication. PhD thesis, Politecnico di Torino, 2018

    2018

  9. [17]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013

    2013 arXiv

  10. [18]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014

    2014 arXiv

  11. [19]

    Personalized insulin dose manipulation attack and its detection using interval-based temporal patterns and machine learning algorithms

    Tamar Levy-Loboda, Eitam Sheetrit, Idit F Liberty, Alon Haim, and Nir Nissim. Personalized insulin dose manipulation attack and its detection using interval-based temporal patterns and machine learning algorithms. Journal of Biomedical Informatics , 132:104129, 2022

    2022

  12. [20]

    Adversarial training against adversarial attacks for machine learning-based intrusion detection systems

    Muhammad Shahzad Haroon and Husnain Mansoor Ali. Adversarial training against adversarial attacks for machine learning-based intrusion detection systems. Computers, Materials & Continua , 73(2), 2022

    2022

  13. [21]

    Defending evasion attacks via adversarially adaptive training

    Minh-Hao Van, Wei Du, Xintao Wu, Feng Chen, and Aidong Lu. Defending evasion attacks via adversarially adaptive training. In 2022 IEEE International Conference on Big Data (Big Data) , pages 1515–

    2022

  14. [22]

    Adversarial training methods for deep learning: A systematic review

    Weimin Zhao, Sanaa Alwidian, and Qusay H Mahmoud. Adversarial training methods for deep learning: A systematic review. Algorithms, 15(8):283, 2022

    2022

  15. [23]

    Feature denoising for improving adversarial robustness

    Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan L Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 501–509, 2019

    2019

  16. [24]

    Evaluating and improving ad- versarial robustness of machine learning-based network intrusion detec- tors

    Dongqi Han, Zhiliang Wang, Ying Zhong, Wenqi Chen, Jiahai Yang, Shuqiang Lu, Xingang Shi, and Xia Yin. Evaluating and improving ad- versarial robustness of machine learning-based network intrusion detec- tors. IEEE Journal on Selected Areas in Communications , 39(8):2632– 2647, 2021

    2021

  17. [25]

    Adversarial feature alignment: Balancing robustness and accuracy in deep learning via adversarial training, 2024

    Leo Hyun Park, Jaeuk Kim, Myung Gyo Oh, Jaewoo Park, and Taeky- oung Kwon. Adversarial feature alignment: Balancing robustness and accuracy in deep learning via adversarial training, 2024

    2024

  18. [26]

    The more the merrier: adding hidden measurements to secure industrial control systems

    Jairo Giraldo, David Urbina, CheeYee Tang, and Alvaro A Cardenas. The more the merrier: adding hidden measurements to secure industrial control systems. In Proceedings of the 7th Symposium on Hot Topics in the Science of Security , pages 1–10, 2020

    2020

  19. [27]

    Ad- versarial regression for detecting attacks in cyber-physical systems

    Amin Ghafouri, Yevgeniy V orobeychik, and Xenofon Koutsoukos. Ad- versarial regression for detecting attacks in cyber-physical systems. arXiv preprint arXiv:1804.11022 , 2018

    2018 arXiv

  20. [28]

    Lunar: Unifying local outlier detection methods via graph neural networks

    Adam Goodge, Bryan Hooi, See-Kiong Ng, and Wee Siong Ng. Lunar: Unifying local outlier detection methods via graph neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence , vol- ume 36, pages 6737–6745, 2022

    2022

  21. [29]

    Robustness test- ing of data and knowledge driven anomaly detection in cyber-physical systems

    Xugui Zhou, Maxfield Kouzel, and Homa Alemzadeh. Robustness test- ing of data and knowledge driven anomaly detection in cyber-physical systems. In 2022 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W) , pages 44–51, 2022

    2022

  22. [30]

    Adversarial attack mitigation strategy for machine learning-based network attack detection model in power system

    Rong Huang and Yuancheng Li. Adversarial attack mitigation strategy for machine learning-based network attack detection model in power system. IEEE Transactions on Smart Grid , 14(3):2367–2376, 2022

    2022

  23. [31]

    Mad-gan: Multivariate anomaly detection for time series data with generative adversarial networks

    Dan Li, Dacheng Chen, Baihong Jin, Lei Shi, Jonathan Goh, and See- Kiong Ng. Mad-gan: Multivariate anomaly detection for time series data with generative adversarial networks. In International conference on artificial neural networks , pages 703–716. Springer, 2019

    2019

  24. [32]

    Deep reinforcement learning based evasion generative adversarial network for botnet detection.Future Generation Computer Systems , 150:294–302, 2024

    Rizwan Hamid Randhawa, Nauman Aslam, Mohammad Alauthman, Muhammad Khalid, and Husnain Rafiq. Deep reinforcement learning based evasion generative adversarial network for botnet detection.Future Generation Computer Systems , 150:294–302, 2024

    2024

  25. [33]

    Strengthening ids against evasion attacks with gan-based adversarial samples in sdn-enabled network

    Cao Phan Xuan Qui, Dang Hong Quang, Phan The Duy, Van-Hau Pham, et al. Strengthening ids against evasion attacks with gan-based adversarial samples in sdn-enabled network. In 2021 RIVF International Conference on Computing and Communication Technologies (RIVF) , pages 1–6. IEEE, 2021

    2021

  26. [34]

    Omni: Au- tomated ensemble with unexpected models against adversarial evasion attack

    Rui Shu, Tianpei Xia, Laurie Williams, and Tim Menzies. Omni: Au- tomated ensemble with unexpected models against adversarial evasion attack. Empirical Software Engineering , 27:1–32, 2022

    2022

  27. [35]

    Clustering and ensemble based approach for securing electricity theft detectors against evasion attacks

    Islam Elgarhy, Mahmoud M Badr, Mohamed MEA Mahmoud, Mostafa M Fouda, Maazen Alsabaan, and Hisham A Kholidy. Clustering and ensemble based approach for securing electricity theft detectors against evasion attacks. IEEE Access, 11:112147–112164, 2023

    2023

  28. [36]

    Mitigating adversarial evasion attacks of ransomware using ensemble learning

    Usman Ahmed, Jerry Chun-Wei Lin, and Gautam Srivastava. Mitigating adversarial evasion attacks of ransomware using ensemble learning. Computers and Electrical Engineering , 100:107903, 2022

    2022

  29. [37]

    Evasion attack and defense on machine learn- ing models in cyber-physical systems: A survey

    Shunyao Wang, Ryan KL Ko, Guangdong Bai, Naipeng Dong, Taejun Choi, and Yanjun Zhang. Evasion attack and defense on machine learn- ing models in cyber-physical systems: A survey. IEEE Communications Surveys & Tutorials, 2023

    2023

  30. [38]

    Adversarial attacks and defenses in machine learning-powered networks: A contemporary survey

    Y Wang, T Sun, S Li, X Yuan, W Ni, E Hossain, and HV Poor. Adversarial attacks and defenses in machine learning-powered networks: A contemporary survey. arXiv preprint arXiv:2303.06302 , 2023

    2023 arXiv

  31. [39]

    Evaluating the adversarial robustness of adaptive test-time defenses

    Francesco Croce, Sven Gowal, Thomas Brunner, Evan Shelhamer, Matthias Hein, and Taylan Cemgil. Evaluating the adversarial robustness of adaptive test-time defenses. In International Conference on Machine Learning, pages 4421–4435. PMLR, 2022

    2022

  32. [40]

    Adversarial attacks to machine learning-based smart healthcare systems

    AKM Iqtidar Newaz, Nur Imtiazul Haque, Amit Kumar Sikder, Mo- hammad Ashiqur Rahman, and A Selcuk Uluagac. Adversarial attacks to machine learning-based smart healthcare systems. In GLOBECOM 2020-2020 IEEE Global Communications Conference, pages 1–6. IEEE, 2020

    2020

  33. [41]

    Xin Li, Deng Pan, and Dongxiao Zhu. Defending against adversarial attacks on medical imaging ai system, classification or detection? In 2021 IEEE 18th International Symposium on Biomedical Imaging (ISBI), pages 1677–1681. IEEE, 2021

    2021

  34. [42]

    Machine learning with electronic health records is vulnerable to backdoor trigger attacks

    Byunggill Joe, Akshay Mehra, Insik Shin, and Jihun Hamm. Machine learning with electronic health records is vulnerable to backdoor trigger attacks. arXiv preprint arXiv:2106.07925 , 2021

    2021 arXiv

  35. [43]

    Dealing with noise problem in machine learning data-sets: A systematic review

    Shivani Gupta and Atul Gupta. Dealing with noise problem in machine learning data-sets: A systematic review. Procedia Computer Science , 161:466–474, 2019. The Fifth Information Systems International Con- ference, 23-24 July 2019, Surabaya, Indonesia

    2019

  36. [44]

    Adversarial learning with cost-sensitive classes

    Haojing Shen, Sihong Chen, Ran Wang, and Xizhao Wang. Adversarial learning with cost-sensitive classes. IEEE Transactions on Cybernetics , 53(8):4855–4866, 2022

    2022

  37. [45]

    Adversarial training for privacy-preserving deep learning model distribution

    Mohammed Alawad, Shang Gao, Xiao-Cheng Wu, Eric B Durbin, Linda Coyle, Lynne Penberthy, and Georgia Tourassi. Adversarial training for privacy-preserving deep learning model distribution. In 2019 IEEE International Conference on Big Data (Big Data) , pages 5705–5710. IEEE, 2019

    2019

  38. [46]

    Robust- ness, privacy, and generalization of adversarial training

    Fengxiang He, Shaopeng Fu, Bohan Wang, and Dacheng Tao. Robust- ness, privacy, and generalization of adversarial training. arXiv preprint arXiv:2012.13573, 2020

    2012 arXiv

  39. [47]

    The ohiot1dm dataset for blood glucose level prediction: Update 2020

    Cindy Marling and Razvan Bunescu. The ohiot1dm dataset for blood glucose level prediction: Update 2020. In CEUR workshop proceedings, volume 2675, page 71. NIH Public Access, 2020

    2020

  40. [48]

    Deep Residual Time- Series Forecasting: Application to Blood Glucose Prediction

    Harry Rubin-Falcone, Ian Fox, and Jenna Wiens. Deep Residual Time- Series Forecasting: Application to Blood Glucose Prediction. In KDH@ ECAI, pages 105–109, 2020

    2020

  41. [49]

    Systematically assessing the security risks of ai/ml-enabled connected healthcare systems

    Mohammed Elnawawy, Mohammadreza Hallajiyan, Gargi Mitra, Shahrear Iqbal, and Karthik Pattabiraman. Systematically assessing the security risks of ai/ml-enabled connected healthcare systems. arXiv preprint arXiv:2401.17136, 2024

    2024 arXiv

  42. [50]

    BLURtooth: Exploiting Cross- Transport Key Derivation in Bluetooth Classic and Bluetooth Low Energy

    Kasper Rasmussen. BLURtooth: Exploiting Cross- Transport Key Derivation in Bluetooth Classic and Bluetooth Low Energy. In AsiaCCS, 2022

    2022

  43. [51]

    Medtronic MyCareLink Smart Vulnerability

    CVE. Medtronic MyCareLink Smart Vulnerability. URL: https:// www.cve.org/CVERecord?id=CVE-2020-25183, Last accessed: Mar 10, 2025

    2020

  44. [52]

    Securing automated insulin delivery systems: A review of security threats and protectives strategies

    Yuchen Niu and Siew-Kei Lam. Securing automated insulin delivery systems: A review of security threats and protectives strategies. arXiv preprint arXiv:2503.14006, 2025

    2025

  45. [53]

    Com- partmentation policies for android apps: A combinatorial optimization approach

    Guillermo Suarez-Tangil, Juan E Tapiador, and Pedro Peris-Lopez. Com- partmentation policies for android apps: A combinatorial optimization approach. In NSS 2015, pages 63–77, 2015

    2015

  46. [54]

    U.S. FDA. DreaMed Advisor Pro. URL: https://www.accessdata. fda.gov/scripts/cdrh/cfdocs/cfpmn/denovo.cfm?id=DEN170043, Last ac- cessed: Nov 30, 2023

    2023

  47. [55]

    URET: Universal Robustness Evaluation Toolkit (for Evasion)

    Kevin Eykholt, Taesung Lee, Douglas Schales, Jiyong Jang, and Ian Molloy. URET: Universal Robustness Evaluation Toolkit (for Evasion). In USENIX Security 23 , pages 3817–3833, 2023

    2023

  48. [56]

    A review of anomaly detection techniques based on nearest neighbor

    Ming Zhao, Jingchao Chen, and Yang Li. A review of anomaly detection techniques based on nearest neighbor. In 2018 International Conference on Computer Modeling, Simulation and Algorithm (CMSA 2018) , pages 290–292. Atlantis Press, 2018

    2018

  49. [57]

    Sparse coding with anomaly detection

    Amir Adler, Michael Elad, Yacov Hel-Or, and Ehud Rivlin. Sparse coding with anomaly detection. Journal of Signal Processing Systems , 79:179–188, 2015

    2015

  50. [58]

    Detection and explanation of anomalies in healthcare data

    Durgesh Samariya, Jiangang Ma, Sunil Aryal, and Xiaohui Zhao. Detection and explanation of anomalies in healthcare data. Health Information Science and Systems , 11(1):20, 2023

    2023

  51. [59]

    Sparsity techniques in medical imaging

    Ruogu Fang, Tsuhan Chen, Dimitris Metaxas, Pina Sanelli, and Shaoting Zhang. Sparsity techniques in medical imaging. Computerized medical imaging and graphics: the official journal of the Computerized Medical Imaging Society, 46(Pt 1):1, 2015

    2015

  52. [60]

    Improv- ing one-class svm for anomaly detection

    Kun-Lun Li, Hou-Kuan Huang, Sheng-Feng Tian, and Wei Xu. Improv- ing one-class svm for anomaly detection. In Proceedings of the 2003 international conference on machine learning and cybernetics (IEEE Cat. No. 03EX693) , volume 5, pages 3077–3081. IEEE, 2003

    2003

  53. [61]

    Analyzing the non-linear relationship between fasting blood glucose levels and gensini score in patients with stemi

    Han Li, Quanzhi Lin, Zhiyuan Jiang, and Guoqiang Zhong. Analyzing the non-linear relationship between fasting blood glucose levels and gensini score in patients with stemi. Frontiers in Cardiovascular Medicine, 11:1427567, 2024

    2024

  54. [62]

    Nonlinear metabolic effect of insulin across the blood glucose range in patients with type 1 diabetes mellitus

    Alice Chan, Lutz Heinemann, Stacey M Anderson, Marc D Breton, and Boris P Kovatchev. Nonlinear metabolic effect of insulin across the blood glucose range in patients with type 1 diabetes mellitus. Journal of diabetes science and technology , 4(4):873–881, 2010

    2010

  55. [63]

    Somogyi effect: What it is, causes, symp- toms & treatment

    Cleveland Clinic. Somogyi effect: What it is, causes, symp- toms & treatment. https://my.clevelandclinic.org/health/diseases/ 11443-somogyi-effect, January 2023. Accessed: March 31, 2025

    2023

  56. [64]

    Hypoglycemia

    Jean-Francois Yale, Breay Paty, Peter A Senior, Diabetes Canada Clinical Practice Guidelines Expert Committee, et al. Hypoglycemia. Canadian journal of diabetes , 42:S104–S108, 2018

    2018

  57. [65]

    Hypoglycemia (low blood sugar)

  58. [66]

    Hypoglycemia (low blood sugar), February 2024

    Mary Jo DiLonardo and Deanna Altomara. Hypoglycemia (low blood sugar), February 2024

    2024

  59. [67]

    What is hierarchical clustering?, August 2024

    Joshua Noble. What is hierarchical clustering?, August 2024

    2024

  60. [68]

    Patient i

    Xiaoge Zhang, Felix TS Chan, Chao Yan, and Indranil Bose. Towards risk-aware artificial intelligence and machine learning systems: An overview. Decision Support Systems , 159:113800, 2022. APPENDIX A SUBSET A R ESULTS Fig. 9. Percentage of originally normal glucose instances t...

    2022

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.