Machine Learning Security Reproducibility

Seminar Description

The intersection between security and machine learning can be viewed from two perspectives: The security of machine learning algorithms and systems, e.g., adversarial examples and poisoning attacks. Second is the use machine learning methods to improve and analyze the security of a system, e.g., malware detection or decompilation. In this seminar, we will cover recent publications from both sides by reading and summarizing the state-of-the-art on these two topics and performing an artefact evaluation of their code to verify and comprehend the practical implementations of the latest scientific publications.

Organisation

The seminar is structured into two parts. In both parts, you will work in groups of two:

• You will write a short survey paper on the main topic of your assigned paper.
• You will evaluate the code of the paper during an artefact evaluation.

Survey

Your group will be assigned a topic (related to your assigned paper) for which you will read and summarize the current research in a survey paper. The resulting survey papers will undergo a peer review process similar to academic conferences. This includes review, rebuttal, and revision phases in which everyone must participate.

This includes:

• Writing a short survey paper on the main topic of the group's papers (6 pages)
• Reviewing two works from other groups to provide feedback
• Improving the original survey paper based on the feedback

Artefact Evaluation

Artefacts such as code and datasets are an essential part of today's research to be able to reproduce results and foster future research. Top computer science and security conferences conduct artefact evaluations performed by independent reviewers to ensure that the quality of provided artefacts meets certain criteria. These criteria include reproducibility, consistency with the paper, and the quality of the documentation.

In this seminar, we will review the artefacts of research papers. During the assessment, you will check and run the code and verify that you can reproduce the results reported in the paper. At the end of the semester, your group will submit a report that covers the above criteria.

Important Dates

• Kick-off meeting in the second week of the semester: After assignment I will contact all participants to agree on a time for the kick-off
• Group and paper assignments: One week after kick-off
• Submission of first version of survey paper: TBA
• Submission of reviews: TBA
• Submission of final version of survey paper: TBA
• Submission of artefact evaluation report: TBA

List of Papers

The list of papers is based on a list of papers with re-evaluated artifacts. However, you are welcome to suggest your own choice which you can work with after approval. The seminar paper's topic will be about the general topic of the paper of your choice (this list or your own):

• Defense against Adversarial Examples: Pratik Vaishnavi, Kevin Eykholt, and Amir Rahmati, "Transferring Adversarial Robustness Through Robust Representation Matching," USENIX Security Symposium 2022 [paper]
• Adversarial Patch Attacks and Defenses: Chong Xiang, Saeed Mahloujifar, and Prateek Mittal, "PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier," USENIX Security Symposium 2022 [paper]
• Attacks against NLP Systems: Thorsten Eisenhofer, Erwin Quiring, Jonas Möller, Doreen Riepel, Thorsten Holz, Konrad Rieck, "No more Reviewer #2: Subverting Automatic Paper-Reviewer Assignment using Adversarial Learning," USENIX Security Symposium 2023 [paper]
• Poisoning Attacks: Hamid Mozaffari, Virat Shejwalkar, and Amir Houmansadr, "Every Vote Counts: Ranking-Based Training of Federated Learning to Resist Poisoning Attacks," USENIX Security Symposium 2023 [paper]
• Membership Inference Attacks: Xiaoyong Yuan and Lan Zhang, "Membership Inference Attacks and Defenses in Neural Network Pruning," USENIX Security Symposium 2022 [paper]
• Concept Drift:  Limin Yang, Wenbo Guo, Qingying Hao, Arridhana Ciptadi, Ali Ahmadzadeh, and Xinyu Xing, Gang Wang, "CADE: Detecting and Explaining Concept Drift Samples for Security Applications," USENIX Security Symposium 2021 [paper]

Deliverables

• Final survey paper (50 % of your final grade)
• Reviews (10 % of your final grade)
• Artefact evaluation report (40 % of your final grade)

Schedule

• Nov 6: Kick-off (Meeting)
• Nov 13: Group and paper assignment
• Nov 20: How to write a survey paper, How to write an artefact report (Meeting)
• Dec 18: How to write a review, How to present research (Meeting)
• Jan 8-12: Individual Feedback
• Jan 8: Presentation topic 1 (Meeting)
• Jan 15: Presentation topic 2 (Meeting)
• Jan 22: Presentation topic 3 (Meeting)
• Jan 29: Presentation topic 4 (Meeting)
• Feb 5: Presentation topic 5 (Meeting)