國立虎尾科技大學 |

Enhancing the Safety of Machine Learning Systems and Cyber-Physical Systems Against Cyber Attacks.

Record Type:	Language materials, manuscript : Monograph/item
Title/Author:	Enhancing the Safety of Machine Learning Systems and Cyber-Physical Systems Against Cyber Attacks./
Author:	Fu, Hao.
Description:	1 online resource (220 pages)
Notes:	Source: Dissertations Abstracts International, Volume: 85-11, Section: B.
Contained By:	Dissertations Abstracts International85-11B.
Subject:	Engineering. -
Online resource:	click for full text (PQDT)
ISBN:	9798382757193

Enhancing the Safety of Machine Learning Systems and Cyber-Physical Systems Against Cyber Attacks.
Fu, Hao.

Enhancing the Safety of Machine Learning Systems and Cyber-Physical Systems Against Cyber Attacks. - 1 online resource (220 pages)

Source: Dissertations Abstracts International, Volume: 85-11, Section: B.

Thesis (Ph.D.)--New York University Tandon School of Engineering, 2024.

Includes bibliographical references

Machine learning are applied in many applications with stringent safety requirements including controlling cyber-physical systems (CPS). However, these systems face significant vulnerabilities, including susceptibility to out-of-distribution (OOD) inputs and backdoor attacks for machine learning systems, and the potential for CPS to be undermined by malicious control signals. To guarantee the safe deployment of these advanced control systems, it is imperative to establish robust defenses against such threats. This thesis aligns with the critical goal of safeguarding these systems, examining how machine learning and cyber-physical systems perform in environments where malicious attacks can degrade, misclassify, or destabilize such systems. In this dissertation, five defense mechanisms are introduced to mitigate the risks posed by abnormal inputs across various scenarios. Specifically, two defenses are designed to protect machine learning systems from backdoor attacks, another two defenses are designed to identify OOD inputs for machine learning systems, and the last defense is designed to enhance the CPS resiliency against malicious control signals.The first defense, removing adversarial backdoors by iterative demarcation (RAID), is a backdoor detection algorithm for white-box scenarios where the user obtains a backdoored model from an open-source platform for downstream tasks. This white-box scenario allows user to have full access to the model, including weights and hidden layer outputs. RAID is a novel feature-based detection strategy with an offline training part and an online retraining part. The offline training process trains detectors to quarantine online anomalous samples that are different from the clean validation data, whereas the online retraining process builds a binary classifier to distinguish clean and poisoned samples correctly.The second defense is a backdoor detection algorithm for black-box scenarios where the user can only access the input and output of the networks. In the realm of commercial machine learning services, owing to intellectual property rights, machine learning systems typically operate as black boxes, offering only query access through APIs. The proposed approach is motivated by the intuition that features corresponding to triggers have a higher influence in determining the backdoored network output than any other benign features. To quantitatively measure the effects of triggers and benign features on determining the backdoored network output, five metrics are introduced. Via assessing the inputs' metrics values, the algorithm identifies and rejects poisoned samples that trigger backdoor attacks.Machine learning systems also encounter challenges when dealing with OOD samples, which are not represented in the training distribution. OOD detection assesses whether a data point is an OOD instance or not. It designates higher values to in-distribution (ID) samples and lower values to OOD samples. The third defense in this thesis is a novel effective OOD detection approach that employs an overlap index (OI)-based confidence score function to evaluate the likelihood of a given input being an ID instance. The proposed OOD detector is non-parametric, lightweight, and easy to interpret, hence providing strong flexibility and generality.The fourth defense, CLIPScope, is a zero-shot OOD detection using the vision language foundation model--CLIP. Traditional OOD detection methods predominantly focus on image data, overlooking the potential benefits of incorporating textual information. The zero-shot OOD detection utilizes both textual and image information and is capable of detecting OOD samples without requiring ID samples. CLIPScope normalizes the confidence score of a sample by class likelihoods, akin to a Bayesian posterior update, thereby reducing confidence scores for OOD instances low in "high-frequency" classes while keeping scores for ID instances high.The last defense is a multi-controller switching strategy with periodic re-initialization to avoid using compromised controllers for CPS. The proposed strategy switches among multiple controllers and reuses controllers that finish re-initialization, preserving the CPS redundancy and resiliency. An anomaly detector is further used to detect CPS attacks during the controller's working period. Upon alarm activation, the current control signal is set to a predefined value, and a switch to an alternative controller occurs at the earliest switching moment.

Electronic reproduction.
Ann Arbor, Mich. :
ProQuest,
2024

Mode of access: World Wide Web

ISBN: 9798382757193Subjects--Topical Terms:

561152
Engineering.
Subjects--Index Terms:

Backdoor detectionIndex Terms--Genre/Form:

554714
Electronic books.

Enhancing the Safety of Machine Learning Systems and Cyber-Physical Systems Against Cyber Attacks.
LDR:05969ntm a22004097 4500 001 1149740
005 20241022112627.5
006 m o d
007 cr bn ---uuuuu
008 250605s2024 xx obm 000 0 eng d
020 $a 9798382757193
035 $a (MiAaPQ)AAI31293953
035 $a AAI31293953
040 $a MiAaPQ $b eng $c MiAaPQ $d NTU
100 1 $a Fu, Hao. $3 1476070
245 1 0 $a Enhancing the Safety of Machine Learning Systems and Cyber-Physical Systems Against Cyber Attacks.
264 0 $c 2024
300 $a 1 online resource (220 pages)
336 $a text $b txt $2 rdacontent
337 $a computer $b c $2 rdamedia
338 $a online resource $b cr $2 rdacarrier
500 $a Source: Dissertations Abstracts International, Volume: 85-11, Section: B.
500 $a Advisor: Khorrami, Farshad.
502 $a Thesis (Ph.D.)--New York University Tandon School of Engineering, 2024.
504 $a Includes bibliographical references
520 $a Machine learning are applied in many applications with stringent safety requirements including controlling cyber-physical systems (CPS). However, these systems face significant vulnerabilities, including susceptibility to out-of-distribution (OOD) inputs and backdoor attacks for machine learning systems, and the potential for CPS to be undermined by malicious control signals. To guarantee the safe deployment of these advanced control systems, it is imperative to establish robust defenses against such threats. This thesis aligns with the critical goal of safeguarding these systems, examining how machine learning and cyber-physical systems perform in environments where malicious attacks can degrade, misclassify, or destabilize such systems. In this dissertation, five defense mechanisms are introduced to mitigate the risks posed by abnormal inputs across various scenarios. Specifically, two defenses are designed to protect machine learning systems from backdoor attacks, another two defenses are designed to identify OOD inputs for machine learning systems, and the last defense is designed to enhance the CPS resiliency against malicious control signals.The first defense, removing adversarial backdoors by iterative demarcation (RAID), is a backdoor detection algorithm for white-box scenarios where the user obtains a backdoored model from an open-source platform for downstream tasks. This white-box scenario allows user to have full access to the model, including weights and hidden layer outputs. RAID is a novel feature-based detection strategy with an offline training part and an online retraining part. The offline training process trains detectors to quarantine online anomalous samples that are different from the clean validation data, whereas the online retraining process builds a binary classifier to distinguish clean and poisoned samples correctly.The second defense is a backdoor detection algorithm for black-box scenarios where the user can only access the input and output of the networks. In the realm of commercial machine learning services, owing to intellectual property rights, machine learning systems typically operate as black boxes, offering only query access through APIs. The proposed approach is motivated by the intuition that features corresponding to triggers have a higher influence in determining the backdoored network output than any other benign features. To quantitatively measure the effects of triggers and benign features on determining the backdoored network output, five metrics are introduced. Via assessing the inputs' metrics values, the algorithm identifies and rejects poisoned samples that trigger backdoor attacks.Machine learning systems also encounter challenges when dealing with OOD samples, which are not represented in the training distribution. OOD detection assesses whether a data point is an OOD instance or not. It designates higher values to in-distribution (ID) samples and lower values to OOD samples. The third defense in this thesis is a novel effective OOD detection approach that employs an overlap index (OI)-based confidence score function to evaluate the likelihood of a given input being an ID instance. The proposed OOD detector is non-parametric, lightweight, and easy to interpret, hence providing strong flexibility and generality.The fourth defense, CLIPScope, is a zero-shot OOD detection using the vision language foundation model--CLIP. Traditional OOD detection methods predominantly focus on image data, overlooking the potential benefits of incorporating textual information. The zero-shot OOD detection utilizes both textual and image information and is capable of detecting OOD samples without requiring ID samples. CLIPScope normalizes the confidence score of a sample by class likelihoods, akin to a Bayesian posterior update, thereby reducing confidence scores for OOD instances low in "high-frequency" classes while keeping scores for ID instances high.The last defense is a multi-controller switching strategy with periodic re-initialization to avoid using compromised controllers for CPS. The proposed strategy switches among multiple controllers and reuses controllers that finish re-initialization, preserving the CPS redundancy and resiliency. An anomaly detector is further used to detect CPS attacks during the controller's working period. Upon alarm activation, the current control signal is set to a predefined value, and a switch to an alternative controller occurs at the earliest switching moment.
533 $a Electronic reproduction. $b Ann Arbor, Mich. : $c ProQuest, $d 2024
538 $a Mode of access: World Wide Web
650 4 $a Engineering. $3 561152
650 4 $a Computer engineering. $3 569006
650 4 $a Electrical engineering. $3 596380
653 $a Backdoor detection
653 $a Out-of-distribution detection
653 $a Switching system
653 $a Cyber attacks
653 $a Overlap index
655 7 $a Electronic books. $2 local $3 554714
690 $a 0537
690 $a 0464
690 $a 0800
690 $a 0544
710 2 $a ProQuest Information and Learning Co. $3 1178819
710 2 $a New York University Tandon School of Engineering. $b Electrical & Computer Engineering. $3 1437750
773 0 $t Dissertations Abstracts International $g 85-11B.
856 4 0 $u http://pqdd.sinica.edu.tw/twdaoapp/servlet/advanced?query=31293953 $z click for full text (PQDT)