Secure and Trustworthy Machine Learning

Course Objective

We will discuss various topics in the intersection of security and machine learning. The main goal of this course is to have you think critically about how and to what extent security guarantees can be given for machine learning tasks. The main objective is to study trustworthy intelligence augmentation from different perspectives.

Upon completion of this course, you will:

• Have knowledge about security problems that arise in machine learning (K&U, AK&U, C)
• Understand (mathematical) technique(s) towards remediating security problems (K&U, AK&U, C)
• Have knowledge of example(s) about machine learning for security (K&U)
• Have acquired critical thinking around machine learning and security (MJ, LS)

The acronyms above refer to the Dublin Descriptors covered by each learning objective, specifically: Knowledge and Understanding (K&U), Applied Knowledge and Understanding (AK&U), Making Judgment (MJ), Learning Skills (LS), and Communication (C).

Course Content

The course touches on various topics in machine learning and security. Examples of topics that can be included are: adversarial machine learning for image classifiers; Differential Privacy for distributed Stochastic Gradient Descent; secure multi-party computation for federated learning; the use of ML in security such as intrusion detection, analysis of silicon Physical Unclonable Function designs, GAN models generating synthetic data such that collected personal data can be discarded, and the moral character of cryptography, security, and artificial intelligence.

Additional Information Teaching Methods

Lectures (105 minutes 2x each week for 4 weeks); Group Q&A (135 minutes 1x each week for 3 weeks) during which (a) we cover lecture material for which we had no time during lectures, (b) upon student request re-explain topics and/or discuss upcoming assignments and (c) answer student questions about the lectured material and problems.

Method of Assessment

(1) At the start of the course you will write a short (but at least 1/3 page, single column) essay on your study strategy and your grade expectation:

You cannot pass the course if you don't submit by the deadline. And those who don't simply get NS "No Show" as the final grade.

(2) Questions and problems will be posted for each lectured topic. At the end of the course there will be a final in a controlled environment where a subset of the posted questions and problems for each topic will be asked. You will be able to prepare for this final by collecting and learning answers throughout the course. The final tests whether you have acquired a sufficient overall understanding. The final has a pass/fail grade.

If you do not pass the final, then you fail the course. If you pass the final, then your final grade is determined by your individually graded assignments as described below.

There is no re-sit opportunity for the final. A grade for the final from a previous year does not transfer to this year.

(3) There will be six (A = 6) individually graded assignments in the form of research surveys/essays together with your own self-evaluations of your submitted works. Each assignment is assessed based on the quality, correctness, and completeness of the solution(s) or written exposition. Each assignment is graded as a
Fail (F), Pass (P), or Excellent (E).

(An F is also given for an assignment if you do not meet its deadline for submission.)

The following explains in text a rather complicated and intuitive formula for computing the final grade. A visual picture will be presented at the start of the course (the editor does not allow it to be inserted here).

We set

A = # Assignments

and we compute

N = 2*(#P) + 3*(#E),

where #P indicates the number of Passes you have received and #E the number of Excellent. (Notice that A = #P + #E + #F.)

If you have submitted your study strategy essay by the deadline and if you passed the final, then your final grade is equal to

14/6 + (17/6)*(N/A) rounded to the nearest integer in {1,2,3,...,10}.

The specifics of this grading policy are subject to change if the need arises.

There are no re-sit opportunities for any of the assignments/essays. Grades for assignments from previous years do not transfer to this year.

(4) At any moment during the course the instructor can request a student to explain one or more of his/her assignments in order for the instructor to verify whether the student understands the material presented in the assignments; if the student is not able to explain his/her understanding in an assignment, then the grade for the assignment will be downgraded to a fail.

Entry Requirements

The course attempts to be self-contained and explains the necessary machine learning concepts as well as security and crypto techniques. Nevertheless, students are required to be independent and study extra where their mathematical background is limited. For example, you will want to know how to compute gradients, know about the structure of a proof, can read mathematical notation, etc.

Literature

Slide decks, papers, and reference material where needed.

Additional Information Target Audience

Master Computer Security; Master Computer Science; Master Artificial Intelligence