Similar to other machine learning frameworks, Offline Reinforcement Learning (RL) is shown to be vulnerable to poisoning attacks, due to its reliance on externally sourced datasets, a vulnerability that is exacerbated by its sequential nature. To mitigate the risks posed by RL poisoning, we extend certified defenses to provide larger guarantees against adversarial manipulation, ensuring robustness for both per-state actions, and the overall expected cumulative reward. Our approach leverages properties of Differential Privacy, in a manner that allows this work to span both continuous and discrete spaces, as well as stochastic and deterministic environments---significantly expanding the scope and applicability of achievable guarantees. Empirical evaluations demonstrate that our approach ensures the performance drops to no more than 50% with up to 7% of the training data poisoned, significantly improving over the 0.008% in prior work (Wu et al., 2022), while producing certified radii that is 5 times larger as well. This highlights the potential of our framework to enhance safety and reliability in offline RL.

The practical applicability of multiagent reinforcement learning is hindered by its low sample efficiency and slow learning speed. While reward shaping and expert guidance can partially mitigate these challenges, their efficiency is offset by the need for substantial manual effort. To address these constraints, we introduce Multiagent Environment-aware semi-Automated Guide (MEAG), a novel framework that leverages widely known, highly efficient, and low-resolution single-agent pathfinding algorithms for shaping rewards to guide multiagent reinforcement learning agents. MEAG uses these single-agent solvers over a coarse-grid surrogate that requires minimal manual intervention, and guides agents away from random exploration in a manner that significantly reduces computational costs. When tested across a range of densely and sparsely connected multiagent navigation environments, MEAG consistently outperforms state-of-the-art algorithms, achieving up to faster convergence and higher rewards. These improvements enable the consideration of MARL for more complex real-world pathfinding applications ranging from warehouse automation to search and rescue operations, and swarm robotics.

In guaranteeing the absence of adversarial examples in an instance's neighbourhood, certification mechanisms play an important role in demonstrating neural net robustness. In this paper, we ask if these certifications can compromise the very models they help to protect? Our new *Certification Aware Attack* exploits certifications to produce computationally efficient norm-minimising adversarial examples $74$% more often than comparable attacks, while reducing the median perturbation norm by more than $10$%. While these attacks can be used to assess the tightness of certification bounds, they also highlight that releasing certifications can paradoxically reduce security.

Certified robustness circumvents the fragility of defences against adversarial attacks, by endowing model predictions with guarantees of class invariance for attacks up to a calculated size. While there is value in these certifications, the techniques through which we assess their performance do not present a proper accounting of their strengths and weaknesses, as their analysis has eschewed consideration of performance over individual samples in favour of aggregated measures. By considering the potential output space of certified models, this work presents two distinct approaches to improve the analysis of certification mechanisms, that allow for both dataset-independent and dataset-dependent measures of certification performance. Embracing such a perspective uncovers new certification approaches, which have the potential to more than double the achievable radius of certification, relative to current state-of-the-art. Empirical evaluation verifies that our new approach can certify 9% more samples at noise scale σ = 1, with greater relative improvements observed as the difficulty of the predictive task increases.

Poisoning attacks can disproportionately influence model behaviour by making small changes to the training corpus. While defences against specific poisoning attacks do exist, they in general do not provide any guarantees, leaving them potentially countered by novel attacks. In contrast, by examining worst-case behaviours Certified Defences make it possible to provide guarantees of the robustness of a sample against adversarial attacks modifying a finite number of training samples, known as pointwise certification. We achieve this by exploiting both Differential Privacy and the Sampled Gaussian Mechanism to ensure the invariance of prediction for each testing instance against finite numbers of poisoned examples. In doing so, our model provides guarantees of adversarial robustness that are more than twice as large as those provided by prior certifications.

Anomaly detection is often deployed in centralised systems, for which critical failure points exist. However, the rising availability of low-cost, wireless-connected devices introduces opportunities for new anomaly detection techniques that leverage more robust topologies. In this paper, we propose a novel collaborative training scheme for anomaly detection models that involves sharing machine learning models amongst devices for incremental training. Using the Adversarial Autoencoder architecture, pseudo-rehearsal, and gossip-based communication, our framework provides all participating devices with a structured representation of other devices' data, so that training can continue even in the event of a device failure, with a 43 % smaller performance degradation than state of the art alternatives. Under both optimal conditions and those with device failure, our model consistently exhibits better anomaly detection performance.

While several wireless network simulators exist, the absence of modern, standardised network datasets may adversely affect the application of machine learning methods to problems involving wireless networks. Due to the difficulty of acquiring and sharing more modern network datasets, many of the rapidly evolving techniques in machine learning are only ever ported to network analysis through archaic network datasets such as KDD'99-creating a divide between communication networks and machine learning. To address this divide, this paper presents a new network simulation framework that brings existing network and machine learning tools together to conveniently generate data consisting of PCAP or raw physical layer data and derived statistics in a format that is directly consumable by machine learning algorithms. The proposed simulation frame-work allows the user to design custom networks through a simple configuration file-based scheme instead of learning a sophisticated network simulator. Measuring our framework's performance on consumer-grade devices, raw data is efficiently generated at up to 1, 200 Ethernet frames per second, and processed into feature vectors of 5.6 samples per second (where each sample uses 1 second of simulation time) or 0.29 samples per second if physical layer signals are used.

In response to subtle adversarial examples flipping classifications of neural network models, recent research has promoted certified robustness as a solution. There, invariance of predictions to all norm-bounded attacks is achieved through randomised smoothing of network inputs. Today's state-of-the-art certifications make optimal use of the class output scores at the input instance under test: no better radius of certification (under the $L_2$ norm) is possible given only these score. However, it is an open question as to whether such lower bounds can be improved using local information around the instance under test. In this work, we demonstrate how today's ``optimal'' certificates can be improved by exploiting both the transitivity of certifications, and the geometry of the input space, giving rise to what we term Geometrically-Informed Certified Robustness. By considering the smallest distance to points on the boundary of a set of certifications this approach improves certifications for more than $80 \%$ of Tiny-Imagenet instances, yielding an on average $5\%$ increase in the associated certification. When incorporating training time processes that enhance the certified radius, our technique shows even more promising results, with a uniform $4$ percentage point increase in the achieved certified radius.

By offering unprecedented flexibility for wireless communications, Software-Defined Radio (SDR) is an enabling technology for distributed platforms such as Internet-of-Things (IoT) and cognitive radio. We propose a network of SDR devices with sensing and computation capabilities without relying on a centralized architecture to monitor and develop a detailed representation of network behavior in the radio frequency spectrum. This network representation provides a foundation for the task of anomaly detection for security purposes, in which SDRs collect the data needed to identify adversarial actors in a selected environment. We present and evaluate a novel distributed anomaly detection scheme for SDRs that applies Round Robin Learning (RRL) and Random Exchange Learning (REL) strategies to a type of machine learning model known as an autoencoder. In doing so, participating devices fill in gaps in a single model’s data representation, in order to build a model closer to that achieved through centralized training, while maintaining the advantages of distributed systems. The distributed architecture developed improves network robustness, decreases the amount of intranetwork communication, and preserves privacy of individual SDR subnetworks. Furthermore, it was found to consistently raise the average anomaly detection performance for groups of participating devices without exchanging any training data.

Multiagent reinforcement learning has shown success in guiding the agents' behaviour in systems that have realworld significance. In these frameworks, agents learn how to interact with the environment and other agents while satisfying their objectives. Unfortunately, the level of complexity of realworld problems requires a significant investment of computational resources before multiagent reinforcement learning methods are able to deliver results. However, by incorporating a priori domain knowledge, more computationally-efficient algorithms can be developed. In this paper, for the first time, we present a Domain-Aware Multiagent Actor-Critic (DAMAC) algorithm, which integrates domain knowledge with the centralised learning and decentralised execution multiagent reinforcement learning approach using domain-specific solvers. Our experiments show that our algorithm achieves substantial high reward and reduces the training time by two orders of magnitude as compared to other multiagent reinforcement learning algorithms. This enables the adoption of this powerful framework in more resource-constrained scenarios.