With the advance in artificial intelligence and high-dimensional data analysis, federated learning (FL) has emerged to allow distributed data providers to collaboratively learn without direct access to local sensitive data. However, limiting access to individual provider’s data inevitably incurs security issues. For instance, backdoor attacks, one of the most popular data poisoning attacks in FL, severely threaten the integrity and utility of the FL system. In particular, backdoor attacks launched by multiple collusive attackers, i.e., distributed backdoor attacks, can achieve high attack success rates and are hard to detect. Existing defensive approaches, like model inspection or model sanitization, often require to access a portion of local training data, which renders them inapplicable to the FL scenarios. Recently, the norm clipping approach is developed to effectively defend against distributed backdoor attacks in FL, which does not rely on local training data. However, we discover that adversaries can still bypass this defense scheme through robust training due to its unchanged norm clipping threshold. In this paper, we propose a novel defense scheme to resist distributed backdoor attacks in FL. Particularly, we first identify that the main reason for the failure of the norm clipping scheme is its fixed threshold in the training process, which cannot capture the dynamic nature of benign local updates during the global model’s convergence. Motivated by it, we devise a novel defense mechanism to dynamically adjust the norm clipping threshold of local updates. Moreover, we provide the convergence analysis of our defense scheme. By evaluating it on four non-IID public datasets, we observe that our defense scheme effectively can resist distributed backdoor attacks and ensure the global model’s convergence. Noticeably, our scheme reduces the attack success rates by 84.23% on average compared with existing defense schemes.

Differential privacy has been widely adopted to release continuous- and scalar-valued information on a database without compromising the privacy of individual data records in it. The problem of querying binary- and matrix-valued information on a database in a differentially private manner has rarely been studied. However, binary- and matrix-valued data are ubiquitous in real-world applications, whose privacy concerns may arise under a variety of circumstances. In this paper, we devise an exclusive or (XOR) mechanism that perturbs binary- and matrix-valued query result by conducting an XOR operation on the query result with calibrated noises attributed to a matrix-valued Bernoulli distribution. We first rigorously analyze the privacy and utility guarantee of the proposed XOR mechanism. Then, to generate the parameters in the matrix-valued Bernoulli distribution, we develop a heuristic approach to minimize the expected square query error rate under ϵ -differential privacy constraint. Additionally, to address the intractability of calculating the probability density function (PDF) of this distribution and efficiently generate samples from it, we adapt an Exact Hamiltonian Monte Carlo based sampling scheme. Finally, we experimentally demonstrate the efficacy of the XOR mechanism by considering binary data classification and social network analysis, all in a differentially private manner. Experiment results show that the XOR mechanism notably outperforms other state-of-the-art differentially private methods in terms of utility (such as classification accuracy and F 1 score), and even achieves comparable utility to the non-private mechanisms.

The Magnetic Resonance Imaging (MRI) clinical applications historically have generated large amounts of data, driven by record keeping, data analysis, and regulatory requirements. However, most raw data is not necessarily stored in hard copy form after analysis (like image reconstruction) is completed. In addition, such image analysis, including reconstruction, registration, and perfusion quantification that performed “offline” are computationally-intensive and time-consuming. These limitations make some MRI analysis applications inappropriate for clinical timescale. Driven by the potential to improve the efficiency of MRI analysis and delivery meanwhile reducing the costs, we develop a data streaming analysis framework specifically for Dynamic Contrast-Enhanced (DCE) Liver MRI application in this paper. The proposed framework has two main features. First, the framework transforms the whole image processing from “offline” to “online” to extensively reduce the data saving and transfer time through data streaming architecture. Second, with the design of optimized reconstruction and registration algorithms, as well as the integration of external computing resources, including Graphics Processing Units (GPUs) parallel computing techniques, the streaming framework achieved 180 times speed-up compared with the original protocol. Our in-vivo experiments showed significantly increased speed (Average 7.72 minutes total analysis time compared to 21.6 hours by original protocol) with minor differences in both image quality and perfusion quantification results. This framework allows easy and direct deployment of clinical studies.

Studies find that deep learning models are vulnerable to deliberate adversarial manipulations by attackers. Adversarial training is an effective approach to address this problem. Previous works quantize the input sample space to find appropriate perturbations on the benign samples so as to generate adversarial samples for adversarial training. However, since only the input sample space is quantized with the perturbation space being still continuous, finding the optimal perturbation noise is still a non-convex and computationally expensive problem. Moreover, in this case, the found perturbation noise that will be used to generate an adversarial sample may be strong in the continuous search space, but may become weak after quantization in the input sample space. In this paper, we first develop an Iterative Quantized Local Search (IQLS) algorithm that finds strong perturbation noises by quantizing both the input space and perturbation space. Then, we theoretically analyze and prove the upper bound on the number of iterations needed for the IQLS algorithm, based on which we devise an efficient and effective Quantized Adversarial Training (QAT) scheme. Experiment results on six public datasets show that our proposed scheme outperforms state-of-the-art methods to defend against different adversarial attacks. Particularly, QAT improves the system performance by 14%, 11%, 16% on average on CIFAR-10, SVHN, and CIFAR-100 datasets respectively compared with the existing defense schemes, and reduces the computing time by about 60%.

With the onset of the big data era, designing efficient and effective machine learning algorithms to analyze large-scale data is in dire need. In practice, data is typically generated by multiple parties and stored in a geographically distributed manner, which spurs the study of distributed machine learning. Traditional master-worker type of distributed machine learning algorithms assumes a trusted central server and focuses on the privacy issue in linear learning models, while privacy in nonlinear learning models and security issues are not well studied. To address these issues, in this paper, we explore the blockchain technique to propose a decentralized privacy-preserving and secure machine learning system, called LearningChain, by considering a general (linear or nonlinear) learning model and without a trusted central server. Specifically, we design a decentralized Stochastic Gradient Descent (SGD) algorithm to learn a general predictive model over the blockchain. In decentralized SGD, we develop differential privacy based schemes to protect each party’s data privacy, and propose an l-nearest aggregation algorithm to protect the system from potential Byzantine attacks. We also conduct theoretical analysis on the privacy and security of the proposed LearningChain. Finally, we implement LearningChain on Etheurum and demonstrate its efficiency and effectiveness through extensive experiments.

Paradigm-shifting systems such as cyber-physical systems, collect data of high- or ultrahigh- dimensionality tremendously. Detecting outliers in this type of systems provides indicative understanding in wide-ranging domains such as system health monitoring, information security, etc. Previous dimensionality reduction based outlier detection methods suffer from the incapability of well preserving the critical information in the low-dimensional latent space, mainly because they generally assume an isotropic Gaussian distribution as prior and fail to mine the intrinsic multimodality in high dimensional data. Moreover, most of the schemes decouple the model learning process, resulting in suboptimal performance. To tackle these challenges, in this paper, we propose a unified Unsupervised Gaussian Mixture Variational Autoencoder for outlier detection. Specifically, a variational autoencoder firstly trains a generative distribution and extracts reconstruction based features. Then we adopt a deep brief network to estimate the component mixture probabilities by the latent distribution and extracted features, which is further used by the Gaussian mixture model to estimate sample densities with the Expectation-Maximization (EM) algorithm. The inference model is optimized jointly with the variational autoencoder, the deep brief network, and the Gaussian mixture model. Afterwards, the proposed detector identifies outliers when the estimated sample density exceeds a learned threshold. Extensive simulations on six public benchmark datasets show that the proposed framework outperforms state-of-the-art outlier detection schemes and achieves, on average, 27% improvements in F1 score.