OVERVIEW

Today machine-learning algorithms and AI-based systems are used for many real-world applications, including image recognition, spam filtering, malware detection, biometric recognition. In these applications, the learning algorithm may have to face intelligent and adaptive attackers who can carefully manipulate data to purposely subvert both the learning and the operational phases. Part 1 of the course aims to introduce the fundamentals of the security of machine learning and the related field of adversarial machine learning. Part 2 introduces the international regulations behind the so called “trustworthy AI. The course uses application examples including object recognition in images, biometric recognition, spam filtering, and malware detection. 

AIMS AND CONTENT

LEARNING OUTCOMES

The aim of this teaching unit is to provide students with fundamental and advanced concepts on the security of machine learning and trustworthy artificial intelligence.

AIMS AND LEARNING OUTCOMES

The aim of this course is to provide graduate students with fundamental and advanced concepts on the security of machine learning and trustworthy artificial intelligence.

The last part of the course will have the aim of increasing the students' ability to identify and pursue learning objectives that will enable them to pass an assessed final test

PREREQUISITES

This course is for graduate students who already attended basic courses (or have a basic/intermediate knowledge) of machine learning and artificial intelligence and have a basic/intermediate knowledge of programming languages (in particular, the Python language).

TEACHING METHODS

Lectures. The lecturer will use slides. Copies of slides will be provided to the students. Hands-on classes on attacks and defences of machine-learning algorithms using the SecML open-source Python library for the security evaluation of machine learning algorithms (https://secml.readthedocs.io/).

The last part of the course will consist in the development of problem solving skills and self-assessment of learning through practical exercises that allow students to identify and pursue learning objectives that will enable them to pass an assessed final test.

Students who hold valid certificates relating to Specific Learning Difficulties (SLD), disabilities or other educational needs are invited to contact the lecturer and the school’s disability liaison officer at the start of the course to agree on any teaching arrangements which, whilst respecting the course objectives, take into account individual learning styles. 

The contact details for the university’s disability liaison officer are available at the following link: https://unige.it/commissioni/comitatoperlinclusionedeglistudenticondisabilita. 

SYLLABUS/CONTENT

Part 1: Security of Machine Learning

• Introduction to machine learning security: introduction by practical examples from computer vision, biometrics, spam filtering, malware detection.

• Threat models and attacks to machine learning. Modelling adversarial tasks. The two-player model (the attacker and the classifier).  Levels of reciprocal knowledge of the two players (perfect knowledge, limited knowledge, knowledge by queries and feedback). Attack models against machine learning: evasion, poisoning, backdoor and privacy attacks. The concepts of security by design and security by obscurity.

• Evaluation of machine learning algorithms in adversarial environments. Vulnerability assessment via formal methods and empirical evaluations. Adaptive and non-adaptive evaluations.

• Design of machine learning algorithms in adversarial environments: Taxonomy of possible defense strategies. Evasion attacks and countermeasures. Defenses against evasion, poisoning, backdoor and privacy attacks. Poisoning attacks and countermeasures. Backdoor poisoning, privacy-related threats and defenses.

• Practical sessions with Python. Hands-on classes on attacks against machine learning and defences of machine-learning algorithms.

Part 2: Trustworthy Artificial Intelligence

• AI regulations: the European AI Act.  European ethics guidelines for trustworthy AI. AI regulations in the world

• Fairness and privacy of machine learning:  fairness and privacy-related threats and defenses.

• Robust AI: robust optimization in machine learning; design of machine learning algorithms in the wild and out-of-distribution pattern recognition

• Explainable AI: explainability methods. Global and local methods. Model-specific and model-agnostic methods.

• Practical sessions with Python: Hands-on classes on explainable machine learning algorithms and AI regulations

RECOMMENDED READING/BIBLIOGRAPHY

A. Joseph, B. Nelson, B. Rubinstein, D. Tygar, Adversarial machine learning, Cambridge University Press, 2018

 B., Battista, F. Roli. Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognition 84 (2018): 317-331.

Biggio, B., Corona, I., Maiorca, D., Nelson, B., Srndic, N., Laskov, P., Giacinto, G., Roli, F. Evasion attacks against machine learning at test time.  ECML-PKDD, 2013.

Biggio, B., Fumera, G., Roli, F. Security evaluation of pattern classifiers under attack. IEEE Trans. Knowl. Data Eng., 26 (4):984–996, 2014.

All slides used during the lessons and other teaching materials will be available on Aulaweb. In general, the notes taken during the lessons and the material on Aulaweb are sufficient for preparing for the exam.

TEACHERS AND EXAM BOARD

Exam Board

FABIO ROLI (President)

LUCA DEMETRIO (President Substitute)

LESSONS

LESSONS START

https://easyacademy.unige.it/portalestudenti/index.php?view=easycourse&_lang=it&include=corso

Class schedule

The timetable for this course is available here: Portale EasyAcademy

EXAMS

EXAM DESCRIPTION

Intermediate in class assignments or home assignment+oral exam.

ASSESSMENT METHODS

Intermediate in class assignments (closed-book solutions of numerical/coding exercises and open-ended/closed questions), or home assignment+oral exam. Grading policy = open/closed questions (15/30) +  numerical/coding exercises (15/30)

Students with certification of Specific Learning Disabilities (SLD), disabilities, or other special educational needs must contact the instructor at the beginning of the course to agree on teaching and examination methods that, while respecting the course objectives, take into account individual learning styles and provide appropriate compensatory tools. It is reminded that the request for compensatory/dispensatory measures for exams must be sent to the course instructor, the School representative, and the “Settore servizi per l'inclusione degli studenti con disabilità e con DSA” office (dsa@unige.it) at least 10 working days before the test, as per the guidelines available at the link: https://unige.it/disabilita-dsa

FURTHER INFORMATION

Contact the instructor by email.

Students with valid certifications for Specific Learning Disorders (SLD) may request accommodations for exams at least 7 days prior to the exam date by filling out the “accommodation request form” (available via online services at https://modulionline.unige.it/richiesta-adattamenti# no-back), which will be automatically forwarded by the system to the instructor in charge of the course and to the faculty liaison for students with disabilities and SLDs in their School/Department. 

The student will receive a copy of their request.