Security of Machine Learning 

Lecture Topics
1.    Overview of Machine Learning Security – Confidentiality, Integrity, Availability (CIA), motivational examples, legal background, risk-based approaches.
2.    Decision Manipulation 1 – Attack models, white-box attacks (FGSM, CW, Saliency maps), physical attacks.
3.    Decision Manipulation 2 – Black-box attacks, transferability of adversarial samples.
4.    Decision Manipulation 3 – Defenses (adversarial training, provable robustness, deep k-NN).
5.    Poisoning Attacks (Untargeted Data Poisoning) – Defenses (label flipping, anomaly detection).
6.    Poisoning Attacks (Targeted Data Poisoning) – Feature collision, Witches' Brew, defenses (sample weighting).
7.    Backdoors in Machine Learning Models – Defenses (Neural Cleanse).
8.    Trojan Attacks Against Machine Learning Models
9.    Availability Attacks – Black-box and white-box sponge constructions.
10.    Training Data Reconstruction – Attack models, model inversion.
11.    Membership Attacks – Active and passive attacks, gradient-based, score-based, label-based attacks.
12.    Defenses Against Membership Attacks – Differential privacy (DP-SGD, PATE), regularization.
13.    Model Stealing and Defenses – Model watermarking, inference from training datasets, fingerprinting models.
14.    Exploiting Explainability and Federated Learning Security – Secure aggregation, Byzantine problems, KRUM.

Exercise/Lab Topics
1.    Adversarial Examples and Model Robustness Auditing 1 – White-box attacks.
2.    Adversarial Examples and Model Robustness Auditing 2 – Black-box attacks.
3.    Untargeted Data Poisoning and Defenses 1 – Label flipping.
4.    Targeted Data Poisoning and Defenses 1 – STRIP.
5.    Generating Backdoors in Models and Defenses – BadNets, Neural Cleanse.
6.    Membership and Reconstruction Attacks, Privacy Auditing 1 – Model inversion, gradient-based attacks, differential privacy.
7.    Membership Attacks and Privacy Auditing 2 – Score-based and label-based attacks, regularization as defense.