12 citations · 64 across the 14 of their papers we have counts for
14 papers
Publicly-Detectable Watermarking for Language Models
Jaiden Fairoze, Sanjam Garg, Somesh Jha +3
We present a publicly-detectable watermarking scheme for LMs: the detection algorithm contains no secret information, and it is executable by anyone. We embed a publicly-verifiable…
Overparameterization from Computational Constraints
Sanjam Garg, Somesh Jha, Saeed Mahloujifar +2
Overparameterized models with millions of parameters have been hugely successful. In this work, we ask: can the need for large models be, at least in part, due to the \emph{computa…
Optimal Membership Inference Bounds for Adaptive Composition of Sampled Gaussian Mechanisms
Saeed Mahloujifar, Alexandre Sablayrolles, Graham Cormode +1
Given a trained model and a data sample, membership-inference (MI) attacks predict whether the sample was in the model's training set. A common countermeasure against MI attacks is…
NeuraCrypt is not private
Nicholas Carlini, Sanjam Garg, Somesh Jha +3
NeuraCrypt (Yara et al. arXiv 2021) is an algorithm that converts a sensitive dataset to an encoded dataset so that (1) it is still possible to train machine learning models on the…
Is Private Learning Possible with Instance Encoding?
Nicholas Carlini, Samuel Deng, Sanjam Garg +6
A private machine learning algorithm hides as much as possible about its training data while still preserving accuracy. In this work, we study whether a non-private learning algori…
A Separation Result Between Data-oblivious and Data-aware Poisoning Attacks
Samuel Deng, Sanjam Garg, Somesh Jha +3
Poisoning attacks have emerged as a significant security threat to machine learning algorithms. It has been demonstrated that adversaries who make small changes to the training set…
Computational Concentration of Measure: Optimal Bounds, Reductions, and More
Omid Etesami, Saeed Mahloujifar, Mohammad Mahmoody
Product measures of dimension are known to be concentrated in Hamming distance: for any set in the product space of probability , a random point in the space, with proba…
Lower Bounds for Adversarially Robust PAC Learning
Dimitrios I. Diochnos, Saeed Mahloujifar, Mohammad Mahmoody
In this work, we initiate a formal study of probably approximately correct (PAC) learning under evasion attacks, where the adversary's goal is to \emph{misclassify} the adversarial…
Empirically Measuring Concentration: Fundamental Limits on Intrinsic Robustness
Saeed Mahloujifar, Xiao Zhang, Mohammad Mahmoody +1
Many recent works have shown that adversarial examples that fool classifiers can be found by minimally perturbing a normal input. Recent theoretical results, starting with Gilmer e…
Adversarially Robust Learning Could Leverage Computational Hardness
Sanjam Garg, Somesh Jha, Saeed Mahloujifar +1
Over recent years, devising classification algorithms that are robust to adversarial perturbations has emerged as a challenging problem. In particular, deep neural nets (DNNs) seem…
Can Adversarially Robust Learning Leverage Computational Hardness?
Saeed Mahloujifar, Mohammad Mahmoody
Making learners robust to adversarial perturbation at test time (i.e., evasion attacks) or training time (i.e., poisoning attacks) has emerged as a challenging task. It is known th…
Adversarial Risk and Robustness: General Definitions and Implications for the Uniform Distribution
Dimitrios I. Diochnos, Saeed Mahloujifar, Mohammad Mahmoody
We study adversarial perturbations when the instances are uniformly distributed over . We study both "inherent" bounds that apply to any problem and any classifier for s…
Universal Multi-Party Poisoning Attacks
Saeed Mahloujifar, Mohammad Mahmoody, Ameer Mohammed
In this work, we demonstrate universal multi-party poisoning attacks that adapt and apply to any multi-party learning process with arbitrary interaction pattern between the parties…
The Curse of Concentration in Robust Learning: Evasion and Poisoning Attacks from Concentration of Measure
Saeed Mahloujifar, Dimitrios I. Diochnos, Mohammad Mahmoody
Many modern machine learning classifiers are shown to be vulnerable to adversarial perturbations of the instances. Despite a massive amount of work focusing on making classifiers r…