208 citations · 588 across the 22 of their papers we have counts for
23 papers
Unlocking Accuracy and Fairness in Differentially Private Image Classification
Leonard Berrada, Soham De, Judy Hanwen Shen +6
Privacy-preserving machine learning aims to train models on private data without leaking sensitive information. Differential privacy (DP) is considered the gold standard framework…
Bounding data reconstruction attacks with the hypothesis testing interpretation of differential privacy
Georgios Kaissis, Jamie Hayes, Alexander Ziller +1
We explore Reconstruction Robustness (ReRo), which was recently proposed as an upper bound on the success of data reconstruction attacks against machine learning models. Previous r…
Differentially Private Diffusion Models Generate Useful Synthetic Images
Sahra Ghalebikesabi, Leonard Berrada, Sven Gowal +7
The ability to generate privacy-preserving synthetic versions of sensitive image datasets could unlock numerous ML applications currently constrained by data availability. Due to t…
Bounding Training Data Reconstruction in DP-SGD
Jamie Hayes, Saeed Mahloujifar, Borja Balle
Differentially private training offers a protection which is usually interpreted as a guarantee against membership inference attacks. By proxy, this guarantee extends to other thre…
Extracting Training Data from Diffusion Models
Nicholas Carlini, Jamie Hayes, Milad Nasr +6
Image diffusion models such as DALL-E 2, Imagen, and Stable Diffusion have attracted significant attention due to their ability to generate high-quality synthetic images. In this w…
Unlocking High-Accuracy Differentially Private Image Classification through Scale
Soham De, Leonard Berrada, Jamie Hayes +2
Differential Privacy (DP) provides a formal privacy guarantee preventing adversaries with access to a machine learning model from extracting information about individual training p…
Learning to be adversarially robust and differentially private
Jamie Hayes, Borja Balle, M. Pawan Kumar
We study the difficulties in learning that arise from robust and differentially private optimization. We first study convergence of gradient descent based adversarial training with…
Reconstructing Training Data with Informed Adversaries
Borja Balle, Giovanni Cherubin, Jamie Hayes
Given access to a machine learning model, can an adversary reconstruct the model's training data? This work studies this question from the lens of a powerful informed adversary who…
Towards transformation-resilient provenance detection of digital media
Jamie Hayes, Krishnamurthy, Dvijotham +4
Advancements in deep generative models have made it possible to synthesize images, videos and audio signals that are difficult to distinguish from natural signals, creating opportu…
Adaptive Webpage Fingerprinting from TLS Traces
Vasilios Mavroudis, Jamie Hayes
In webpage fingerprinting, an on-path adversary infers the specific webpage loaded by a victim user by analysing the patterns in the encrypted TLS traffic exchanged between the use…
Local and Central Differential Privacy for Robustness and Privacy in Federated Learning
Mohammad Naseri, Jamie Hayes, Emiliano De Cristofaro
Federated Learning (FL) allows multiple participants to train machine learning models collaboratively by keeping their datasets local while only exchanging model updates. Alas, thi…
Extensions and limitations of randomized smoothing for robustness guarantees
Jamie Hayes
Randomized smoothing, a method to certify a classifier's decision on an input is invariant under adversarial noise, offers attractive advantages over other certification methods. I…
Unique properties of adversarially trained linear classifiers on Gaussian data
Jamie Hayes
Machine learning models are vulnerable to adversarial perturbations, that when added to an input, can cause high confidence misclassifications. The adversarial learning research co…
Trade-offs between membership privacy & adversarially robust learning
Jamie Hayes
Historically, machine learning methods have not been designed with security in mind. In turn, this has given rise to adversarial examples, carefully perturbed input samples aimed t…
Contamination Attacks and Mitigation in Multi-Party Machine Learning
Jamie Hayes, Olga Ohrimenko
Machine learning is data hungry; the more data a model has access to in training, the more likely it is to perform well at inference time. Distinct parties may want to combine thei…
A note on hyperparameters in black-box adversarial examples
Jamie Hayes
Since Biggio et al. (2013) and Szegedy et al. (2013) first drew attention to adversarial examples, there has been a flood of research into defending and attacking machine learning…
Evading classifiers in discrete domains with provable optimality guarantees
Bogdan Kulynych, Jamie Hayes, Nikita Samarin +1
Machine-learning models for security-critical applications such as bot, malware, or spam detection, operate in constrained discrete domains. These applications would benefit from h…
Learning Universal Adversarial Perturbations with Generative Models
Jamie Hayes, George Danezis
Neural networks are known to be vulnerable to adversarial examples, inputs that have been intentionally perturbed to remain visually similar to the source input, but cause a miscla…
LOGAN: Membership Inference Attacks Against Generative Models
Jamie Hayes, Luca Melis, George Danezis +1
Generative models estimate the underlying distribution of a dataset to generate realistic samples according to that distribution. In this paper, we present the first membership inf…
The Loopix Anonymity System
Ania Piotrowska, Jamie Hayes, Tariq Elahi +2
We present Loopix, a low-latency anonymous communication system that provides bi-directional 'third-party' sender and receiver anonymity and unobservability. Loopix leverages cover…
Generating Steganographic Images via Adversarial Training
Jamie Hayes, George Danezis
Adversarial training was recently shown to be competitive against supervised learning methods on computer vision tasks, however, studies have mainly been confined to generative tas…
Traffic Confirmation Attacks Despite Noise
Jamie Hayes
We propose a traffic confirmation attack on low-latency mix networks based on computing robust real-time binary hashes of network traffic flows. Firstly, we adapt the Coskun-Memon…
k-fingerprinting: a Robust Scalable Website Fingerprinting Technique
Jamie Hayes, George Danezis
Website fingerprinting enables an attacker to infer which web page a client is browsing through encrypted or anonymized network connections. We present a new website fingerprinting…