Adversarial Machine Learning

Undergraduate / Graduate

Machine learning tools are now integrated into all facets of our lives, ranging from facial recognition running on deep neural network classifiers on our phones, to large language models as productivity and educational tools. Yet they are dynamic and ever evolving tools with significant limitations and weaknesses, some of which can be used to manipulate their results, while others can be used to limit the harms produced by their misuse and weaponization. This course takes a pragmatic perspective to the intersection between machine learning and security and privacy. Students will learn about specific topics related to both security (robustness, consistency, attacks and defenses) and privacy of machine learning models, ranging from classifiers on deep neural network architectures to generative tools for text (large language models) and images (diffusion models). We will study both concepts and implementations of a range of attacks and defenses, from using optimization methods (SGD, PGD, CW) that generate model evasion attacks (e.g. adversarial examples) to broader classes of poisoning attacks (dirty-label, clean-label), privacy attacks (model-inversion/extraction, membership-inference), and evolving attacks against large language models. We will also cover techniques to improve model robustness and to defend against a variety of attacks.