trustworthy machine learning

We show that splitting backdoor logic across the hardware-software boundary yields an attack that leaves the model looking fully benign, evading state-of-the-art model-level defenses at near-zero hardware overhead.

We show that the ML execution environment itself is an unguarded attack surface, presenting a parasitic runtime Trojan that observes live tensor state to exfiltrate hyperparameters and amplify weak poisoning into 100%-success backdoors.

We show that any image or audio input in a multi-modal retrieval system can be turned into an adversarial hub that is retrieved for thousands of unrelated queries, and that standard hubness mitigations do not defend against it.

We compose existing Lp-bounded attacks into a differentiable meta-attack that produces adversarial examples which are both more effective and more perceptually aligned than state-of-the-art perceptual attacks.