M. Xue et al.: Machine Learning Security: Threats, Countermeasures, and Evaluations

萌芽研究会セッション「AI Safety & Security」
Source).Xue, Mingfu, Chengxiang Yuan, Heyi Wu, Yushu Zhang, andWeiqiang Liu. “Machine Learning Security: Threats,Countermeasures, and Evaluations.” IEEE Access 8 (2020):
74720‒42. https://doi.org/10.1109/ACCESS.2020.2987435.

FIGURE 1. Overview of machine learning systems, which illustrates the two phases, the learning algorithm, and differententities.
(1) Poisoning攻撃(2) Adversarial Examples攻撃(3) Model Inversion攻撃fitraditional machine learning algorithms, such as Support Vechowever, they still lack consensus. Goodfellow et al. [2]tor Machine (SVM), k-means, Naive Bayes, etc.
indicate that the linearity of DNN model in high dimensional
Entities in Adversarial Models: A normal machine learnspace is a possible reason for being vulnerable to adversarial
ing system consists of the following entities, data owner,
example attacks. Studies [1], [8] also suggest that training
system/service provider, and clients, while in the adversarial
data incompletion is one of the reasons for the existencemodel, there are also attackers, as shown in Fig. 1. Theof adversarial examples. They conclude that the adversarial
data owners are the owners of the massive training data
examples are corner cases with low probability in the test set,
which are usually private. The system/service provider is thewhich indicates that the training data is not enough and is notSource) Geiping, Jonas, Liam Fowl, W. Ronny Huang, Wojciech Czaja,Source) Fredrikson, Matt, Somesh Jha, and Thomas Ristenpart. “ModelSource) Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao,provider
whoconstructs
the algorithm,trains themodel andcomplete. Yeom et al.
[13]Inversion
studyAttacks
the effectof overfitting andGavin
Taylor, MichaelMoeller,and Tom Goldstein.
“Witchesʼ
That Exploit Con dence Information andC., ... & Song, D. (2017). Robust physical-world attacks on
Brew: Industrial Scale Data Poisoning via Gradient Matching,”
Basic
Countermeasures.”
In
Proceedingsof the 22nd
then performs the task or provides the service.
clients
influence
on recovering sensitive training dataor attributebyACM
deepThelearningmodels. arXiv preprint
arXiv:1707.08945.
2021.
SIGSAC Conference on Computer and Communications
are the users who use the service, e.g., through the provided
an adversary. They show thatoverfitting
plays
anUSA:
importantSecurity,1322‒33. Denver
Colorado
ACM, 2015.
prediction APIs. The attacker can be an external adversary, orrole to make the attacker be able to carry out membership
中心テーマ：AIのSafety/Security課題
an curious person inside the system who is interested in the / AIによるSafety/Security課題の解決
inference attacks. Due to the unexplained nature of machine

萌芽研究会セッション「AI Safety & Security」
10:00

10:00-10:30

10:30-11:00

11:00-11:30

11:30-12:00

オープニングプログラム 11月26日(金)○大塚 玲（情報セキュリティ大学院大学）【招待講演】自動車業界におけるAI Safety動向とデンソーの取り組み○中江 俊博（株式会社デンソー・ソフト生産革新部 ）【招待講演】機械学習システムの脆弱性とセキュリティ・リスク
○菅 和聖（日本銀行金融研究所）【招待講演】機械学習を使用した不正プログラムの開発環境推定手法の提案○大坪雄平（警察大学校／警察庁）【招待講演】AI Safety & Securityの国際研究動向○櫻井 幸一（九州大学 ）AISEC

DLS: Deep Learning Security

AISafety

AIセキュリティセッション

AI分野・Security分野のトップカンファレンスでワークショップが続々開催

ご参加をお待ちしています！