The seminar is cancelled this year because of not having enough participants.
This is the course space for the Aalto University Department of Computer Science Research seminar on security and privacy of machine learning (CS-E400101). The course is worth 5 credits,
which are earned by reading, analyzing, presenting and discussing research papers on the topic of security and privacy of machine learning systems. There is no exam.
Course staff: Samuel Marchal (responsible teacher - email@example.com), Buse Gul Atli (teacher - firstname.lastname@example.org),
Sebastian Szyller (teacher - email@example.com).
Students must register for the course through Sisu by March 1, 2021. We expect around 10 participants for this course.
Zoom Link & Passcode, Teams
All meetings will be hosted on Zoom.
Use the following link: https://aalto.zoom.us/j/67035584821?pwd=R2Z3WXFQdlRIQXBJSnRWbzNNSVdKZz09
All course related discussion will happen on Microsoft Teams. Follow the link below to join the workspace: Microsoft Teams link
After this course, you are expected to have the following new skills:
- knowledge of the security and privacy threats to machine learning systems
- ability to identify the threats to a given machine learning system (threat modelling)
- ability to summarize and critically analyze findings/contributions from research papers
- ability to make a sensible oral presentation of a research paper and to lead a critical discussion about it
- new insights on good research methodology and on scientific writing (useful for MSc. thesis)
The course consists of several group discussion sessions (5 sessions planned). Two scientific papers on the topic of security and privacy of machine learning are presented and discussed during each session. These papers cover both attacks on machine learning systems and defenses to some of these attacks. One student presents and leads the discussion for each paper. The remaining of the students participate in the discussions.
Each paper discussion will typically consist in the presentation of the paper (20 minutes) and an interactive discussion led by the presenter (30 minutes).
Two programming assignments cover crafting adversarial examples to perform evasion attacks, and watermarking of deep neural networks for the purpose of ownership verification.
Assessment and grading
Students are assessed and graded according to 4 components:
- Presenting and leading the discussion on a scientific paper (twice per student): 40% of the grade
- Participation in discussions: 15% of the grade
- Writing paper takeaways and questions: 15% of the grade
- Programing assignments: 30% of the grade
Workload: 132 hours
- reading research papers (3 papers per discussion) - 15 papers x 3h = 45h
- participate to contact sessions (once a week) - 9 sessions x 2h = 18h
- prepare the presentation and the discussion for 1 paper (twice over the course) - 2 preparations x 12h = 24h
- write paper takeaways and questions (1 page to fill once a week, before each discussion session) - 5 sessions x 1h = 5h
- two programing assignments - 2 x 20h = 40h
|Friday, March 4
||Introductory lecture: Course organization and topics overview
|Friday, March 11
||Zoom||Info session + Q&A for programming assignment
|Friday, March 25
||Zoom||Discussion 1: Model evasion (adversarial examples)
|Friday, April 8
||Zoom||Discussion 2: Model poisoning and backdoor
|Tuesday, April 19
||Zoom||General feedback on presentations + discussions already done
|Friday, April 22
||Zoom||Discussion 3: Model confidentiality and Intellectual property
|Friday, May 6
||Discussion 4: Training data privacy
|Friday, May 20
||Zoom||Discussion 5: Privacy-preserving and verifiable training
|Friday, May 27
||Zoom||Final feedback session
What students liked about the course last year (selected feedback)
- "It provides a good chance for me to read state-of-the-art articles, the presentation and discussion part also encourage me to think deeper and learn more actively."
- "The lecturers also helped the leader for discussion and opened new topics to discuss. They also assured that we can actually ask something that we are not sure and it is perfectly fine."
- "The discussions, research paper selection, presentations."
- "Experienced participants in the discussions who could contribute interesting points."
- "Really good feedback after our presentations."
- "Really constructive and detailed feedback on how to improve both content and communication."
- "Good feedback!"