Search

Despite the impressive performances reported by deep neural networks in different application domains, they remain largely vulnerable to adversarial examples, i.e., input samples that are carefully perturbed to cause misclassification at test time. In this work, we propose a deep neural rejection mechanism to detect adversarial examples, based on the idea of rejecting samples that exhibit anomalous feature representations at different network layers. With respect to competing approaches, our method does not require generating adversarial examples at training time, and it is less computationally demanding. To properly evaluate our method, we define an adaptive white-box attack that is aware of the defense mechanism and aims to bypass it. Under this worst-case setting, we empirically show that our approach outperforms previously proposed methods that detect adversarial examples by only analyzing the feature representation provided by the output network layer.

While machine-learning algorithms have demonstrated a strong ability in detecting Android malware, they can be evaded by sparse evasion attacks crafted by injecting a small set of fake components, e.g., permissions and system calls, without compromising intrusive functionality. Previous work has shown that, to improve robustness against such attacks, learning algorithms should avoid overemphasizing few discriminant features, providing instead decisions that rely upon a large subset of components. In this work, we investigate whether gradient-based attribution methods, used to explain classifiers' decisions by identifying the most relevant features, can be used to help identify and select more robust algorithms. To this end, we propose to exploit two different metrics that represent the evenness of explanations, and a new compact security measure called Adversarial Robustness Metric. Our experiments conducted on two different datasets and five classification algorithms for Android malware detection show that a strong connection exists between the uniformity of explanations and adversarial robustness. In particular, we found that popular techniques like Gradient*Input and Integrated Gradients are strongly correlated to security when applied to both linear and nonlinear detectors, while more elementary explanation techniques like the simple Gradient do not provide reliable information about the robustness of such classifiers.

Deep neural networks are vulnerable to adversarial examples, i.e., carefully-crafted inputs that mislead classification at test time. Recent defenses have been shown to improve adversarial robustness by detecting anomalous deviations from legitimate training samples at different layer representations - a behavior normally exhibited by adversarial attacks. Despite technical differences, all aforementioned methods share a common backbone structure that we formalize and highlight in this contribution, as it can help in identifying promising research directions and drawbacks of existing methods. The first main contribution of this work is the review of these detection methods in the form of a unifying framework designed to accommodate both existing defenses and newer ones to come. In terms of drawbacks, the overmentioned defenses require comparing input samples against an oversized number of reference prototypes, possibly at different representation layers, dramatically worsening the test-time efficiency. Besides, such defenses are typically based on ensembling classifiers with heuristic methods, rather than optimizing the whole architecture in an end-to-end manner to better perform detection. As a second main contribution of this work, we introduce FADER, a novel technique for speeding up detection-based methods. FADER overcome the issues above by employing RBF networks as detectors: by fixing the number of required prototypes, the runtime complexity of adversarial examples detectors can be controlled. Our experiments outline up to 73x prototypes reduction compared to analyzed detectors for MNIST dataset and up to 50x for CIFAR10 dataset respectively, without sacrificing classification accuracy on both clean and adversarial data., Submitted as a Neurocomputing journal paper

Background and aim Cardiac resynchronization therapy (CRT) reduces mortality and morbidity in chronic heart failure symptomatic patients with broad QRS who are already undergoing optimal medical treatment. However, approximately one-third of implanted patients do not show any benefit from this treatment. Right ventricle (RV) dysfunction leads to a worse outcome in patients with heart failure, but its role in predicting the response to CRT has shown conflicting results. The purpose of our study was to investigate how the RV function, assessed by cardiac magnetic resonance (CMR), could influence the outcome of heart failure patients treated with CRT. Methods and results We retrospectively enrolled 72 heart failure patients, 38 affected by dilated cardiomyopathy (DCM) and 34 by ischemic dysfunction, with left bundle branch block, QRS greater than 120 ms and standard indications to CRT. We defined the response to CRT as an improvement of at least 10% of the left ventricular ejection fraction (LVEF) or at least one of the NYHA functional classes. We stratified the population into two groups based on the right ventricle ejection fraction (RVEF) at CMR: group 1 RVEF at least 55% (n = 32), group 2 RVEF less than 55% (n = 40). After a mean follow-up of 38 ± 12 months, 44 patients (61%) were considered responders whereas 28 (39%) did not show any benefit. Patients in group 1 had a higher rate of response to CRT (75 vs. 50%, P = 0.03). At the univariate analysis RVEF [54 vs. 43%; confidence interval (CI) = 0.907-0.980; hazard ratio = 0.943; P = 0.003], RV end-systolic volume (56 vs. 84 ml; CI = 1.005-1.034; hazard ratio = 1.019; P = 0.008) and tricuspid annular plane systolic excursion (TAPSE) (16.4 vs. 14 mm; CI 0.745-0.976; heart rate = 0.853; P = 0.021) were the parameters most strongly associated with the response to CRT. Male sex, atrial fibrillation, and older age also negatively influenced the outcome. At a multivariate model, RVEF and older age remained significant. Conclusion In our experience, patients with RV dysfunction less likely benefited from CRT. RV assessment, studied with CMR, appears to be a good predictor of the response to biventricular stimulation.

To cope with the increasing variability and sophistication of modern attacks, machine learning has been widely adopted as a statistically-sound tool for malware detection. However, its security against well-crafted attacks has not only been recently questioned, but it has been shown that machine learning exhibits inherent vulnerabilities that can be exploited to evade detection at test time. In other words, machine learning itself can be the weakest link in a security system. In this paper, we rely upon a previously-proposed attack framework to categorize potential attack scenarios against learning-based malware detection tools, by modeling attackers with different skills and capabilities. We then define and implement a set of corresponding evasion attacks to thoroughly assess the security of Drebin, an Android malware detector. The main contribution of this work is the proposal of a simple and scalable secure-learning paradigm that mitigates the impact of evasion attacks, while only slightly worsening the detection rate in the absence of attack. We finally argue that our secure-learning approach can also be readily applied to other malware detection tasks., Accepted for publication on IEEE Transactions on Dependable and Secure Computing

Machine-learning models have been recently used for detecting malicious Android applications, reporting impressive performances on benchmark datasets, even when trained only on features statically extracted from the application, such as system calls and permissions. However, recent findings have highlighted the fragility of such in-vitro evaluations with benchmark datasets, showing that very few changes to the content of Android malware may suffice to evade detection. How can we thus trust that a malware detector performing well on benchmark data will continue to do so when deployed in an operating environment? To mitigate this issue, the most popular Android malware detectors use linear, explainable machine-learning models to easily identify the most influential features contributing to each decision. In this work, we generalize this approach to any black-box machine- learning model, by leveraging a gradient-based approach to identify the most influential local features. This enables using nonlinear models to potentially increase accuracy without sacrificing interpretability of decisions. Our approach also highlights the global characteristics learned by the model to discriminate between benign and malware applications. Finally, as shown by our empirical analysis on a popular Android malware detection task, it also helps identifying potential vulnerabilities of linear and nonlinear models against adversarial manipulations., Comment: Published on the Proceedings of 26th European Signal Processing Conference (EUSIPCO '18)

In a growing number of applications, including computer vision, biometrics, text categorization and information retrieval, samples are often represented more naturally in terms of similarities between each other, rather than in an explicit feature vector space [1], [2]. Traditional machine-learning algorithms can still be used to learn over similarity-based representations; e.g., linear classification algorithms like Support Vector Machines (SVMs) [3], [4] can be trained in the space implicitly induced by the similarity measure (i.e., the kernel function) to learn nonlinear functions in input space. However, the main drawback of similarity-based techniques is their high computational complexity at test time, since computing their classification function often requires matching the input sample against a large set of reference prototypes, and evaluating such similarity measures is usually computationally demanding. Even SVMs, that induce sparsity in the number of required prototypes (the so-called support vectors, SVs) may not provide solutions that are sparse enough, as the number of prototypes (i.e., SVs) grows linearly with respect to the number of training samples [5], [6]. To reduce the number of reference prototypes, several state-of-the-art approaches select them from the training data, and then separately train the classification function using the reduced set of prototypes. However, decoupling these two steps may not effectively reduce the number of prototypes, without significantly affecting classification accuracy [2], [7], [8].

Deep neural networks have been widely adopted in recent years, exhibiting impressive performances in several application domains. It has however been shown that they can be fooled by adversarial examples, i.e., images altered by a barely-perceivable adversarial noise, carefully crafted to mislead classification. In this work, we aim to evaluate the extent to which robot-vision systems embodying deep-learning algorithms are vulnerable to adversarial examples, and propose a computationally efficient countermeasure to mitigate this threat, based on rejecting classification of anomalous inputs. We then provide a clearer understanding of the safety properties of deep networks through an intuitive empirical analysis, showing that the mapping learned by such networks essentially violates the smoothness assumption of learning algorithms. We finally discuss the main limitations of this work, including the creation of real-world adversarial examples, and sketch promising research directions., Accepted for publication at the ICCV 2017 Workshop on Vision in Practice on Autonomous Robots (ViPAR)

Many modern face verification algorithms use a small set of reference templates to save memory and computational resources. However, both the reference templates and the combination of the corresponding matching scores are heuristically chosen. In this paper, we propose a well-principled approach, named sparse support faces, that can outperform state-of-the-art methods both in terms of recognition accuracy and number of required face templates, by jointly learning an optimal combination of matching scores and the corresponding subset of face templates. For each client, our method learns a support vector machine using the given matching algorithm as the kernel function, and determines a set of reference templates, that we call support faces, corresponding to its support vectors. It then drastically reduces the number of templates, without affecting recognition accuracy, by learning a set of virtual faces as well-principled transformations of the initial support faces. The use of a very small set of support face templates makes the decisions of our approach also easily interpretable for designers and end users of the face verification system.

The goal of this work is to study the effects of the adoption of agile practices on open source development. In particular, we started to evaluate the effects of TDD (Test Driven Development) since it is easer to apply in a distributed environment than most other agile practices. In order to reach this goal we used the simulation modeling approach. We developed a simulation model of open source software development process. The model was tuned using data from a real FLOSS project: Apache HTTP Server. To introduce the TDD practice in our FLOSS simulation model, we made some assumptions based on empirical results. The two FLOSS development models (nonTDD and TDD) were compared. The one incorporating the agile practice yields better results in terms of code quality.

In this article, we present a simulation model that we developed for exploring the influence of two key Extreme Programming (XP) practices — Test-first Programming and Pair Programming — on the evolution of an XP software project. We present the results obtained simulating a typical XP project changing the usage levels of the two practices. We focused on output variables related to effort, size, quality and released functionalities. Copyright © 2006 John Wiley & Sons, Ltd.

Image classification is intrinsically a multiclass, nonlinear classification task. Support Vector Machines (SVMs) have been successfully exploited to tackle this problem, using one-vs-one or one-vs-all learning schemes to enable multiclass classification, and kernels designed for image classification to handle nonlinearities. To classify an image at test time, an SVM requires matching it against a small subset of the training data, namely, its support vectors (SVs). In the multiclass case, though, the union of the sets of SVs of each binary SVM may almost correspond to the full training set, potentially yielding an unacceptable computational complexity at test time. To overcome this limitation, in this work we propose a well-principled reduction method that approximates the discriminant function of a multiclass SVM by jointly optimizing the full set of SVs along with their coefficients. We show that our approach is capable of reducing computational complexity up to two orders of magnitude without significantly affecting recognition accuracy, by creating a super-sparse, budgeted set of virtual vectors.

Numerous scientific evidence support that quality of life of the patients have significant prognostic impact in various heart's diseases. Studies on quality of life in general population have led to the validation of different questionnaires. Currently there are no specific questionnaires for assessing the quality of life in thalassemic patients. Questionnaire on health status SF-36 is a validated and simple tool that, through two synthetic indices, which refers to physical (Physical Component Summary, PCS) and psychic health's domain (Mental Component Summary, MCS), provides important information on quality of life. PCS reflects concepts related to physical morbidity, while the index MCS reflects psychological or mental morbidity. Questionnaire SF-36 requires an assessment of the patient's activities of daily living (personal hygiene wait, walk, climb stairs, carry weight, etc.), subjective health status, emotional state, on social life and relationships. The aim of our study was to assess whether, in this population, the derived indices have diverged significantly from the healthy reference population and, if so, whether there was a correlation with the severity of underlying heart disease. To assess quality of life in a population of patients (n. 46) with thalassemia major and/or intermediate followed at our center, we administered the Italian version of the questionnaire SF-36 (Apolone, 2005), relating derived indexes with the main clinical and instrumental parameters, especially functional NYHA class, ejection fraction and indices of left ventricular diastolic function, T2* values, echocardiographic signs of pulmonary hypertension and right ventricular dysfunction, such as PAPs values and RV FAC. The mean values of the indices PCS and MCS in the entire study population were, respectively, 47.50 and 51.24, overlapping those of healthy reference population (Survey on health status of Italians, ISTAT 1999-2000). Subgroup analysis showed that the presence of pulmonary hypertension and/or right ventricular dysfunction was associated with a significant deterioration in the perception of physical health (PCS 35.9 versus 48.3 in patients without pulmonary hypertension). The analysis of correlation between PCS and clinical-instrumental variables studied has also returned frankly negative values with the values of PAPs (r -0.86), confirming the negative impact of the presence of pulmonary hypertension on health's perception. No other significant association was identified. In conclusion, our study highlighted how detection of pulmonary hypertension in an unselected population of patients with beta-thalassemia has a detrimental impact on perceived quality of life.

Effectively evaluating the capability of a software development methodology has always been very difficult, owing to the number and variability of factors to control. Evaluating XP is by no way different under this respect. In this paper we present a simulation approach to evaluate the applicability and effectiveness of XP process, and the effects of some of its individual practices. Such approaches using simulation are increasing popular because they are inexpensive and flexible. Of course, they need to be calibrated with real data and complemented with empirical research. The XP process has been modelled and a simulation executive has been written, enabling to simulate XP software development activities. The model follows an object-oriented approach, and has been implemented in Smalltalk language, following XP process itself. It is able to vary the usage level of some XP practices and to simulate how all the project entities evolve consequently.

In this paper we describe XPSuite, a tool comprising two parts: XPSwiki, a tool for managing XP projects and XP4IDE, a plug-in for integrating XPSwiki with the IDE IntelliJ-Idea. The reasons for this integration and the ability of XPSuite to collect process metrics are described. The system has a full object oriented implementation so it is possible to extract all data represented in the model that the system implements.

This paper describes a simulation model that represents the first step to modeling open source software development processes. The model has been tuned using data from a real FLOSS project: Apache. The goal of our research is to show the effects of adopting TDD (Test Driven Development) on our open source simulation model. In order to introduce the TDD practice, we have only changed some parameter values in the FLOSS simulation model. In particular, the average time required to write a line of production code increases because now automated tests are also coded, the number of defects injected during coding decreases as does the debugging time to fix a single defect. The two FLOSS development models (nonTDD and TDD) have been compared, the one incorporating the agile practice of Test Driven Development yielding better results in terms of code quality (defects/Kloc).

In the last years, a few studies and experiences have been published about the compatibility between Extreme Programming and ISO 9001:2000 certification. The actual problem is not to demonstrate if it is possible to certificate an XP process but to explain how an XP process can maintain its agility in such a context. We think that the use of an appropriate tool that supports both XP practices and ISO 9000 standard can simplify this integration process. In this paper we will provide the essential requirements for a tool supporting such functionalities.

Simultaneous allografts of both kidneys were performed in pigs. The experiments were carried out in three groups of animals. In group I both kidneys were grafted with portal venous drainage. In group II both kidneys were grafted with caval venous drainage. In group III the renal vein of one kidney was anastomosed to the portal vein whereas the renal vein of the other kidney was anastomosed to the caval vein. Although in group I the animals showed longterm survival (two of them over one year), in groups II and III all animals died within a few days with typical signs of rejection. These results indicate that the portally anastomosed kidney does not produce immunologic paralysis of the host to avoid the rejection reaction of the other cavally anastomosed kidney.