Security & Privacy of Artificial Intelligence

1 : Introduction (4 April 10-13h)

This module is an overall course introduction, sketching all the facets and aspects of securing a system or service in general, and of a data driven application based on ML in particular. Each of the major course modules will be briefly introduced and motivated.

2 : Security & Privacy (S&P) Engineering and Regulations (4 April, 14-17.30h)

Module 2A

The covering of S&P requirements is a matter of running a significant security project, albeit efficiently. There is no such thing as the ultimate approach, but rather a range of measures and activities that can be applied to strengthen the S&P posture. This can be at the level of requirements and specification, at the level of coding, in security testing, etc. This module will cover the overall landscape and zoom into some of the most promising techniques.

Relevant themes of this session include:

• Threat modelling and risk assessment
• Architectures and blueprints
• Regulations and compliance

Module 2B

Security and privacy requirements are typically not only of a technical nature, they also and largely emerge from the demand to be compliant with policies and regulations. In the second module of Security & Privacy Engineering, we zoom into the most relevant regulations and discuss how we can work towards compliance. In addition, we discuss how this concern can be addressed as an integrated part of the overall development and engineering process.Z

3 : Cryptography: basic & advanced techniques (5 April, 10-13h)

Many protection techniques and technologies are at hand. It goes without saying that cryptography is an essential building block at the heart of data protection, and thus essential for the delivery of S&P requirements. The machine learning pipeline needs protection of training data, production data and models. This challenging environment demands for fairly advanced techniques.

Module 3A

In the module Cryptography I, we revisit the basics of cryptography to make sure that all attendants can refresh their existing knowledge on the subject matter.

Module 3B

In the module Advanced Cryptography and Data Protection, we elaborate on the most recent advances and techniques that can contribute to securing advanced data sharing in distributed AI. Relevant themes of this session include:

1. Data storage in the new century
2. Data processing: an overview of cryptographic protection
   1. MPC intro and applications
   2. FHE state-of-the-art and implications
3. Protection of data in motion

4 : Security and privacy posture of a Machine Learning architecture (5 April, 14-17h)

In this module, we revisit the architecture and operational environment of a machine learning application and analyze the values of contributions of known security techniques. Relevant themes of this session include:

• Attack surface: data, model, process and data flow
• Threat modelling for AI and known challenges
• Adversaries and their capabilities
• Architectural and algorithmic defences
• Security and privacy challenges in Federated Machine Learning

5 : Adversarial Machine Learning (6 April, 14-17h)

In this module, we zoom into the specific challenge of achieving robustness and reliability when facing adversaries that attempt to fool the ML application by feeding disturbing data into, e.g. a classifier. This type of attack is typical to the setting of a ML environment and deserves significant attention. Relevant themes of this session include:

• Vulnerabilities in ML systems; overview of ML specific attacks
• Protection against adversarial examples
• Evaluation and robustness of solutions
• Privacy aspects

6 : Case Studies (7 April, 10-13h)

In this module, we discuss and analyze some case studies and apply the knowhow of this course to a specific application, for example in the context of authentication systems. Relevant themes of this session include:

• Face recognition revisited
• Biometrics and challenges
• Anomaly detection

7 : Workshops (7 April, 14-17h & 8 April, 10-17h)

In this module, we organize – if so desired – interactive workshops with smaller groups of attendants who may share an interest in a common application domain. The goal is to validate which elements of the course can be applied to an application domain or case that is well understood by a team of course attendants. The practical approach and organization of this last module will depend on the engagement and input that is provided by the participants.