Articles
개의 글 articles
-
고정Pinned🎉중앙대학교 산업보안학과 김호기 교수 연구진, 과기정통부 「사이버 보안 특화 AI 파운데이션 모델 개발」 사업 선정
본 연구실이 참여한 네이버클라우드 컨소시엄이 과기정통부 「사이버 보안 특화 AI 파운데이션 모델 개발」 사업 수행기관으로 최종 선정됨.
-
고정Pinned🎉Prof. Hoki Kim's Research Team Selected for MSIT Cybersecurity-Specialized AI Foundation Model Project
The NAVER Cloud consortium that our lab participates in was selected as the executing organization for MSIT's Cybersecurity-Specialized AI Foundation Model Development project.
-
🎉학부 인턴십 주요 성과
교내 경진대회 최우수상 1건을 내고 대학원 진학·금융권 취업으로 이어짐.
-
🎉Undergraduate Internship Outcomes
Eight undergraduate interns at the Trustworthy AI Lab have, since 2025, co-authored one SCIE top-5% journal paper, won one conference outstanding paper award and one university-wide grand prize, and moved on to graduate study and financial-sector positions.
-
📖MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models
핵심 구절을 이미지에 직접 적은 Typography가 LLaVA-1.5의 평균 ASR을 30%p 이상 높임을 보임.
-
📖MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models
MM-SafetyBench evaluates, over 5,040 image-text pairs across 13 scenarios, the phenomenon whereby a harmful query refused in text form is carried out once it is paired with a related image, and shows that typography, which writes the key phrase directly into the image, raises LLaVA-1.5's average attack success rate by more than 30 percentage points.
-
📖Jailbreak in Pieces: Compositional Adversarial Attacks on Multi-Modal Language Models
유해한 요청을 텍스트와 이미지로 나누고 Vision Encoder 접근만으로 임베딩 공간에서 유해한 의미를 숨겨 VLM의 Safety Alignment를 우회하는 Compositional Jailbreak 공격을 제안함.
-
📖Jailbreak in Pieces: Compositional Adversarial Attacks on Multi-Modal Language Models
This paper proposes a compositional attack that splits a harmful request across text and an image and hides the harmful meaning in the embedding space using only access to the vision encoder, thereby bypassing a VLM's safety alignment.
-
📖UMU-Bench: Closing the Modality Gap in Multimodal Unlearning Evaluation
단일 모달과 멀티 모달 질문을 1대1로 짝지은 벤치마크 UMU-Bench와 전용 metric을 제안함.
-
📖UMU-Bench: Closing the Modality Gap in Multimodal Unlearning Evaluation
This paper identifies the modality misalignment problem, in which existing unlearning methods take effect only in the modality they were applied to and do not transfer to the other, and proposes UMU-Bench, a benchmark pairing unimodal and multimodal questions one-to-one, together with dedicated metrics.
-
📖Benchmarking Vision Language Model Unlearning via Fictitious Facial Identity Dataset
기존 방법은 강하게 지울수록 일반 성능이 함께 떨어지며 Preference Optimization은 출력만 감출 뿐 내부 likelihood에 학습 흔적을 남김을 보임.
-
📖Benchmarking Vision Language Model Unlearning via Fictitious Facial Identity Dataset
FIUBench uses 400 synthetic faces and 8,000 private VQA pairs to evaluate whether a vision-language model has genuinely forgotten personal information it learned in association with a face, showing that existing methods degrade general performance the harder they erase and that Preference Optimization merely hides the information in its output while leaving traces in the internal likelihood.
-
📖Visual Adversarial Examples Jailbreak Aligned Large Language Models
Visual Adversarial Perturbation만으로 Safety Alignment가 적용된 VLM에서 Jailbreak을 유도할 수 있음을 보인 초기 연구임.
-
📖Visual Adversarial Examples Jailbreak Aligned Large Language Models
This paper treats the image input of a VLM as a new attack surface and is one of the early works showing that visual adversarial perturbation alone can induce a jailbreak in a VLM with safety alignment applied.
-
📖On the Adversarial Robustness of Multi-Modal Foundation Models
사람이 거의 인지할 수 없는 수준의 이미지 변형만으로 OpenFlamingo의 출력을 공격자가 지정한 허위 정보나 악성 문구로 바꿀 수 있음을 보임.
-
📖On the Adversarial Robustness of Multi-Modal Foundation Models
Image perturbations almost imperceptible to a human are enough to steer OpenFlamingo's output, and in particular to make the model reproduce false information or malicious sentences chosen by the attacker.
-
📖Single Image Unlearning: Efficient Machine Unlearning in Multimodal Large Language Models
새 벤치마크 MMUBench에서 기존 방법보다 잘 잊으면서 모델의 다른 능력은 유지함.
-
📖Single Image Unlearning: Efficient Machine Unlearning in Multimodal Large Language Models
SIU erases only a multimodal LLM's ability to visually recognize a target concept, using a single image and six fine-tuning steps, and on the newly built MMUBench benchmark it forgets more thoroughly than prior methods while leaving the model's other abilities intact.
-
📖Protecting Privacy in Multimodal Large Language Models with MLLMU-Bench
언러닝한 모달리티에 따라 task별 성능이 갈리며 강한 망각과 모델 유용성 사이에 트레이드오프가 있음을 보임.
-
📖Protecting Privacy in Multimodal Large Language Models with MLLMU-Bench
MLLMU-Bench evaluates MLLM unlearning across both multimodal and text-only settings using 500 fictitious profiles and 153 real celebrity profiles, and the experiments show that task-level results differ depending on which modality is unlearned, with a persistent trade-off between strong forgetting and model utility.
-
📖Qwen Series
Qwen-VL은 vision encoder와 LLM을 연결해 하나의 모델에서 다루고, Qwen2-VL은 해상도를 가변 길이 토큰으로 처리하는 naive dynamic resolution과 시간 축을 고려한 MRoPE를 도입했으며, Qwen2.5-VL은 좌표와 시간을 정규화된 값이 아닌 절대값으로 표현해 공간·시간 인식을 실제 스케일에 맞추고, Qwen3.5-Omni는 텍스트·이미지·영상·오디오를 하나의 시퀀스로 통합한 Thinker–Talker 구조 위에서 ARIA로 텍스트와 음성의 생성 속도를 정렬해 실시간 음성 응답까지 확장함
-
📖Qwen Series
Qwen-VL connects a vision encoder to an LLM to handle both within a single model; Qwen2-VL introduces Naive Dynamic Resolution that turns any resolution into variable-length tokens and MRoPE that accounts for the temporal axis; Qwen2.5-VL represents coordinates and time as absolute values rather than normalized ones so that spatial and temporal perception match the real scale; and Qwen3.5-Omni unifies text, image, video, and audio into a single sequence on a Thinker–Talker structure, aligning text and speech generation speeds with ARIA to extend all the way to real-time speech responses.
-
📖MiniGPT-4
자체 생성한 고품질 이미지-설명 데이터로 2단계 미세조정하여 손그림 기반 웹사이트 코딩·밈 해석 등 GPT-4류의 창발적 멀티모달 능력을 적은 학습으로 재현함.
-
📖MiniGPT-4
MiniGPT-4 aligns a frozen pretrained vision encoder and BLIP-2's Q-Former to a powerful LLM (Vicuna) through a single linear projection layer, and with two-stage fine-tuning on self-generated high-quality image-description data, it reproduces GPT-4-like emergent multimodal abilities such as coding a website from a hand-drawn sketch and interpreting memes with very little training.
-
📖LLaVA Series: LLaVA-1, LLaVA-1.5
LLaVA-1.5는 사영층을 MLP로 바꾸고 학술 VQA 데이터와 입력 해상도를 확장해 적은 데이터로도 다수 벤치마크에서 SOTA급 성능을 달성함.
-
📖LLaVA Series: LLaVA-1, LLaVA-1.5
LLaVA opened up the possibility of visual instruction tuning by connecting a CLIP vision encoder and an LLM (Vicuna) through a linear projection layer and training them on multimodal instruction-following data generated by GPT-4; LLaVA-1.5 replaces the projection layer with an MLP and scales up the academic VQA data and input resolution to achieve SOTA-level performance on numerous benchmarks even with limited data.
-
📖Flamingo Series: Flamingo, OpenFlamingo
학습 데이터의 구조·언어 모델 백본·특수 토큰 임베딩 같은 세부 설계가 in-context learning 능력에 미치는 영향을 보여 줌.
-
📖Flamingo Series: Flamingo, OpenFlamingo
Flamingo pairs a large pretrained language model and vision model with a Perceiver resampler and Gated cross-attention dense that bridge them, taking interleaved image, video, and text input to produce autoregressive text output; with no task-specific fine-tuning, multimodal few-shot prompting alone set a new few-shot SOTA on 9 benchmarks at the time. The later OpenFlamingo reproduced the closed-source Flamingo using only open data (LAION-2B, MMC4) and open backbones, reaching 80-89% of Flamingo's performance on 7 benchmarks and revealing how design details such as training-data structure, the language-model backbone, and special-token embeddings shape in-context learning ability.
-
📖BLIP Series: BLIP, BLIP-2, InstructBLIP
InstructBLIP은 instruction을 Q-Former에 함께 입력하는 instruction tuning으로 사용자 요청에 맞는 시각 정보 추출을 가능하게 함.
-
📖BLIP Series: BLIP, BLIP-2, InstructBLIP
BLIP unifies understanding and generation tasks into a single VLP framework, BLIP-2 achieves zero-shot SOTA with few parameters by training only a lightweight Q-Former between a frozen image encoder and a frozen LLM, and InstructBLIP enables user-tailored visual information extraction through instruction tuning that also feeds the instruction into the Q-Former.
-
📖Vision-Language Model의 진화 (BLIP부터 Qwen까지)
가변 해상도·절대 좌표·옴니모달(Qwen)로 진화해 온 흐름을 정리함.
-
🎉KISA·SK쉴더스와 공동 제작한 「AI 보안 위협 대응 매뉴얼」 배포
정보보호의 날(2026.7.8)을 맞아 TrustworthyAI 연구실이 KISA·SK쉴더스와 공동 제작한 「AI 보안 위협 대응 매뉴얼」이 배포됨.
-
🎉AI Security Threat Mitigation Manual Released with KISA and SK Shieldus
On Information Security Day (July 8, 2026), the AI Security Threat Mitigation Manual — co-developed by our TrustworthyAI Lab with KISA and SK Shieldus — was released.
-
📄CyBiasBench: Benchmarking Bias in LLM Agents for Cyber-Attack Scenarios
명시적 지시가 취향과 어긋나면 잘 따르지 않고 ASR이 오히려 하락하는 bias momentum 현상을 발견함.
-
📄CyBiasBench: Benchmarking Bias in LLM Agents for Cyber-Attack Scenarios
Introduces CyBiasBench, a 630-session benchmark showing LLM agents have stable, prompt-independent attack-selection biases, and that steering against these preferences lowers rather than improves attack success (bias momentum).
-
🎉중앙대학교 산업보안학과 김호기 교수 연구진, ICML 2026 논문 3편 채택
김호기 교수 연구진의 논문 3편(SAM 안정성 분석, 딥페이크 사전적 방어 벤치마크, 오픈웨이트 모델 거버넌스 Position 논문)이 ICML 2026에 채택됨.
-
🎉Prof. Hoki Kim's Research Team Has Three Papers Accepted to ICML 2026
Three papers by Prof. Hoki Kim's team — on SAM optimization stability, a proactive deepfake defense benchmark, and open-weight model governance — were accepted to ICML 2026.
-
📄Stability Analysis of Sharpness-Aware Minimization
모멘텀 증가와 배치 크기 감소로 이를 완화할 수 있음을 보임.
-
📄Stability Analysis of Sharpness-Aware Minimization
Shows that SAM turns saddle points into attractors, causing it to escape them more slowly than SGD, and that increasing momentum or decreasing batch size mitigates this instability.
-
📄Proactive Defense Benchmark Against Deepfake Generation
견고성-disruption 트레이드오프 및 단일 생성기 평가의 일반화 과대평가 문제를 밝힘.
-
📄Proactive Defense Benchmark Against Deepfake Generation
Introduces the first unified benchmark for proactive deepfake defenses, decomposing disruption into four axes (including the new CIDR metric) and showing a robustness-disruption trade-off with low cross-generator transferability.
-
📄Position: Current Model Cards Are Insufficient for Downstream Governance of Open-Weight Foundation Models
이를 보완할 3-Layer Governance Framework를 제안함.
-
📄Position: Current Model Cards Are Insufficient for Downstream Governance of Open-Weight Foundation Models
This position paper audits top Hugging Face models and finds only 11.0% jointly publish a model card, AUP, and license, proposing a Three-Layer Governance Framework to close this gap.
-
📖Adversarial Training for Free!
일반 학습과 거의 동일한 비용으로 PGD 수준의 강건성을 달성함.
-
📖Adversarial Training for Free!
This paper proposes free adversarial training, which reuses a single backward pass via minibatch replay to update both parameters and perturbations, matching PGD-level robustness at nearly standard-training cost.
-
📖Adversarial Examples Are Not Bugs, They Are Features
강건성-정확도 트레이드오프와 전이성을 이 관점으로 통일적으로 설명함.
-
📖Adversarial Examples Are Not Bugs, They Are Features
This paper shows experimentally that adversarial examples arise from models learning genuine non-robust features in the data rather than from bugs, unifying the robustness-accuracy trade-off and cross-model transferability under this view.
-
📖Theoretically Principled Trade-off between Robustness and Accuracy
이 논문은 강건 오류와 자연 오류 차이의 이론적 상한을 도출하고, 단일 계수 $\lambda$로 정확도와 강건성을 조절하는 TRADES를 제안하여 CIFAR-10 PGD-20에서 56.61% 강건 정확도로 Madry 모델(47.04%)을 상회함을 보임.
-
📖Theoretically Principled Trade-off between Robustness and Accuracy
This paper proposes TRADES, which bounds the robust-natural error gap and balances accuracy and robustness via a single coefficient $\lambda$, reaching 56.61% robust accuracy on CIFAR-10 PGD-20 versus Madry's 47.04%.
-
📖Robustness May Be at Odds with Accuracy
이 논문은 toy 데이터셋을 통해 적대적 강건성과 표준 정확도 간 trade-off가 학습 방식의 한계가 아니라 데이터 분포 자체의 구조적 결과임을 수학적으로 증명함.
-
📖Robustness May Be at Odds with Accuracy
This paper proves, using a toy dataset, that the trade-off between adversarial robustness and standard accuracy is a structural consequence of the data distribution rather than a mere training limitation.
-
📖Code Review: Adversarial Attacks and Defenses
이 포스팅은 torchattacks·MAIR의 적대적 공격 5종(FGSM·C&W·PGD·PGDL2·TPGD)과 방어 2종(AT·TRADES)의 PyTorch 구현을 코드 단위로 분석해 핵심 수식과 텐서 연산의 대응 관계를 정리함.
-
📖Code Review: Adversarial Attacks and Defenses
This post reviews PyTorch implementations of five adversarial attacks (FGSM, C&W, PGD, PGDL2, TPGD) and two defenses (AT, TRADES) from torchattacks and MAIR, mapping each method's equations to tensor operations.
-
📖Towards Evaluating the Robustness of Neural Networks
logit margin과 change-of-variables 기반 $L_0$/$L_2$/$L_\infty$ C&W 공격으로 distilled 모델에서도 100% 성공률을 달성함.
-
📖Towards Evaluating the Robustness of Neural Networks
Defensive distillation's apparent robustness came from exploiting numerical weaknesses in prior attacks, not true robustness, and the proposed $L_0$, $L_2$, $L_\infty$ C&W attacks achieve 100% success even on distilled models.
-
📖Obfuscated Gradients Give a False Sense of Security
이를 우회하는 BPDA·EOT·Reparameterization 공격으로 무력화하여 방어 평가에는 adaptive attack이 필수임을 제시함.
-
📖Obfuscated Gradients Give a False Sense of Security
Seven of nine ICLR 2018 defenses relied on obfuscated gradients, not true robustness; BPDA, EOT, and reparameterization attacks defeat them, establishing adaptive attacks as the evaluation standard.
-
📖Adversarial Examples in the Physical World
Inception v3 대상 디지털 적대적 이미지를 인쇄 후 재촬영해도 다수가 오분류를 유도함을 실증하고, 디지털에서 가장 강력한 반복 공격(iterative least-likely, destruction rate 72.2%)일수록 물리 변환에는 오히려 더 취약함을 밝힘.
-
📖Adversarial Examples in the Physical World
Adversarial images crafted against Inception v3 remain effective after being printed and re-photographed, with iterative attacks that appear strongest digitally proving the most fragile under physical transformations.
-
📖Towards Deep Learning Models Resistant to Adversarial Attacks
CIFAR-10($\epsilon=8$)에서 64% 이상의 강건 정확도를 달성함.
-
📖Towards Deep Learning Models Resistant to Adversarial Attacks
Adversarial defense is formalized as the saddle-point problem $\min_\theta \mathbb{E}[\max_{\delta\in\mathcal{S}} L(\theta, x+\delta, y)]$, and adversarial training against PGD as a universal first-order adversary achieves over 89.3% robust accuracy on MNIST and 64% on CIFAR-10.
-
📖Intriguing Properties of Neural Networks
L-BFGS로 $\|r\|_2$를 최소화해 찾은 미세 섭동이 서로 다른 구조·데이터로 학습된 모델 간에도 전이되는 적대적 예제를 안정적으로 생성함을 입증함.
-
📖Intriguing Properties of Neural Networks
Semantic information in deep networks is distributed across activation space rather than individual neurons, and L-BFGS minimizing $\|r\|_2$ finds imperceptible adversarial perturbations that transfer across architectures and datasets.
-
📖Explaining and Harnessing Adversarial Examples
신경망의 적대적 취약성이 비선형성이 아니라 고차원 공간에서의 과도한 선형성에서 비롯됨을 규명하고, 이에 기반한 FGSM $\eta=\epsilon\,\mathrm{sign}(\nabla_x J)$ 적대적 훈련으로 Maxout 네트워크 오류율을 89.4%에서 17.9%로 낮춤을 보임.
-
📖Explaining and Harnessing Adversarial Examples
Adversarial vulnerability stems from excessive linearity in high-dimensional spaces rather than nonlinearity, motivating FGSM ($\eta=\epsilon\,\mathrm{sign}(\nabla_x J)$), which via adversarial training cut a Maxout network's error from 89.4% to 17.9%.
-
🎉중앙대학교 산업보안학과 김호기 교수 연구진, 상위 5% SCI 저널 게재
김호기 교수팀의 ARU 프레임워크가 적대적 공격으로 대체 유지 샘플을 생성해 실제 데이터 없이도 산업 AI에서 안전한 데이터 삭제를 가능케 한 성과로 SCIE 상위 5% 저널 IEEE TII에 게재됨.
-
🎉Prof. Hoki Kim's Research Team Publishes in Top 5% SCI Journal
Prof. Hoki Kim's team published the ARU framework, which synthesizes surrogate retain samples via adversarial attacks to enable data deletion in industrial AI, in the top-5% journal IEEE TII.
-
✏️AI의 내재적 위협과 외재적 위협
이를 통제하려면 프라이버시·강건성·설명성을 갖춘 신뢰할 수 있는 AI와 EU·한국의 AI 규제가 함께 필요함을 제안함.
-
✏️Intrinsic and Extrinsic Threats of AI
Our lab classifies AI threats into intrinsic (structural flaws) and extrinsic (human misuse) layers, arguing trustworthy AI requires privacy, robustness, and explainability now mandated by the EU and Korean AI Acts.
-
📄Adversarial Retain-Free Unlearning for Bearing Prognostics and Health Management
베어링 PHM 벤치마크에서 최저 $\Delta$Acc를 달성해 Retrain에 가장 근접함.
-
📄Adversarial Retain-Free Unlearning for Bearing Prognostics and Health Management
ARU proposes a retain-free unlearning method that synthesizes retain-like samples via targeted adversarial attacks and a combined loss, achieving the lowest $\Delta$Acc across bearing PHM benchmarks among retain-free baselines.
-
📖BountyBench: Dollar Impact of AI Agent Attackers and Defenders on Real-World Cybersecurity Systems
Claude Code·Codex 등이 패치에는 강하나 공격에는 취약한 공수 불균형을 보임.
-
📖BountyBench: Dollar Impact of AI Agent Attackers and Defenders on Real-World Cybersecurity Systems
BountyBench evaluates AI agents on real bug-bounty tasks across 25 systems, revealing that agents like Claude Code and Codex excel at patching vulnerabilities but lag at exploiting them.
-
📖CYBENCH: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models
scaffolding·도구보다 모델 자체 추론 능력이 복잡한 취약점 해결의 핵심임을 보임.
-
📖CYBENCH: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models
Cybench is an open-source benchmark of 40 CTF tasks that evaluates LLM agents' cybersecurity capabilities, finding that model reasoning ability, not tools or scaffolding, determines success on complex exploits.
-
🎉‘2025 SW·AI Tech Fair’ 우수성과 발표대회 최우수상
김수민·장희원·전소현 연구원이 김호기 교수 지도로 중앙대 '2025 SW·AI Tech Fair' 우수성과 발표대회에서 설명가능한 AI 기반 가상자산 이상거래 탐지 시스템으로 최우수상을 수상함
-
🎉Grand Prize at the '2025 SW·AI Tech Fair' Outstanding Achievement Presentation
Researchers Sumin Kim, Heewon Jang, and Sohyun Jeon, advised by Prof. Hoki Kim, won the Grand Prize at Chung-Ang University's 2025 SW·AI Tech Fair for an XAI-based virtual-asset fraud detection system.
-
🎉중앙대학교 산업보안학과 김호기 교수 논문, 세계 최고 인공지능 학회 채택
중앙대 김호기 교수의 논문이 제안한 min-max 최적화 기법 Unlearning-Aware Minimization(UAM)이 NeurIPS 2025에 채택되어 비전·LLM 벤치마크 전반에서 기존 기법을 능가함.
-
🎉Prof. Hoki Kim's Paper Accepted at World's Top AI Conference
Prof. Hoki Kim's paper proposing Unlearning-Aware Minimization (UAM), a min-max optimization for machine unlearning, has been accepted at NeurIPS 2025 and outperforms existing methods across vision and LLM benchmarks.
-
📄Unlearning-Aware Minimization
CIFAR·TinyImageNet class-wise 언러닝에서 zero-forget을 달성하고 Zephyr-7B-β의 WMDP에서 최저 위험지식 점수를 기록함
-
📄Unlearning-Aware Minimization
UAM frames unlearning as min-max optimization, minimizing retain loss at weights perturbed to maximize forget loss, achieving zero forget accuracy on class-wise CIFAR/TinyImageNet unlearning and lowest WMDP scores for Zephyr-7B-β.
-
📖Extracting Robust Models with Uncertain Examples
적대적 학습된 원본 모델의 정확도와 강건성을 동시에 추출하며 기존 방어도 우회함을 보임
-
📖Extracting Robust Models with Uncertain Examples
BEST synthesizes Uncertain Examples via PGD-based dual minimization to extract both clean and robust accuracy from adversarially trained victim models, outperforming prior extraction attacks and evading existing extraction defenses.
-
📖Perturbing Inputs to Prevent Model Stealing
OLS/MLE 공격자가 무한 표본에서도 편향된 추정치에 수렴하게 만들고 로지스틱 회귀에서는 sigmoid 꼬리 덕에 서비스 예측 손실은 작게 유지됨을 보임
-
📖Perturbing Inputs to Prevent Model Stealing
Garbling inputs induces endogeneity so OLS/MLE attackers converge to a persistently biased estimate even under infinite queries, while logistic regression's sigmoid tails keep the defender's own prediction loss small.
-
📖Preventing Neural Network Weight Stealing via Network Obfuscation
MNIST에서 1% 노이즈나 지식 증류 복제 시 정확도가 급락함을 보임
-
📖Preventing Neural Network Weight Stealing via Network Obfuscation
Restructuring FC layers via neuron decomposition and deceptive neuron pairs preserves network function while making weights hypersensitive to perturbation, causing accuracy to collapse under 1% weight noise or knowledge-distillation cloning on MNIST.
-
📖Practical Black-Box Attacks Against Machine Learning
FGSM·Papernot 적대적 예제를 오라클에 전이시켜 최대 96.19% 오분류율을 달성하고 그래디언트 마스킹 방어도 무력화함을 보임
-
📖Practical Black-Box Attacks Against Machine Learning
Querying only labels, the method trains a substitute model via Jacobian-based dataset augmentation and transfers FGSM/JSMA adversarial examples, reaching up to 96.19% oracle misclassification and defeating gradient-masking defenses.
-
📖High Accuracy and High Fidelity Extraction of Neural Networks
학습 기반 추출의 한계인 93.7%를 넘어 MNIST에서 거의 100% 충실도를 달성함.
-
📖High Accuracy and High Fidelity Extraction of Neural Networks
Separates accuracy from fidelity and proposes functionally-equivalent extraction that recovers single-hidden-layer ReLU network weights via critical points, achieving near-100% fidelity where learning-based extraction caps at 93.7%.
-
📖Hiding CNN Parameters with Guided Grad-CAM
픽셀 2% 교란만으로 원본과 82% 예측 일치를 유지하며 추출 공격 충실도를 낮춤.
-
📖Hiding CNN Parameters with Guided Grad-CAM
Uses Guided Grad-CAM to inject noise only into low-importance pixels, hiding CNN parameters from equation-solving extraction while preserving prediction accuracy, reaching 82% agreement with only 2% pixels perturbed.
-
📖Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks
victim 정확도 손실 없이 모델 추출 공격자 정확도를 최대 65% 저하시킴.
-
📖Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks
Proposes MAD, an active defense that perturbs softmax outputs to maximize angular deviation between attacker and true gradients, cutting model-stealing attacker accuracy by up to 65% with minimal utility loss.
-
📖Data-Free Model Extraction
적은 쿼리만으로 victim 수준 정확도를 달성함.
-
📖Data-Free Model Extraction
Adapts data-free knowledge distillation to model extraction via a GAN-style generator-student min-max game with zeroth-order gradient approximation, reaching victim-level accuracy with far fewer queries than data-based attacks.
-
📖PRADA: Protecting Against DNN Model Stealing Attacks
기존 공격들을 거의 오탐 없이 검출함을 보임.
-
📖PRADA: Protecting Against DNN Model Stealing Attacks
Proposes PRADA, which detects DNN model extraction by applying a Shapiro-Wilk normality test to the distribution of pairwise distances between consecutive queries, flagging known attacks with near-zero false positives.
-
📖Towards Reverse-Engineering Black-Box Neural Networks
ImageNet에서 모델 계열 예측 정확도 94.8%를 달성함.
-
📖Towards Reverse-Engineering Black-Box Neural Networks
This ICLR 2018 paper shows 12 internal attributes of a black-box neural network can be inferred from input-output queries via KENNEN metamodels, reaching 94.8% model-family accuracy on ImageNet.
-
📖Knockoff Nets: Stealing Functionality of Black-Box Models
실제 얼굴 속성 API 대비 약 30달러로 76~82% 성능을 달성함.
-
📖Knockoff Nets: Stealing Functionality of Black-Box Models
This CVPR 2019 paper shows a black-box model's functionality can be stolen without knowledge of its architecture or data, reaching 76-82% of a real face-attribute API's performance for about $30.
-
📖Stealing Hyperparameters in Machine Learning
반올림 방어는 L2엔 효과적이나 LASSO엔 무력함을 보임.
-
📖Stealing Hyperparameters in Machine Learning
Shows that regularization hyperparameter λ can be recovered analytically from MLaaS-returned model parameters, achieving perfect recovery for Ridge and Kernel Ridge regression, though a rounding defense fails against LASSO.
-
📖Stealing Machine Learning Models via Prediction APIs
USENIX Security 2016 논문은 MLaaS 예측 API가 equation-solving·path-finding·retraining 공격만으로 Amazon·BigML 등 실제 서비스에서 기능적으로 동등한 모델을 추출할 수 있을 만큼 정보를 누출함을 보임.
-
📖Stealing Machine Learning Models via Prediction APIs
This USENIX Security 2016 paper shows prediction APIs leak enough information for equation-solving, path-finding, and retraining attacks to extract functionally equivalent models from real MLaaS services like Amazon and BigML.
-
📄CaddieSet: A Golf Swing Dataset with Human Joint Features and Ball Information
관절 동작 지표와 볼 궤적 데이터를 짝지은 최초의 정량적 골프 스윙 데이터셋 CaddieSet이 CVPR 2025 CVSports 워크숍에 채택됨.
-
📄CaddieSet: A Golf Swing Dataset with Human Joint Features and Ball Information
Kimcaddie, Dongguk University, and Chung-Ang University's CaddieSet, the first golf-swing dataset pairing joint motion metrics with ball-trajectory data, was accepted to the CVPR 2025 CVSports workshop.
-
📄Explaining Determinants of Bank Failure Prediction via Neural Additive Model
이를 대체할 SVM·MLP 수준의 정확도를 유지하면서 변수별 일관된 설명을 제공하는 Neural Additive Model(NAM)을 제안함.
-
📄Explaining Determinants of Bank Failure Prediction via Neural Additive Model
Post-hoc explanations (SHAP, LIME) disagree on top features for black-box bank-failure models, so this paper proposes a Neural Additive Model matching SVM/MLP accuracy while giving consistent, faithful feature explanations.
-
📄Evaluating Practical Adversarial Robustness of Fault Diagnosis Systems via Spectrogram-Aware Ensemble Method
블랙박스 베어링 결함 진단 모델에 spectrogram 코사인 임베딩 손실과 다중 윈도우 앙상블을 결합한 전이 공격 SAEM을 제안하여, 기존 PGD보다 공격 성공률을 크게 높임.
-
📄Evaluating Practical Adversarial Robustness of Fault Diagnosis Systems via Spectrogram-Aware Ensemble Method
This paper proposes SAEM, a spectrogram-aware ensemble transfer attack that combines cosine-embedding loss with multi-window fusion to substantially outperform PGD in fooling black-box bearing fault-diagnosis models.
-
📖Unified Gradient-Based Machine Unlearning with Remain Geometry Enhancement
forget 기울기(F)·remain 손실 보존(R)·Hessian 비율 방향(S) 세 요소로 언러닝 업데이트를 분해하고, Hessian을 직접 계산하지 않고 fast-slow weight update로 근사하며 샘플 중요도 가중치와 saliency mask를 결합한 SFR-on을 제안해 분류·생성 언러닝 전반에서 재학습과의 정확도·KL divergence 격차가 가장 작음을 보임.
-
📖Unified Gradient-Based Machine Unlearning with Remain Geometry Enhancement
SFR-on unifies forget-gradient, remain-preservation, and Hessian-ratio saliency components via fast-slow weight updates approximating $(H_r)^{-1}$, sample reweighting, and a saliency mask, achieving the smallest accuracy/KL-divergence gap to retraining across classification and image-generation unlearning.
-
📖Towards Unbounded Machine Unlearning
forget 데이터에서 학생-교사 KL-divergence를 최대화하고 retain 데이터에서 최소화하는 teacher-student 프레임워크 SCRUB를 제안하고, 과도한 forget-error로 인한 멤버십 추론 노출을 막는 체크포인트 기반 Rewind를 결합해 다양한 시나리오에서 forget quality와 utility 모두 최고 수준을 달성하되 NegGrad+보다 계산 비용이 높음을 보임.
-
📖Towards Unbounded Machine Unlearning
SCRUB, a teacher-student framework that maximizes forget-data KL divergence while minimizing it on retain data with a Rewind step to avoid membership-inference exposure, achieves the best forget-quality/utility balance across scenarios, at higher cost than NegGrad+.
-
📖Approximate Data Deletion from Machine Learning Models
삭제 전후 가중치 비로 민감 특성 잔존을 측정하는 Feature Injection Test(FIT)를 통해 PRU가 기존 영향 함수 기반 방법보다 안정적으로 특성을 제거함을 보임.
-
📖Approximate Data Deletion from Machine Learning Models
PRU deletes data from linear and logistic regression models with cost linear in $d$ and independent of $n$, and the paper's FIT metric shows PRU removes sensitive features more stably than influence-function baselines.
-
📖SalUn: Empowering Machine Unlearning via Gradient-Based Weight Saliency in Both Image Classification and Generation
forget 손실의 기울기 절댓값이 임계값을 넘는 가중치만 업데이트하는 saliency 기반 SalUn을 제안하며, Random Labeling과 결합한 plug-and-play 방식으로 이미지 분류·생성(class-wise·concept-wise forgetting) 전반에서 재학습과의 성능 격차를 가장 작게 유지하고 under/over-forget 문제를 완화함.
-
📖SalUn: Empowering Machine Unlearning via Gradient-Based Weight Saliency in Both Image Classification and Generation
SalUn updates only weights whose forget-loss gradient magnitude exceeds a threshold, and combined with random labeling this saliency-based approach achieves the smallest performance gap to full retraining across image classification and generation unlearning tasks.
-
📖Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models
임베딩을 조작하는 CCE 공격에는 여전히 취약함을 보임.
-
📖Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models
AdvUnlearn applies bi-level adversarial training with retention regularization to the diffusion text encoder, cutting nudity-concept attack success from 100% to 21.13% while preserving image quality, though embedding-based CCE attacks remain effective.
-
📖Machine Unlearning of Features and Labels
재학습 대비 각각 약 1000배·28배 빠르면서 충실도를 유지함을 보임.
-
📖Machine Unlearning of Features and Labels
This seminar paper (NDSS 2023) introduces feature/label-level machine unlearning via influence functions, with first- and second-order updates about 1000x and 28x faster than retraining while preserving fidelity.
-
📖Amnesiac Machine Learning
삭제 배치가 1%를 넘으면 정확도가 급격히 하락함.
-
📖Amnesiac Machine Learning
Amnesiac Unlearning subtracts recorded per-batch parameter updates to forget targeted data faster than retraining or random labeling while blocking inversion and membership-inference attacks, though accuracy collapses beyond ~1% batch removal.
-
📖Evaluating Machine Unlearning via Epistemic Uncertainty
Retraining·Fisher Forgetting에서는 유효하나 Amnesiac Unlearning에서는 반대 경향을 보여 가설이 기각됨.
-
📖Evaluating Machine Unlearning via Epistemic Uncertainty
This seminar paper proposes a Fisher-information-based efficacy score for unlearning evaluation, which behaves as expected for Retraining and Fisher Forgetting but fails for Amnesiac Unlearning.
-
📄Are Self-Attentions Effective for Time Series Forecasting?
시계열 예측에서 셀프 어텐션을 제거하고 크로스 어텐션 기반 CATS 모델로 대체하면 기존 SOTA 대비 성능과 해석성이 모두 개선됨을 보임.
-
📄Are Self-Attentions Effective for Time Series Forecasting?
This NeurIPS 2024 paper shows replacing self-attention with the cross-attention-based CATS model improves time-series forecasting accuracy and interpretability over prior transformer SOTA.
-
✏️신뢰할 수 있는 인공지능의 핵심 요소와 기술적 과제
신뢰할 수 있는 AI의 규제 요건인 안전성·책임성·투명성을 본 연구실의 기술 축인 강건성·일반화·설명성과 연결하여 제시함.
-
✏️Key Elements and Technical Challenges of Trustworthy AI
This lecture note maps Trustworthy AI's three regulatory pillars -- safety, accountability, transparency -- onto the lab's technical research axes of robustness, generalization, and explainability.
-
✏️인공지능 규제와 신뢰성
국제·국내 AI 규제 흐름을 정리하며 세계 최초의 포괄적 AI 규제인 EU AI Act(2024년 8월 발효)를 중심으로 각국 대응을 비교함.
-
✏️AI Regulations and Trustworthiness
This lecture note surveys global AI regulation trends, highlighting the EU AI Act (August 2024) as the world's first comprehensive AI law with tiered risk rules and heavy fines.
-
📄Fantastic Robustness Measures: The Secrets of Robust Generalization
CIFAR-10에서 1,300개 이상의 적대적 학습 모델을 분석해 기존 강건성 지표들과 달리 입력 기울기 노름만이 강건 일반화 차이와 일관되게 상관관계를 보임을 규명함.
-
📄Fantastic Robustness Measures: The Secrets of Robust Generalization
This NeurIPS 2023 paper trains over 1,300 robust CIFAR-10 models and finds only the input gradient norm consistently correlates with the robust generalization gap, unlike prior measures.
-
🏛연구실 소개
KISA·SK쉴더스 「AI 보안 위협 대응 매뉴얼」 공동제작 등의 성과를 냈습니다.
검색 결과가 없습니다.No matching articles.