Publications
- SCIE Top 5%UnlearningBearingRegulation33Toward regulation-friendly bearing fault diagnosis via structural embedding preserving machine unlearningJiyoung Lee, Chaewon Yoon, and Hoki KimAdvanced Engineering Informatics, 2027Bearing fault diagnosis supports predictive maintenance by detecting mechanical failures early and reducing downtime in industrial monitoring systems. Recent deep learning models have achieved strong performance in classifying fault types. In practical industrial applications, however, certain training data may need to be removed due to privacy regulations, contractual obligations, or data quality issues. Machine unlearning has therefore become increasingly relevant, although prior work has rarely studied it in bearing fault diagnosis. This paper provides a systematic analysis of existing unlearning methods for fault diagnosis systems and shows their poor performance on time-series vibration data typical of bearing faults. To overcome this limitation, a novel structural embedding preserving unlearning method, Soft-directed Embedding Unlearning (SEU) is proposed, which directly manipulates the embedding space by pushing forget samples away from original class clusters while preserving the structure of retain samples using soft examples near decision boundaries. We use a manifold similarity measure to quantify distance-based separation between forget and retain samples and show that SEU provides a stable approximation of the ideal manifold structure. Experiments on both public and private data show that SEU achieves more effective machine unlearning than the evaluated baselines.
@article{lee2027toward, title = {Toward regulation-friendly bearing fault diagnosis via structural embedding preserving machine unlearning}, author = {Lee, Jiyoung and Yoon, Chaewon and Kim, Hoki}, year = {2027}, journal = {Advanced Engineering Informatics}, publisher = {Elsevier BV}, volume = {77}, pages = {105199}, doi = {10.1016/j.aei.2026.105199}, } - NeurIPS 2026LLM AgentBiasCybersecurity32CyBiasBench: Benchmarking Bias in LLM Agents for Cyber-Attack ScenariosTaein Lim, Seongyong Ju, Munhyeok Kim, Hyunjun Kim, and Hoki KimIn Fortieth Conference on Neural Information Processing Systems, 2026
@inproceedings{lim2026cybiasbench, title = {CyBiasBench: Benchmarking Bias in LLM Agents for Cyber-Attack Scenarios}, author = {Lim, Taein and Ju, Seongyong and Kim, Munhyeok and Kim, Hyunjun and Kim, Hoki}, year = {2026}, booktitle = {Fortieth Conference on Neural Information Processing Systems}, } - EMNLP 2026 FindingsUnlearningLLMExponential Tilting31Exponential-Tilted UnlearningSungwon Chae, Keonwoo Kim, and Hoki KimIn Findings of the Association for Computational Linguistics: EMNLP 2026, 2026Large Language Models (LLMs) often memorize and regenerate sensitive or protected content that requires inference-time suppression. While machine unlearning has emerged as a highly active area of research, existing unlearning methods often degrade performance on the retain dataset or require costly retraining. In this paper, we introduce Exponential-Tilted Unlearning (ETU), an inference-time method that formulates unlearning as the KL I-projection of the base next-token distribution under a user-specified upper bound on the forget-token mass, with a closed-form exponential tilt whose scalar multiplier is set analytically. Under a single shared protocol, (i) ETU satisfies the constraint across nine instruction-tuned dense and Mixture-of-Experts backbones on TOFU, RWKU, and WPU while preserving retain utility; (ii) the same calibrated family covers the full spectrum with the strict zero-mass case as a limiting operating point; and (iii) representative weight-update methods expose no such calibrated residual-mass control.
@inproceedings{chae2026exponentialtilted, title = {Exponential-Tilted Unlearning}, author = {Chae, Sungwon and Kim, Keonwoo and Kim, Hoki}, year = {2026}, booktitle = {Findings of the Association for Computational Linguistics: EMNLP 2026}, } - ICML 2026SAMStabilityOptimization30Stability Analysis of Sharpness-Aware MinimizationHoki Kim, Jinseong Park, Yujin Choi, and Jaewook LeeIn Forty-third International Conference on Machine Learning, 2026Sharpness-aware minimization (SAM) is a recently proposed training method that seeks to find flat minima in deep learning, resulting in state-of-the-art performance across various domains. Instead of minimizing the loss of the current weights, SAM minimizes the worst-case loss in its neighborhood in the parameter space. In this paper, we analyze the stability of SAM and show that, unlike standard gradient descent, SAM can convert saddle points into attractors. We prove via gradient-flow analysis on simple functions and stochastic differential equation analysis that SAM escapes saddle points more slowly than SGD, and we reproduce this behavior empirically on Beale’s function and on deep-learning benchmarks. Building on these findings, we provide practical guidance for stabilizing SAM training (larger momentum, smaller batches) that increases the probability of escaping saddle points.
@inproceedings{kim2026sam, title = {Stability Analysis of Sharpness-Aware Minimization}, author = {Kim, Hoki and Park, Jinseong and Choi, Yujin and Lee, Jaewook}, year = {2026}, booktitle = {Forty-third International Conference on Machine Learning}, } - ICML 2026Model CardAI GovernanceOpen-weight Model29Position: Current Model Cards Are Insufficient for Downstream Governance of Open-Weight Foundation ModelsSungwon Chae, Keonwoo Kim, Hoki Kim, Jaeyeon Ju, and Sangchul ParkIn Forty-third International Conference on Machine Learning, 2026The growth of open-weight foundation models (OWFMs) has prompted the AI community to re-evaluate strategies for effective downstream governance. Although model cards have been widely adopted as transparency artifacts in model repositories, existing frameworks often fail to adequately inform downstream developers and users about the distinct safety challenges posed by OWFMs. We empirically analyze the top-500 most-downloaded models on Hugging Face and show that only 11.0 percent of OWFMs simultaneously provide a model card, an acceptable-use policy (AUP), and a license. We identify four structural gaps: dispersion of safety information, absence of AUPs, conflicts between open-source licenses and AUPs, and disconnection between informational and legal governance. We then propose a three-layer governance framework that integrates an informational layer (a standardized Safety Card), a normative layer (a standard AUP), and a legal layer (an OWFM-specific license), and we provide an OWFM-friendly variant of Apache 2.0 as an appendix.
@inproceedings{chae2026position, title = {Position: Current Model Cards Are Insufficient for Downstream Governance of Open-Weight Foundation Models}, author = {Chae, Sungwon and Kim, Keonwoo and Kim, Hoki and Ju, Jaeyeon and Park, Sangchul}, year = {2026}, booktitle = {Forty-third International Conference on Machine Learning}, } - ICML 2026DeepfakeProactive DefenseBenchmark28Proactive Defense Benchmark against Deepfake GenerationJoonhyuk Baek, Wonjune Seo, Jae-yun Kim, Saerom Park, and Hoki KimIn Forty-third International Conference on Machine Learning, 2026Despite the proliferation of proactive defenses against deepfakes, the lack of a unified evaluation protocol precludes fair comparison and masks critical vulnerabilities. To bridge this gap, we present the first comprehensive benchmark that systematically assesses disruption, robustness, and transferability across pixel, perceptual, identity, and visual-quality axes. We introduce the Calibrated Identity Disruption Ratio (CIDR), which corrects for the identity drift induced by the generator itself, along with a post-processing robustness metric (ROB) and a transferability metric (TE) for unseen generators. Experiments on six generators and seven defense techniques reveal that robustness and disruption form an inherent trade-off and that single-generator evaluation overestimates generalization.
@inproceedings{baek2026proactive, title = {Proactive Defense Benchmark against Deepfake Generation}, author = {Baek, Joonhyuk and Seo, Wonjune and Kim, Jae-yun and Park, Saerom and Kim, Hoki}, year = {2026}, booktitle = {Forty-third International Conference on Machine Learning}, } - SCIE Top 10%UnlearningBearingRetain-free27Adversarial Retain-Free Unlearning for Bearing Prognostics and Health ManagementChaewon Yoon, Jiyoung Lee, and Hoki KimIEEE Transactions on Industrial Informatics, 2026Prognostics and health management (PHM) systems increasingly rely on machine learning for reliable bearing fault diagnosis. However, data deletion in PHM remains an open problem. Since retraining a model from scratch is often infeasible, this raises a new challenge. Moreover, in most cases, only the pretrained model and the user-requested data are available. Existing approaches under this constraint often fail to achieve proper unlearning and substantially degrade model performance, thereby disrupting the original embedding space and collapsing the structural integrity of the pretrained model. To address this, we propose adversarial retain-free unlearning (ARU). Our framework integrates adversarial samples generated from the pretrained model with a semantic-driven loss to preserve representational stability. Experiments on public and private bearing datasets demonstrate that ARU achieves unlearning efficacy and structural consistency comparable to Retrain while maintaining diagnostic accuracy. We believe that our proposed framework provides a practical and reliable solution for retain-free unlearning in real-world industrial PHM systems.
@article{yoon2026adversarial, title = {Adversarial Retain-Free Unlearning for Bearing Prognostics and Health Management}, author = {Yoon, Chaewon and Lee, Jiyoung and Kim, Hoki}, year = {2026}, journal = {IEEE Transactions on Industrial Informatics}, publisher = {Institute of Electrical and Electronics Engineers (IEEE)}, volume = {22}, number = {6}, pages = {5231–5241}, doi = {10.1109/tii.2026.3664210}, } - SCIE Top 40%SAMFlatnessLoss Landscape26Exploring the Effect of Multi-Step Ascent in Sharpness-Aware MinimizationHoki Kim, Jinseong Park, Woojin Lee, Jaewook Lee, and Yujin ChoiIEEE Access, 2026Recently, Sharpness-Aware Minimization (SAM) has shown state-of-the-art performance by seeking flat minima. To minimize the maximum loss within a neighborhood in the parameter space, SAM uses an ascent step, which perturbs the weights along the direction of gradient ascent with a given radius. While single-step or multi-step can be taken during ascent steps, previous studies have shown that multi-step ascent SAM rarely improves generalization performance. However, this phenomenon is particularly interesting because the multi-step ascent is expected to provide a better approximation of the maximum neighborhood loss. Therefore, in this paper, we analyze the effect of the number of ascent steps and investigate the difference between both single-step ascent SAM and multi-step ascent SAM. We identify the effect of the number of ascents on SAM optimization and reveal that single-step ascent SAM and multi-step ascent SAM exhibit distinct loss landscapes. Based on these observations, we finally suggest a simple modification that can mitigate the suboptimal generalization of multi-step ascent SAM.
@article{kim2026exploring, title = {Exploring the Effect of Multi-Step Ascent in Sharpness-Aware Minimization}, author = {Kim, Hoki and Park, Jinseong and Lee, Woojin and Lee, Jaewook and Choi, Yujin}, year = {2026}, journal = {IEEE Access}, publisher = {Institute of Electrical and Electronics Engineers (IEEE)}, volume = {14}, pages = {82166–82179}, doi = {10.1109/access.2026.3695934}, } - SCIE Top 30%Adversarial AttackBatteryTransferability25Generating imperceptible adversarial examples via low-frequency aware transfer attacks on battery management systemsKyeongseo Min, Yeseo Joo, Jiho Hong, Hoki Kim, Sangho Lee, and 1 more authorScientific Reports, 2026Despite the success of deep learning models for the state-of-health estimation of lithium-ion batteries in battery management systems, their susceptibility to adversarial attacks raises concerns about security risks, leading to misdiagnosis and unnecessary maintenance. However, their practical robustness against adversarial perturbations remains largely underexplored, despite its importance for real-world deployment. Thus, we develop a novel adversarial attack to unveil practical risks associated with battery management systems. Our approach assesses model robustness in practical scenarios where model information is inaccessible by selectively exploiting frequency information that benefits the capture of unique characteristics for the state of health. In particular, we generate a malicious but imperceptible example by manipulating low-frequency components of a signal while preserving their relationships. Through a series of experiments, we demonstrate the effectiveness of our approach in uncovering and understanding potential risks associated with deep learning models in battery management systems.
@article{min2026generating, title = {Generating imperceptible adversarial examples via low-frequency aware transfer attacks on battery management systems}, author = {Min, Kyeongseo and Joo, Yeseo and Hong, Jiho and Kim, Hoki and Lee, Sangho and Son, Youngdoo}, year = {2026}, journal = {Scientific Reports}, publisher = {Springer Science and Business Media LLC}, volume = {16}, number = {1}, doi = {10.1038/s41598-026-49020-1}, } - SSCI Top 1%Metal PriceForecastingDecomposition24Pattern-guided forecasting framework for metal price prediction with grouping decomposed seriesDongbin Kim, Jaewook Lee, and Hoki KimFinancial Innovation, 2026Accurate forecasting of precious metal prices is increasingly critical in modern financial markets, as these metals function as industrial commodities and as strategic financial instruments for portfolio diversification and risk management. Although recent advances in financial technology have produced a range of forecasting approaches from traditional econometric methods to sophisticated deep learning models—the complex dynamics of metal prices continue to challenge existing methodologies. This paper introduces a significant innovation in financial forecasting by revealing and leveraging previously unrecognized pattern relationships in decomposed time series data. Our comprehensive analysis of metal price dynamics reveals distinct grouped patterns in decomposed time series components, challenging the conventional assumption of independence in current forecasting methods. Based on these insights, we propose the pattern-guided forecasting framework (PGFF), which enhances forecasting accuracy by leveraging cross-dimensional pattern relationships in decomposed time series. Our framework employs a novel two-stage approach: first, categorizing decomposed time series based on their temporal characteristics and autocorrelation patterns; then, implementing cross-dimensional forecasting to capture complex market dynamics. Empirical analysis of four major precious metals demonstrates that PGFF consistently outperforms existing forecasting frameworks, offering significant implications for investment decision-making and portfolio management in modern financial markets.
@article{kim2026pattern, title = {Pattern-guided forecasting framework for metal price prediction with grouping decomposed series}, author = {Kim, Dongbin and Lee, Jaewook and Kim, Hoki}, year = {2026}, journal = {Financial Innovation}, publisher = {Springer Science and Business Media LLC}, volume = {12}, number = {1}, doi = {10.1186/s40854-025-00833-5}, } - ICLR 2026UnlearningDiffusion ModelConcept Erasure23Co-occurring Associated REtained concepts in Diffusion UnlearningMiso Kim, Georu Lee, Yunji Kim, Hoki Kim, Jinseong Park, and 1 more authorIn The Fourteenth International Conference on Learning Representations, 2026Unlearning has emerged as a key technique to mitigate harmful content generation in diffusion models. However, existing methods often remove not only the target concept, but also benign co-occurring concepts. Unlearning nudity can unintentionally suppress the concept of person, preventing a model from generating images with person. We define these undesirably suppressed co-occurring concepts that must be preserved co-occurring associated retained concepts). Then, we introduce the CARE score, a general metric that directly quantifies their preservation across unlearning tasks. With this foundation, we propose RECARE(robust erasure for care), a framework that explicitly safeguards CARE while erasing only the target concept. ReCARE automatically constructs the CARE-set, a curated vocabulary of benign co-occurring tokens extracted from target images, and leverages this vocabulary during training for stable unlearning. Extensive experiments across various target concepts demonstrate that ReCARE achieves overall state-of-the-art performance in balancing robust concept erasure, overall utility, and CARE preservation.
@inproceedings{kim2026cooccurring, title = {Co-occurring Associated REtained concepts in Diffusion Unlearning}, author = {Kim, Miso and Lee, Georu and Kim, Yunji and Kim, Hoki and Park, Jinseong and Lee, Woojin}, year = {2026}, booktitle = {The Fourteenth International Conference on Learning Representations}, } - NeurIPS 2025UnlearningSAMOptimization22Unlearning-Aware MinimizationHoki Kim, Keonwoo Kim, Sungwon Chae, and Sangwon YoonIn Thirty-ninth Conference on Neural Information Processing Systems, 2025Machine unlearning aims to remove the influence of specific training samples (i.e., forget data) from a trained model while preserving its performance on the remaining samples (i.e., retain data). Existing approximate unlearning approaches, such as fine-tuning or negative gradient, often suffer from either insufficient forgetting or significant degradation on retain data. In this paper, we introduce Unlearning-Aware Minimization (UAM), a novel min–max optimization framework for machine unlearning. UAM perturbs model parameters to maximize the forget loss and then leverages the corresponding gradients to minimize the retain loss. We derive an efficient optimization method for this min-max problem, which enables effective removal of forget data and uncovers better optima that conventional methods fail to reach. Extensive experiments demonstrate that UAM outperforms existing methods across diverse benchmarks, including image classification datasets (CIFAR-10, CIFAR-100, TinyImageNet) and multiple-choice question-answering benchmarks for large language models (WMDP-Bio, WMDP-Cyber).
@inproceedings{kim2025unlearning, title = {Unlearning-Aware Minimization}, author = {Kim, Hoki and Kim, Keonwoo and Chae, Sungwon and Yoon, Sangwon}, year = {2025}, booktitle = {Thirty-ninth Conference on Neural Information Processing Systems}, } - SCIE Top 20%Adversarial AttackTime SeriesImperceptibility21Towards undetectable adversarial attack on time series classificationHoki Kim, Yunyoung Lee, Woojin Lee, and Jaewook LeeInformation Sciences, 2025Although deep learning models have shown superior performance for time series classification, prior studies have recently discovered that small perturbations can fool various time series models. This vulnerability poses a serious threat that can cause malfunctions in real-world systems, such as Internet-of-Things (IoT) devices and industrial control systems. To defend these systems against adversarial time series, recent studies have proposed a detection method using time series characteristics. In this paper, however, we reveal that this detection-based defense can be easily circumvented. Through an extensive investigation into existing adversarial attacks and generated adversarial time series examples, we discover that they tend to ignore the trends in local areas and add excessive noise to the original examples. Based on the analyses, we propose a new adaptive attack, called trend-adaptive interval attack (TIA), that generates a hardly detectable adversarial time series by adopting trend-adaptive loss and gradient-based interval selection. Our experiments demonstrate that the proposed method successfully maintains the important features of the original time series and deceives diverse time series models without being detected.
@article{kim2025towards, title = {Towards undetectable adversarial attack on time series classification}, author = {Kim, Hoki and Lee, Yunyoung and Lee, Woojin and Lee, Jaewook}, year = {2025}, journal = {Information Sciences}, publisher = {Elsevier BV}, volume = {715}, pages = {122216}, doi = {10.1016/j.ins.2025.122216}, } - CVPR 2025 WorkshopGolf SwingDatasetPose20CaddieSet: A Golf Swing Dataset with Human Joint Features and Ball InformationSeunghyeon Jung, Seoyoung Hong, Jiwoo Jeong, Seungwon Jeong, Jaerim Choi, and 2 more authorsIn Proceedings of the CVPR 2025 Workshop on Computer Vision in Sports (CVSports), 2025Recent advancements in deep learning have led to a rise in studies aimed at helping golfers improve their shot precision. However, current research has not quantitatively determined a relationship between swing posture and ball trajectory, limiting their effectiveness in offering golfers precise recommendations for correcting swing issues. In this paper, we propose a new dataset called CaddieSet, which contains joint information and various ball information from a single shot. CaddieSet extracts joint information from a single swing video divided into eight swing phases and includes information on various balls for a single shot. Based on expert golf domain knowledge, we define swing-related features using a computer vision-based approach. 15 metrics are defined that affect a golf swing and make it possible to interpret the results of the swing from the joint information. The dataset includes these features extracted from eight golfers, along with ball information as the result of each swing. In the experiments, we demonstrated the feasibility of CaddieSet for predicting ball trajectories using various benchmarks. In particular, we focus on interpretable models among several benchmarks and verify that swing feedback using our joint features is quantitatively consistent with existing domain knowledge. It is expected that this will provide a new perspective on golf swing analysis to both the academic and sports worlds.
@inproceedings{jung2025caddieset, title = {CaddieSet: A Golf Swing Dataset with Human Joint Features and Ball Information}, author = {Jung, Seunghyeon and Hong, Seoyoung and Jeong, Jiwoo and Jeong, Seungwon and Choi, Jaerim and Kim, Hoki and Lee, Woojin}, year = {2025}, booktitle = {Proceedings of the CVPR 2025 Workshop on Computer Vision in Sports (CVSports)}, address = {Seattle, WA, USA}, organization = {IEEE}, } - SCIE Top 40%Meme StockSocial MediaInvestor Sentiment19A Statistical Analysis of the Relationship Between Meme Stocks and Social MediaSeungju Lee, Yunyoung Lee, Jaewook Lee, and Hoki KimIEEE Access, 2025Meme stocks, driven by viral social media trends, have added new complexities to financial markets. Prior studies have explored meme stock price dynamics and investor sentiment, but the interplay between social media activity and market movements, along with the structural and linguistic features of online discussions, remains understudied. To address this, we integrate econometric and NLP-based techniques, combining correlation analysis, Granger causality testing, BSADF-based bubble detection, and textual analysis. Our results reveal a strong correlation between trading volume and social media engagement, with Granger causality confirming a feedback loop between market fluctuations and online discussions. BSADF analysis demonstrates that social media-based detection complements price-based methods by identifying explosive periods they may miss. Additionally, network analysis indicates that meme stock discussions exhibit distinct structural patterns, while linguistic analysis highlights unique word choices and emoji usage. Sentiment analysis shows that bullish sentiment dominates during speculative surges, reinforcing the emotionally driven nature of meme stock trading. These findings provide investors with a complementary tool for risk assessment by integrating sentiment with traditional market indicators, while helping regulators monitor online sentiment to identify early signs of speculative excess and market instability.
@article{lee2025statistical, title = {A Statistical Analysis of the Relationship Between Meme Stocks and Social Media}, author = {Lee, Seungju and Lee, Yunyoung and Lee, Jaewook and Kim, Hoki}, year = {2025}, journal = {IEEE Access}, publisher = {Institute of Electrical and Electronics Engineers (IEEE)}, volume = {13}, pages = {63143–63156}, doi = {10.1109/access.2025.3557460}, } - SCIE Top 30%Homomorphic EncryptionFault DiagnosisIoT18Homomorphic encryption-based fault diagnosis in IoT-enabled industrial systemsHoki Kim, Youngdoo Son, and Junyoung ByunInternational Journal of Information Security, 2025In IoT-enabled industrial environments, ensuring the privacy and security of operational data is paramount for fault diagnosis systems. This study presents a novel framework that seamlessly integrates homomorphic encryption (HE) with deep learning to achieve secure and efficient fault diagnosis for industrial bearings. By performing computations directly on encrypted sensor data, the framework guarantees full data confidentiality throughout the diagnostic process without requiring decryption. Key technical contributions of this work include the development of a minimax polynomial approximation for ReLU activations, which enhances diagnostic accuracy while preserving efficiency, and the design of an efficient 1D convolution method that combines two existing HE convolution techniques for optimal performance. Additionally, the framework incorporates frequency-domain optimizations using the Discrete Fourier Transform (DFT), which significantly enhance processing efficiency. The proposed model was trained on the CWRU bearing dataset and validated on a private dataset, achieving a diagnostic accuracy of 95.92%, comparable to state-of-the-art models operating on plaintext data. Furthermore, the DFT-based optimizations reduced inference time by nearly threefold while maintaining superior accuracy, underscoring the framework’s potential to provide secure and efficient fault diagnosis for industrial applications.
@article{kim2025homomorphic, title = {Homomorphic encryption-based fault diagnosis in IoT-enabled industrial systems}, author = {Kim, Hoki and Son, Youngdoo and Byun, Junyoung}, year = {2025}, journal = {International Journal of Information Security}, publisher = {Springer Science and Business Media LLC}, volume = {24}, number = {3}, doi = {10.1007/s10207-025-01005-3}, } - SCIE Top 20%Black-box AttackFault DiagnosisFrequency17Black-box adversarial examples via frequency distortion against fault diagnosis systemsSangho Lee, Hoki Kim, Woojin Lee, and Youngdoo SonApplied Soft Computing, 2025Deep learning has significantly impacted prognostic and health management, but its susceptibility to adversarial attacks raises security risks for fault diagnosis systems. Previous research on the adversarial robustness of these systems is limited by unrealistic assumptions about prior model knowledge, which is often unobtainable in the real world, and by a lack of integration of domain-specific knowledge, particularly frequency information crucial for identifying unique characteristics for machinery states. To address these limitations and enhance robustness assessments, we propose a novel adversarial attack method that exploits frequency distortion. Our approach corrupts both frequency components and waveforms of vibration signals from rotating machinery, enabling a more thorough evaluation of system vulnerability without requiring access to model information. Through extensive experiments on two bearing datasets, including a self-collected dataset, we demonstrate the effectiveness of the proposed method in generating malicious yet imperceptible examples that remarkably degrade model performance, even without access to model information. In realistic attack scenarios for fault diagnosis systems, our approach produces adversarial examples that mimic unique frequency components associated with the deceived machinery states, leading to average performance drops of approximately 13 and 19 percentage points higher than existing methods on the two datasets, respectively. These results reveal potential risks for deep learning models embedded in fault diagnosis systems, highlighting the need for enhanced robustness against adversarial attacks.
@article{lee2025black, title = {Black-box adversarial examples via frequency distortion against fault diagnosis systems}, author = {Lee, Sangho and Kim, Hoki and Lee, Woojin and Son, Youngdoo}, year = {2025}, journal = {Applied Soft Computing}, publisher = {Elsevier BV}, volume = {171}, pages = {112828}, doi = {10.1016/j.asoc.2025.112828}, } - SSCI Top 70%Bank FailureExplainabilityNAM16Explaining determinants of bank failure prediction via neural additive modelBumho Son, Jaewook Lee, and Hoki KimApplied Economics Letters, 2025This study aims to explain the determinants of bank failures by evaluating existing prediction models. We reveal that existing machine learning models often result in inconsistent explanations within the financial domain, leading to flawed conclusions and suboptimal decision-making. Therefore, we propose the use of a neural additive model that combines the transparency of a general additive model with the high performance of a neural network. Our findings show that this approach enhances the interpretation of explanatory variables in bank failure predictions, offering valuable insights for improving financial risk assessment.
@article{son2026explaining, title = {Explaining determinants of bank failure prediction via neural additive model}, author = {Son, Bumho and Lee, Jaewook and Kim, Hoki}, year = {2025}, journal = {Applied Economics Letters}, publisher = {Informa UK Limited}, volume = {33}, number = {11}, pages = {1755–1760}, doi = {10.1080/13504851.2024.2449551}, } - NeurIPS 2024Time SeriesForecastingSelf-Attention15Are Self-Attentions Effective for Time Series Forecasting?Dongbin Kim, Jinseong Park, Jaewook Lee, and Hoki KimIn Thirty-eighth Conference on Neural Information Processing Systems, 2024Time series forecasting is crucial for applications across multiple domains and various scenarios. Although Transformer models have dramatically shifted the landscape of forecasting, their effectiveness remains debated. Recent findings have indicated that simpler linear models might outperform complex Transformer-based approaches, highlighting the potential for more streamlined architectures. In this paper, we shift focus from the overall architecture of the Transformer to the effectiveness of self-attentions for time series forecasting. To this end, we introduce a new architecture, Cross-Attention-only Time Series transformer (CATS), that rethinks the traditional Transformer framework by eliminating self-attention and leveraging cross-attention mechanisms instead. By establishing future horizon-dependent parameters as queries and enhanced parameter sharing, our model not only improves long-term forecasting accuracy but also reduces the number of parameters and memory usage. Extensive experiment across various datasets demonstrates that our model achieves superior performance with the lowest mean squared error and uses fewer parameters compared to existing models.
@inproceedings{kim2024self, title = {Are Self-Attentions Effective for Time Series Forecasting?}, author = {Kim, Dongbin and Park, Jinseong and Lee, Jaewook and Kim, Hoki}, year = {2024}, booktitle = {Thirty-eighth Conference on Neural Information Processing Systems}, } - SCIEAdversarial TrainingWassersteinAdversarial Robustness14Sliced Wasserstein adversarial training for improving adversarial robustnessWoojin Lee, Sungyoon Lee, Hoki Kim, and Jaewook LeeJournal of Ambient Intelligence and Humanized Computing, 2024Recently, deep-learning-based models have achieved impressive performance on tasks that were previously considered to be extremely challenging. However, recent works have shown that various deep learning models are susceptible to adversarial data samples. In this paper, we propose the sliced Wasserstein adversarial training method to encourage the logit distributions of clean and adversarial data to be similar to each other. We capture the dissimilarity between two distributions using the Wasserstein metric and then align distributions using an end-to-end training process. We present the theoretical background of the motivation for our study by providing generalization error bounds for adversarial data samples. We performed experiments on three standard datasets and the results demonstrate that our method is more robust against white box attacks compared to previous methods.
@article{lee2024sliced, title = {Sliced Wasserstein adversarial training for improving adversarial robustness}, author = {Lee, Woojin and Lee, Sungyoon and Kim, Hoki and Lee, Jaewook}, year = {2024}, journal = {Journal of Ambient Intelligence and Humanized Computing}, publisher = {Springer Science and Business Media LLC}, volume = {15}, number = {8}, pages = {3229–3242}, doi = {10.1007/s12652-024-04791-1}, } - SCIE Top 5%Adversarial RobustnessFault DiagnosisEnsemble Attack13Evaluating practical adversarial robustness of fault diagnosis systems via spectrogram-aware ensemble methodHoki Kim, Sangho Lee, Jaewook Lee, Woojin Lee, and Youngdoo SonEngineering Applications of Artificial Intelligence, 2024While machine learning models have shown superior performance in fault diagnosis systems, researchers have revealed their vulnerability to subtle noises generated by adversarial attacks. Given that this vulnerability can lead to misdiagnosis or unnecessary maintenance, the assessment of the practical robustness of fault diagnosis models is crucial for their deployment and use in real-world scenarios. However, research on the practical adversarial robustness of fault diagnosis models remains limited. In this work, we present a comprehensive analysis on rotating machinery diagnostics and discover that existing attacks often over-estimate the robustness of these models in practical settings. In order to precisely estimate the practical robustness of models, we propose a novel method that unveils the hidden risks of fault diagnosis models by manipulating the spectrum of signal frequencies—an area that has been rarely explored in the domain of adversarial attacks. Our proposed attack, Spectrogram-Aware Ensemble Method (SAEM), the hidden vulnerability of fault diagnosis systems through achieving a higher attack performance in practical black-box settings. Through experiments, we reveal the potential dangers of employing non-robust fault diagnosis models in real-world applications and suggest directions for future research in industrial applications.
@article{kim2024evaluating, title = {Evaluating practical adversarial robustness of fault diagnosis systems via spectrogram-aware ensemble method}, author = {Kim, Hoki and Lee, Sangho and Lee, Jaewook and Lee, Woojin and Son, Youngdoo}, year = {2024}, journal = {Engineering Applications of Artificial Intelligence}, publisher = {Elsevier BV}, volume = {130}, pages = {107980}, doi = {10.1016/j.engappai.2024.107980}, } - AAAI 2024Diffusion ModelFairnessSampling12Fair Sampling in Diffusion Models through Switching MechanismYujin Choi, Jinseong Park, Hoki Kim, Jaewook Lee, and Saerom ParkIn Proceedings of the AAAI Conference on Artificial Intelligence, 2024Diffusion models have shown their effectiveness in generation tasks by well-approximating the underlying probability distribution. However, diffusion models are known to suffer from an amplified inherent bias from the training data in terms of fairness. While the sampling process of diffusion models can be controlled by conditional guidance, previous works have attempted to find empirical guidance to achieve quantitative fairness. To address this limitation, we propose a fairness-aware sampling method called \textitattribute switching mechanism for diffusion models. Without additional training, the proposed sampling can obfuscate sensitive attributes in generated data without relying on classifiers. We mathematically prove and experimentally demonstrate the effectiveness of the proposed method on two key aspects: (i) the generation of fair data and (ii) the preservation of the utility of the generated data.
@inproceedings{choi2024fair, title = {Fair Sampling in Diffusion Models through Switching Mechanism}, author = {Choi, Yujin and Park, Jinseong and Kim, Hoki and Lee, Jaewook and Park, Saerom}, year = {2024}, booktitle = {Proceedings of the AAAI Conference on Artificial Intelligence}, volume = {38}, number = {20}, pages = {21995--22003}, } - NeurIPS 2023Adversarial RobustnessRobust OverfittingGeneralization11Fantastic Robustness Measures: The Secrets of Robust GeneralizationHoki Kim, Jinseong Park, Yujin Choi, and Jaewook LeeIn Thirty-seventh Conference on Neural Information Processing Systems, 2023Adversarial training has become the de-facto standard method for improving the robustness of models against adversarial examples. However, robust overfitting remains a significant challenge, leading to a large gap between the robustness on the training and test datasets. To understand and improve robust generalization, various measures have been developed, including margin, smoothness, and flatness-based measures. In this study, we present a large-scale analysis of robust generalization to empirically verify whether the relationship between these measures and robust generalization remains valid in diverse settings. We demonstrate when and how these measures effectively capture the robust generalization gap by comparing over 1,300 models trained on CIFAR-10 under the norm and further validate our findings through an evaluation of more than 100 models from RobustBench across CIFAR-10, CIFAR-100, and ImageNet. We hope this work can help the community better understand adversarial robustness and motivate the development of more robust defense methods against adversarial attacks.
@inproceedings{kim2023fantastic, title = {Fantastic Robustness Measures: The Secrets of Robust Generalization}, author = {Kim, Hoki and Park, Jinseong and Choi, Yujin and Lee, Jaewook}, year = {2023}, booktitle = {Thirty-seventh Conference on Neural Information Processing Systems}, } - SCIE Top 20%Adversarial TrainingAdversarial RobustnessSmoothness10Bridged adversarial trainingHoki Kim, Woojin Lee, Sungyoon Lee, and Jaewook LeeNeural Networks, 2023Adversarial robustness is considered a required property of deep neural networks. In this study, we discover that adversarially trained models might have significantly different characteristics in terms of margin and smoothness, even though they show similar robustness. Inspired by the observation, we investigate the effect of different regularizers and discover the negative effect of the smoothness regularizer on maximizing the margin. Based on the analyses, we propose a new method called bridged adversarial training that mitigates the negative effect by bridging the gap between clean and adversarial examples. We provide theoretical and empirical evidence that the proposed method provides stable and better robustness, especially for large perturbations.
@article{kim2023bridged, title = {Bridged adversarial training}, author = {Kim, Hoki and Lee, Woojin and Lee, Sungyoon and Lee, Jaewook}, year = {2023}, journal = {Neural Networks}, publisher = {Elsevier BV}, volume = {167}, pages = {266–282}, doi = {10.1016/j.neunet.2023.08.024}, } - SCIE Top 20%SAMTime SeriesForecasting9Fast sharpness-aware training for periodic time series classification and forecastingJinseong Park, Hoki Kim, Yujin Choi, Woojin Lee, and Jaewook LeeApplied Soft Computing, 2023Various deep learning architectures have been developed to capture long-term dependencies in time series data, but challenges such as overfitting and computational time still exist. The recently proposed optimization strategy called Sharpness-Aware Minimization (SAM) optimization prevents overfitting by minimizing a perturbed loss within the nearby parameter space. However, SAM requires doubled training time to calculate two gradients per iteration, hindering its practical application in time series modeling such as real-time assessment. In this study, we demonstrate that sharpness-aware training improves generalization performance by capturing trend and seasonal components of time series data. To avoid the computational burden of SAM, we leverage the periodic characteristics of time series data and propose a new fast sharpness-aware training method called Periodic Sharpness-Aware Time series Training (PSATT) that reuses gradient information from past iterations. Empirically, the proposed method achieves both generalization and time efficiency in time series classification and forecasting without requiring additional computations compared to vanilla optimizers.
@article{park2023fast, title = {Fast sharpness-aware training for periodic time series classification and forecasting}, author = {Park, Jinseong and Kim, Hoki and Choi, Yujin and Lee, Woojin and Lee, Jaewook}, year = {2023}, journal = {Applied Soft Computing}, publisher = {Elsevier BV}, volume = {144}, pages = {110467}, doi = {10.1016/j.asoc.2023.110467}, } - ICML 2023Differential PrivacySAMFlat Minima8Differentially Private Sharpness-Aware TrainingJinseong Park, Hoki Kim, Yujin Choi, and Jaewook LeeIn International Conference on Machine Learning, 2023Training deep learning models with differential privacy (DP) results in a degradation of performance. The training dynamics of models with DP show a significant difference from standard training, whereas understanding the geometric properties of private learning remains largely unexplored. In this paper, we investigate sharpness, a key factor in achieving better generalization, in private learning. We show that flat minima can help reduce the negative effects of per-example gradient clipping and the addition of Gaussian noise. We then verify the effectiveness of Sharpness-Aware Minimization (SAM) for seeking flat minima in private learning. However, we also discover that SAM is detrimental to the privacy budget and computational time due to its two-step optimization. Thus, we propose a new sharpness-aware training method that mitigates the privacy-optimization trade-off. Our experimental results demonstrate that the proposed method improves the performance of deep learning models with DP from both scratch and fine-tuning.
@inproceedings{park2023differentially, title = {Differentially Private Sharpness-Aware Training}, author = {Park, Jinseong and Kim, Hoki and Choi, Yujin and Lee, Jaewook}, year = {2023}, booktitle = {International Conference on Machine Learning}, organization = {PMLR}, pages = {27204--27224}, } - SCIE Top 10%Adversarial AttackTransferabilitySpeech Classification7Generating Transferable Adversarial Examples for Speech ClassificationHoki Kim, Jinseong Park, and Jaewook LeePattern Recognition, 2023Despite the success of deep neural networks, the existence of adversarial attacks has revealed the vulnerability of neural networks in terms of security. Adversarial attacks add subtle noise to the original example, resulting in a false prediction. Although adversarial attacks have been mainly studied in the image domain, a recent line of research has discovered that speech classification systems are also exposed to adversarial attacks. By adding inaudible noise, an adversary can deceive speech classification systems and cause fatal issues in various applications, such as speaker identification and command recognition tasks. However, research on the transferability of audio adversarial examples is still limited. Thus, in this study, we first investigate the transferability of audio adversarial examples with different structures and conditions. Through extensive experiments, we discover that the transferability of audio adversarial examples is related to their noise sensitivity. Based on the analyses, we present a new adversarial attack called noise injected attack that generates highly transferable audio adversarial examples by injecting additive noise during the gradient ascent process. Our experimental results demonstrate that the proposed method outperforms other adversarial attacks in terms of transferability.
@article{kim2023generating, title = {Generating Transferable Adversarial Examples for Speech Classification}, author = {Kim, Hoki and Park, Jinseong and Lee, Jaewook}, year = {2023}, journal = {Pattern Recognition}, publisher = {Elsevier BV}, volume = {137}, pages = {109286}, doi = {10.1016/j.patcog.2022.109286}, } - SCIE Top 1%Adversarial RobustnessRandomized NetworksGradient Diversity6GradDiv: Adversarial Robustness of Randomized Neural Networks via Gradient Diversity RegularizationSungyoon Lee, Hoki Kim, and Jaewook LeeIEEE Transactions on Pattern Analysis and Machine Intelligence, 2023Deep learning is vulnerable to adversarial examples. Many defenses based on randomized neural networks have been proposed to solve the problem, but fail to achieve robustness against attacks using proxy gradients such as the Expectation over Transformation (EOT) attack. We investigate the effect of the adversarial attacks using proxy gradients on randomized neural networks and demonstrate that it highly relies on the directional distribution of the loss gradients of the randomized neural network. We show in particular that proxy gradients are less effective when the gradients are more scattered. To this end, we propose Gradient Diversity (GradDiv) regularizations that minimize the concentration of the gradients to build a robust randomized neural network. Our experiments on MNIST, CIFAR10, and STL10 show that our proposed GradDiv regularizations improve the adversarial robustness of randomized neural networks against a variety of state-of-the-art attack methods. Moreover, our method efficiently reduces the transferability among sample models of randomized neural networks.
@article{lee2023graddiv, title = {GradDiv: Adversarial Robustness of Randomized Neural Networks via Gradient Diversity Regularization}, author = {Lee, Sungyoon and Kim, Hoki and Lee, Jaewook}, year = {2023}, journal = {IEEE Transactions on Pattern Analysis and Machine Intelligence}, publisher = {Institute of Electrical and Electronics Engineers (IEEE)}, volume = {45}, number = {2}, pages = {2645–2651}, doi = {10.1109/tpami.2022.3169217}, } - SCIE Top 40%Adversarial DetectionSpeech ClassificationFeature Extraction5Exploring Diverse Feature Extractions for Adversarial Audio DetectionYujin Choi, Jinseong Park, Jaewook Lee, and Hoki KimIEEE Access, 2023Although deep learning models have exhibited excellent performance in various domains, recent studies have discovered that they are highly vulnerable to adversarial attacks. In the audio domain, malicious audio examples generated by adversarial attacks can cause significant performance degradation and system malfunctions, resulting in security and safety concerns. However, compared to recent developments in the audio domain, the properties of the adversarial audio examples and defenses against them still remain largely unexplored. In this study, to provide a deeper understanding of the adversarial robustness in the audio domain, we first investigate traditional and recent feature extractions in terms of adversarial attacks. We show that adversarial audio examples generated from different feature extractions exhibit different noise patterns, and thus can be distinguished by a simple classifier. Based on the observation, we extend existing adversarial detection methods by proposing a new detection method that detects adversarial audio examples using an ensemble of diverse feature extractions. By combining the frequency and self-supervised feature representations, the proposed method provides a high detection rate against both white-box and black-box adversarial attacks. Our empirical results demonstrate the effectiveness of the proposed method in speech command classification and speaker recognition.
@article{choi2023exploring, title = {Exploring Diverse Feature Extractions for Adversarial Audio Detection}, author = {Choi, Yujin and Park, Jinseong and Lee, Jaewook and Kim, Hoki}, year = {2023}, journal = {IEEE Access}, publisher = {Institute of Electrical and Electronics Engineers (IEEE)}, volume = {11}, pages = {2351–2360}, doi = {10.1109/access.2023.3234110}, } - SCIE Top 10%ImputationMissing DataGAN4Variational cycle-consistent imputation adversarial networks for general missing patternsWoojin Lee, Sungyoon Lee, Junyoung Byun, Hoki Kim, and Jaewook LeePattern Recognition, 2022Imputation of missing data is an important but challenging issue because we do not know the underlying distribution of the missing data. Previous imputation models have addressed this problem by assuming specific kinds of missing distributions. However, in practice, the mechanism of the missing data is unknown, so the most general case of missing pattern needs to be considered for successful imputation. In this paper, we present cycle-consistent imputation adversarial networks to discover the underlying distribution of missing patterns closely under some relaxations. Using adversarial training, our model successfully learns the most general case of missing patterns. Therefore our method can be applied to a wide variety of imputation problems. We empirically evaluated the proposed method with numerical and image data. The result shows that our method yields the state-of-the-art performance quantitatively and qualitatively on standard datasets.
@article{lee2022variational, title = {Variational cycle-consistent imputation adversarial networks for general missing patterns}, author = {Lee, Woojin and Lee, Sungyoon and Byun, Junyoung and Kim, Hoki and Lee, Jaewook}, year = {2022}, journal = {Pattern Recognition}, publisher = {Elsevier BV}, volume = {129}, pages = {108720}, doi = {10.1016/j.patcog.2022.108720}, } - SCIE Top 10%Domain AdaptationDomain InvarianceClass-conditional3Compact class-conditional domain invariant learning for multi-class domain adaptationWoojin Lee, Hoki Kim, and Jaewook LeePattern Recognition, 2021Neural network-based models have recently shown excellent performance in various kinds of tasks. However, a large amount of labeled data is required to train deep networks, and the cost of gathering labeled training data for every kind of domain is prohibitively expensive. Domain adaptation tries to solve this problem by transferring knowledge from labeled source domain data to unlabeled target domain data. Previous research tried to learn domain-invariant features of source and target domains to address this problem, and this approach has been used as a key concept in various methods. However, domain-invariant features do not mean that a classifier trained on source data can be directly applied to target data because it does not guarantee that data distribution of the same classes will be aligned across two domains. In this paper, we present novel generalization upper bounds for domain adaptation that motivates the need for class-conditional domain invariant learning. Based on this theoretical framework, we then propose a class-conditional domain invariant learning method that can learn a feature space in which features in the same class are expected to be mapped nearby. We empirically experimented that our model showed state-of-the-art performance on standard datasets and showed effectiveness by visualization of latent space.
@article{lee2021compact, title = {Compact class-conditional domain invariant learning for multi-class domain adaptation}, author = {Lee, Woojin and Kim, Hoki and Lee, Jaewook}, year = {2021}, journal = {Pattern Recognition}, publisher = {Elsevier BV}, volume = {112}, pages = {107763}, doi = {10.1016/j.patcog.2020.107763}, } - AAAI 2021Adversarial TrainingCatastrophic OverfittingSingle-step Attack2Understanding Catastrophic Overfitting in Single-step Adversarial TrainingHoki Kim, Woojin Lee, and Jaewook LeeProceedings of the AAAI Conference on Artificial Intelligence, 2021Although fast adversarial training has demonstrated both robustness and efficiency, the problem of "catastrophic overfitting" has been observed. This is a phenomenon in which, during single-step adversarial training, the robust accuracy against projected gradient descent (PGD) suddenly decreases to 0% after a few epochs, whereas the robust accuracy against fast gradient sign method (FGSM) increases to 100%. In this paper, we demonstrate that catastrophic overfitting is very closely related to the characteristic of single-step adversarial training which uses only adversarial examples with the maximum perturbation, and not all adversarial examples in the adversarial direction, which leads to decision boundary distortion and a highly curved loss surface. Based on this observation, we propose a simple method that not only prevents catastrophic overfitting, but also overrides the belief that it is difficult to prevent multi-step adversarial attacks with single-step adversarial training.
@article{kim2021understanding, title = {Understanding Catastrophic Overfitting in Single-step Adversarial Training}, author = {Kim, Hoki and Lee, Woojin and Lee, Jaewook}, year = {2021}, journal = {Proceedings of the AAAI Conference on Artificial Intelligence}, publisher = {Association for the Advancement of Artificial Intelligence (AAAI)}, volume = {35}, number = {9}, pages = {8119–8127}, doi = {10.1609/aaai.v35i9.16989}, } - arXiv 2020Adversarial AttackPyTorchLibrary1Torchattacks: A PyTorch Repository for Adversarial AttacksHoki KimarXiv preprint arXiv:2010.01950, 2020Torchattacks is a PyTorch library that contains adversarial attacks to generate adversarial examples and to verify the robustness of deep learning models.
@article{kim2020torchattacks, title = {Torchattacks: A PyTorch Repository for Adversarial Attacks}, author = {Kim, Hoki}, year = {2020}, journal = {arXiv preprint arXiv:2010.01950}, doi = {10.48550/arXiv.2010.01950}, }