Quantifying Timing Leaks and Cost Optimisation

Distributed learning optimisation of Cox models can leak patient data: Risks and solutions

Medical data are often highly sensitive, and frequently there are missing data. Due to the data's sensitive nature, there is an interest in creating modelling methods where the data are kept in each local centre to preserve their privacy, but yet the model can be trained on and learn from data across multiple centres. Such an approach might be distributed machine learning (federated learning, collaborative learning) in which a model is iteratively calculated based on aggregated local model information from each centre. However, even though no specific data are leaving the centre, there is a po…

Bicycle Attacks Considered Harmful: Quantifying the Damage of Widespread Password Length Leakage

We examine the issue of password length leakage via encrypted traffic i.e., bicycle attacks. We aim to quantify both the prevalence of password length leakage bugs as well as the potential harm to users. In an observational study, we find that {\em most} of the Alexa top 100 rates sites are vulnerable to bicycle attacks meaning that an eavesdropping attacker can infer the exact length of a password based on the length the encrypted packet containing the password. We discuss several ways in which an eavesdropping attacker could link this password length with a particular user account e.g., a ta…

Modelling and Quantifying Membership Information Leakage in Machine Learning

Machine learning models have been shown to be vulnerable to membership inference attacks, i.e., inferring whether individuals' data have been used for training models. The lack of understanding about factors contributing success of these attacks motivates the need for modelling membership information leakage using information theory and for investigating properties of machine learning models and training algorithms that can reduce membership information leakage. We use conditional mutual information leakage to measure the amount of information leakage from the trained machine learning model ab…

Quantifying Privacy Leakage in Graph Embedding

Graph embeddings have been proposed to map graph data to low dimensional space for downstream processing (e.g., node classification or link prediction). With the increasing collection of personal data, graph embeddings can be trained on private and sensitive data. For the first time, we quantify the privacy leakage in graph embeddings through three inference attacks targeting Graph Neural Networks. We propose a membership inference attack to infer whether a graph node corresponding to individual user's data was member of the model's training or not. We consider a blackbox setting where the adv…

Quantifying (Hyper) Parameter Leakage in Machine Learning

Machine Learning models, extensively used for various multimedia applications, are offered to users as a blackbox service on the Cloud on a pay-per-query basis. Such blackbox models are commercially valuable to adversaries, making them vulnerable to extraction attacks to reverse engineer the proprietary model thereby violating the model privacy and Intellectual Property. Here, the adversary first extracts the model architecture or hyperparameters through side channel leakage, followed by stealing the functionality of the target model by training the reconstructed architecture on a synthetic da…

Quantifying the Privacy Risks of Learning High-Dimensional Graphical Models

Models leak information about their training data. This enables attackers to infer sensitive information about their training sets, notably determine if a data sample was part of the model's training set. The existing works empirically show the possibility of these membership inference (tracing) attacks against complex deep learning models. However, the attack results are dependent on the specific training data, can be obtained only after the tedious process of training the model and performing the attack, and are missing any measure of the confidence and unused potential power of the attack. …

某些目标比其他目标更难识别：量化依赖于目标的成员泄露

Some Targets Are Harder to Identify than Others: Quantifying the Target-dependent Membership Leakage

本文通过Mahalanobis距离刻画固定目标成员推理博弈中最优攻击的效能，解释了目标依赖的攻击难度，并提出改进的协方差攻击及联邦学习隐私审计策略。

量化DRAM安全性的内存单元脆弱性

Quantifying Memory Cells Vulnerability for DRAM Security

本文提出一个量化内存单元电路框架，用于直接建模DRAM的物理电荷泄漏和干扰路径，评估其在挥发性、完整性及保密性方面的安全特性。

On the Compositionality of Dynamic Leakage and Its Application to the Quantification Problem

Quantitative information flow (QIF) is traditionally defined as the expected value of information leakage over all feasible program runs and it fails to identify vulnerable programs where only limited number of runs leak large amount of information. As discussed in Bielova (2016), a good notion for dynamic leakage and an efficient way of computing the leakage are needed. To address this problem, the authors have already proposed two notions for dynamic leakage and a method of quantifying dynamic leakage based on model counting. Inspired by the work of Kawamoto et. al. (2017), this paper propos…

Quantifying Privacy Risks of Masked Language Models Using Membership Inference Attacks

The wide adoption and application of Masked language models~(MLMs) on sensitive data (from legal to medical) necessitates a thorough quantitative investigation into their privacy vulnerabilities -- to what extent do MLMs leak information about their training data? Prior attempts at measuring leakage of MLMs via membership inference attacks have been inconclusive, implying the potential robustness of MLMs to privacy attacks. In this work, we posit that prior attempts were inconclusive because they based their attack solely on the MLM's model score. We devise a stronger membership inference atta…

Discovering, quantifying, and displaying attacks

In the design of software and cyber-physical systems, security is often perceived as a qualitative need, but can only be attained quantitatively. Especially when distributed components are involved, it is hard to predict and confront all possible attacks. A main challenge in the development of complex systems is therefore to discover attacks, quantify them to comprehend their likelihood, and communicate them to non-experts for facilitating the decision process. To address this three-sided challenge we propose a protection analysis over the Quality Calculus that (i) computes all the sets of dat…

NIFuzz：使用模糊测试器估计量化信息流

NIFuzz: Estimating Quantified Information Flow with a Fuzzer

本文提出NIFuzz，一种基于模糊测试的实用方法，用于量化软件信息泄漏，通过三种度量（含条件互信息）评估安全性，并在14个程序（含8个CVE）上验证了其有效性。

对LLM系统中安全控制的回报进行量化

Quantifying Return on Security Controls in LLM Systems

本文提出了一种量化LLM系统安全控制回报的方法，通过模拟攻击和风险评估，比较了ABAC、NER删除和NeMo Guardrails三种安全措施的效果，发现ABAC显著降低风险，RoC达到9.83。

QTFlow：面向RTL安全感知硬件设计的定量时序敏感信息流分析

QTFlow: Quantitative Timing-Sensitive Information Flow for Security-Aware Hardware Design on RTL

QTFlow提出一种时序敏感的信息流分析框架，用于在硬件设计阶段量化泄露并消除误报，有效识别时序通道。

GraphTheft：量化图提示学习中的隐私风险

GraphTheft: Quantifying Privacy Risks in Graph Prompt Learning

本文首次系统评估图提示学习（GPL）在三种攻击者能力下的隐私泄露风险，通过属性推断和链接推断攻击揭示其脆弱性，并探索拉普拉斯噪声扰动等防御机制，为图学习隐私保护提供新方向。

Methodologies for Quantifying (Re-)randomization Security and Timing under JIT-ROP

Just-in-time return-oriented programming (JIT-ROP) allows one to dynamically discover instruction pages and launch code reuse attacks, effectively bypassing most fine-grained address space layout randomization (ASLR) protection. However, in-depth questions regarding the impact of code (re-)randomization on code reuse attacks have not been studied. For example, how would one compute the re-randomization interval effectively by considering the speed of gadget convergence to defeat JIT-ROP attacks?; how do starting pointers in JIT-ROP impact gadget availability and gadget convergence time?; what …

视觉提示学习中提示的隐私风险量化

Quantifying Privacy Risks of Prompts in Visual Prompt Learning

本文首次全面评估视觉提示学习中提示的隐私风险，通过属性推断和成员推断攻击证明其易受攻击，并提出可缓解成员推断攻击但无法防御属性推断攻击的初步防御方法。

Electromagnetic Side-Channel Attack Resilience against PRESENT Lightweight Block Cipher

Lightweight cryptography is a novel diversion from conventional cryptography that targets internet-of-things (IoT) platform due to resource constraints. In comparison, it offers smaller cryptographic primitives such as shorter key sizes, block sizes and lesser energy drainage. The main focus can be seen in algorithm developments in this emerging subject. Thus, verification is carried out based upon theoretical (mathematical) proofs mostly. Among the few available side-channel analysis studies found in literature, the highest percentage is taken by power attacks. PRESENT is a promising lightwei…

Membership Inference Attacks Against Recommender Systems

Recently, recommender systems have achieved promising performances and become one of the most widely used web applications. However, recommender systems are often trained on highly sensitive user data, thus potential data leakage from recommender systems may lead to severe privacy problems. In this paper, we make the first attempt on quantifying the privacy leakage of recommender systems through the lens of membership inference. In contrast with traditional membership inference against machine learning classifiers, our attack faces two main differences. First, our attack is on the user-level b…

Enhancing Privacy against Inversion Attacks in Federated Learning by using Mixing Gradients Strategies

Federated learning reduces the risk of information leakage, but remains vulnerable to attacks. We investigate how several neural network design decisions can defend against gradients inversion attacks. We show that overlapping gradients provides numerical resistance to gradient inversion on the highly vulnerable dense layer. Specifically, we propose to leverage batching to maximise mixing of gradients by choosing an appropriate loss function and drawing identical labels. We show that otherwise it is possible to directly recover all vectors in a mini-batch without any numerical optimisation due…

PriPrune：量化并保护剪枝联邦学习中的隐私

PriPrune: Quantifying and Preserving Privacy in Pruned Federated Learning

本文首次量化联邦学习剪枝的隐私泄露，提出隐私感知剪枝算法PriPrune，通过个性化防御掩码和自适应剪枝率，显著提升隐私-准确性权衡。