Machine Learning for CybersecuritySource on GitHub

Contents

All references

Dr. Ali Al Bataineh, Higher Colleges of Technology, United Arab Emirates

Every work cited anywhere in the course, 228 in all. Each lesson also lists the works it cites at its end.

  1. Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., and Zhang, L. (2016). Deep learning with differential privacy. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS), 308-318. https://doi.org/10.1145/2976749.2978318
  2. Adi, Y., Baum, C., Cisse, M., Pinkas, B., and Keshet, J. (2018). Turning your weakness into a strength: Watermarking deep neural networks by backdooring. Proceedings of the 27th USENIX Security Symposium, 1615-1631. https://www.usenix.org/conference/usenixsecurity18/presentation/adi
  3. Amodei, D., Olah, C., Steinhardt, J., Christiano, P., Schulman, J., and Mané, D. (2016). Concrete problems in AI safety. arXiv. arXiv preprint arXiv:1606.06565. https://arxiv.org/abs/1606.06565
  4. An, B., Ding, M., Rabbani, T., Agrawal, A., Xu, Y., Deng, C., Zhu, S., Mohamed, A., Wen, Y., Goldstein, T., and Huang, F. (2024). WAVES: Benchmarking the robustness of image watermarks. Proceedings of the 41st International Conference on Machine Learning (ICML), PMLR, 235, 1456-1492. https://proceedings.mlr.press/v235/an24a.html
  5. Anderson, H. S., and Roth, P. (2018). EMBER: An open dataset for training static PE malware machine learning models. arXiv preprint arXiv:1804.04637. https://arxiv.org/abs/1804.04637
  6. Apruzzese, G., Anderson, H. S., Dambra, S., Freeman, D., Pierazzi, F., and Roundy, K. (2023). 'Real attackers don't compute gradients': Bridging the gap between adversarial ML research and practice. 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), 339-364. https://doi.org/10.1109/SaTML54575.2023.00031
  7. Arp, D., Quiring, E., Pendlebury, F., Warnecke, A., Pierazzi, F., Wressnegger, C., Cavallaro, L., and Rieck, K. (2022). Dos and don'ts of machine learning in computer security. Proceedings of the 31st USENIX Security Symposium, 3971-3988. https://www.usenix.org/conference/usenixsecurity22/presentation/arp
  8. Arthur, D., and Vassilvitskii, S. (2007). k-means++: The advantages of careful seeding. Proceedings of the Eighteenth Annual ACM-SIAM Symposium on Discrete Algorithms (SODA 2007), 1027-1035. https://theory.stanford.edu/~sergei/papers/kMeansPP-soda.pdf
  9. Athalye, A., Carlini, N., and Wagner, D. (2018). Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. Proceedings of the 35th International Conference on Machine Learning (ICML), 274-283. https://proceedings.mlr.press/v80/athalye18a.html
  10. Atli, B. G., Szyller, S., Juuti, M., Marchal, S., and Asokan, N. (2020). Extraction of complex DNN models: Real threat or boogeyman?. Engineering Dependable and Secure Machine Learning Systems, Communications in Computer and Information Science 1272, 42-57. Springer. https://doi.org/10.1007/978-3-030-62144-5_4
  11. Axelsson, S. (2000). The base-rate fallacy and the difficulty of intrusion detection. ACM Transactions on Information and System Security, 3(3), 186-205. https://doi.org/10.1145/357830.357849
  12. Azulay, A., and Weiss, Y. (2019). Why do deep convolutional networks generalize so poorly to small image transformations?. Journal of Machine Learning Research, 20(184), 1-25. https://jmlr.org/papers/v20/19-519.html
  13. Bagdasaryan, E., Poursaeed, O., and Shmatikov, V. (2019). Differential privacy has disparate impact on model accuracy. Advances in Neural Information Processing Systems, 32. https://proceedings.neurips.cc/paper_files/paper/2019/hash/fc0de4e0396fff257ea362983c2dda5a-Abstract.html
  14. Baldi, P., and Hornik, K. (1989). Neural networks and principal component analysis: Learning from examples without local minima. Neural Networks, 2(1), 53-58. https://doi.org/10.1016/0893-6080(89)90014-2
  15. Bayer, U., Milani Comparetti, P., Hlauschek, C., Kruegel, C., and Kirda, E. (2009). Scalable, behavior-based malware clustering. Network and Distributed System Security Symposium (NDSS 2009). https://www.ndss-symposium.org/wp-content/uploads/2017/09/bay.pdf
  16. Bengio, Y., Simard, P., and Frasconi, P. (1994). Learning long-term dependencies with gradient descent is difficult. IEEE Transactions on Neural Networks, 5(2), 157-166. https://doi.org/10.1109/72.279181
  17. Beurer-Kellner, L., Buesser, B., Creţu, A.-M., Debenedetti, E., Dobos, D., Fabian, D., Fischer, M., Froelicher, D., Grosse, K., Naeff, D., Ozoani, E., Paverd, A., Tramèr, F., and Volhejn, V. (2025). Design patterns for securing LLM agents against prompt injections. arXiv preprint arXiv:2506.08837. https://arxiv.org/abs/2506.08837
  18. Biggio, B., and Roli, F. (2018). Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognition, 84, 317-331. https://doi.org/10.1016/j.patcog.2018.07.023
  19. Biggio, B., Nelson, B., and Laskov, P. (2012). Poisoning attacks against support vector machines. Proceedings of the 29th International Conference on Machine Learning (ICML). https://icml.cc/2012/papers/880.pdf
  20. Biggio, B., Corona, I., Maiorca, D., Nelson, B., Šrndić, N., Laskov, P., Giacinto, G., and Roli, F. (2013). Evasion attacks against machine learning at test time. Machine Learning and Knowledge Discovery in Databases (ECML PKDD), Lecture Notes in Computer Science 8190, 387-402. https://doi.org/10.1007/978-3-642-40994-3_25
  21. Bolton, R. J., and Hand, D. J. (2002). Statistical fraud detection: A review. Statistical Science, 17(3), 235-255. https://doi.org/10.1214/ss/1042727940
  22. Bottou, L. (2010). Large-scale machine learning with stochastic gradient descent. Proceedings of COMPSTAT'2010, 177-186. https://doi.org/10.1007/978-3-7908-2604-3_16
  23. Breiman, L. (1996). Bagging predictors. Machine Learning, 24(2), 123-140. https://doi.org/10.1007/BF00058655
  24. Breiman, L. (2001). Random forests. Machine Learning, 45(1), 5-32. https://doi.org/10.1023/A:1010933404324
  25. Breunig, M. M., Kriegel, H.-P., Ng, R. T., and Sander, J. (2000). LOF: Identifying density-based local outliers. Proceedings of the 2000 ACM SIGMOD International Conference on Management of Data, 93-104. https://doi.org/10.1145/342009.335388
  26. Brown, L. D., Cai, T. T., and DasGupta, A. (2001). Interval estimation for a binomial proportion. Statistical Science, 16(2), 101-133. https://doi.org/10.1214/ss/1009213286
  27. Campello, R. J. G. B., Moulavi, D., Zimek, A., and Sander, J. (2015). Hierarchical density estimates for data clustering, visualization, and outlier detection. ACM Transactions on Knowledge Discovery from Data, 10(1), 5:1-5:51. https://doi.org/10.1145/2733381
  28. Carlini, N., and Farid, H. (2020). Evading deepfake-image detectors with white- and black-box attacks. 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), 2804-2813. https://doi.org/10.1109/CVPRW50498.2020.00337
  29. Carlini, N., and Wagner, D. (2017). Towards evaluating the robustness of neural networks. 2017 IEEE Symposium on Security and Privacy (SP), 39-57. https://doi.org/10.1109/SP.2017.49
  30. Carlini, N., Athalye, A., Papernot, N., Brendel, W., Rauber, J., Tsipras, D., Goodfellow, I., Madry, A., and Kurakin, A. (2019). On evaluating adversarial robustness. arXiv. arXiv preprint arXiv:1902.06705. https://arxiv.org/abs/1902.06705
  31. Carlini, N., Tramèr, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Erlingsson, Ú., Oprea, A., and Raffel, C. (2021). Extracting training data from large language models. Proceedings of the 30th USENIX Security Symposium, 2633-2650. https://www.usenix.org/conference/usenixsecurity21/presentation/carlini-extracting
  32. Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., and Tramèr, F. (2022). Membership inference attacks from first principles. 2022 IEEE Symposium on Security and Privacy (SP), 1897-1914. https://doi.org/10.1109/SP46214.2022.9833649
  33. Cawley, G. C., and Talbot, N. L. C. (2010). On over-fitting in model selection and subsequent selection bias in performance evaluation. Journal of Machine Learning Research, 11, 2079-2107. https://www.jmlr.org/papers/v11/cawley10a.html
  34. Chakraborty, S., Krishna, R., Ding, Y., and Ray, B. (2022). Deep learning based vulnerability detection: Are we there yet?. IEEE Transactions on Software Engineering, 48(9), 3280-3296. https://doi.org/10.1109/TSE.2021.3087402
  35. Chandola, V., Banerjee, A., and Kumar, V. (2009). Anomaly detection: A survey. ACM Computing Surveys, 41(3), 15:1-15:58. https://doi.org/10.1145/1541880.1541882
  36. Chen, T., and Guestrin, C. (2016). XGBoost: A scalable tree boosting system. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 785-794. https://doi.org/10.1145/2939672.2939785
  37. Chen, H., and Magramo, K. (2024). Finance worker pays out $25 million after video call with deepfake 'chief financial officer'. CNN. Published 4 February 2024. https://edition.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk/index.html
  38. Chen, X., Liu, C., Li, B., Lu, K., and Song, D. (2017). Targeted backdoor attacks on deep learning systems using data poisoning. arXiv. arXiv preprint arXiv:1712.05526. https://arxiv.org/abs/1712.05526
  39. Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., and Srivastava, B. (2019). Detecting backdoor attacks on deep neural networks by activation clustering. Proceedings of the AAAI Workshop on Artificial Intelligence Safety (SafeAI 2019), CEUR Workshop Proceedings 2301. https://ceur-ws.org/Vol-2301/paper_18.pdf
  40. Cho, K., van Merrienboer, B., Gulcehre, C., Bahdanau, D., Bougares, F., Schwenk, H., and Bengio, Y. (2014). Learning phrase representations using RNN encoder-decoder for statistical machine translation. Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP), 1724-1734. https://doi.org/10.3115/v1/D14-1179
  41. Choquette-Choo, C. A., Tramèr, F., Carlini, N., and Papernot, N. (2021). Label-only membership inference attacks. Proceedings of the 38th International Conference on Machine Learning (ICML), PMLR, 139, 1964-1974. https://proceedings.mlr.press/v139/choquette-choo21a.html
  42. Chouldechova, A. (2017). Fair prediction with disparate impact: A study of bias in recidivism prediction instruments. Big Data, 5(2), 153-163. https://doi.org/10.1089/big.2016.0047
  43. Christiano, P. F., Leike, J., Brown, T. B., Martic, M., Legg, S., and Amodei, D. (2017). Deep reinforcement learning from human preferences. Advances in Neural Information Processing Systems, 30. https://proceedings.neurips.cc/paper_files/paper/2017/hash/d5e2c0adad503c91f91df240d0cd4e49-Abstract.html
  44. Coalition for Content Provenance and Authenticity (2026a). C2PA and Content Credentials explainer. Version 2.2, 24 March 2026, published with the version 2.4 specifications. https://spec.c2pa.org/specifications/specifications/2.4/explainer/_attachments/Explainer.pdf
  45. Coalition for Content Provenance and Authenticity (2026b). Content Credentials: C2PA technical specification. Version 2.4, 1 April 2026. https://spec.c2pa.org/specifications/specifications/2.4/specs/_attachments/C2PA_Specification.pdf
  46. Cohen, J., Rosenfeld, E., and Kolter, Z. (2019). Certified adversarial robustness via randomized smoothing. Proceedings of the 36th International Conference on Machine Learning (ICML), PMLR, 97, 1310-1320. https://proceedings.mlr.press/v97/cohen19c.html
  47. Cortes, C., and Vapnik, V. (1995). Support-vector networks. Machine Learning, 20(3), 273-297. https://doi.org/10.1007/BF00994018
  48. Cover, T. M., and Hart, P. E. (1967). Nearest neighbor pattern classification. IEEE Transactions on Information Theory, 13(1), 21-27. https://doi.org/10.1109/TIT.1967.1053964
  49. Croce, F., and Hein, M. (2020). Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. Proceedings of the 37th International Conference on Machine Learning (ICML), 2206-2216. https://proceedings.mlr.press/v119/croce20b.html
  50. Cybenko, G. (1989). Approximation by superpositions of a sigmoidal function. Mathematics of Control, Signals, and Systems, 2(4), 303-314. https://doi.org/10.1007/BF02551274
  51. Davis, J., and Goadrich, M. (2006). The relationship between precision-recall and ROC curves. Proceedings of the 23rd International Conference on Machine Learning, 233-240. https://doi.org/10.1145/1143844.1143874
  52. Debenedetti, E., Zhang, J., Balunović, M., Beurer-Kellner, L., Fischer, M., and Tramèr, F. (2024). AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. Advances in Neural Information Processing Systems (Datasets and Benchmarks Track), 37, 82895-82920. https://proceedings.neurips.cc/paper_files/paper/2024/hash/97091a5177d8dc64b1da8bf3e1f6fb54-Abstract-Datasets_and_Benchmarks_Track.html
  53. Debenedetti, E., Shumailov, I., Fan, T., Hayes, J., Carlini, N., Fabian, D., Kern, C., Shi, C., Terzis, A., and Tramèr, F. (2026). Defeating prompt injections by design. 2026 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), 587-618. https://doi.org/10.1109/SaTML68715.2026.00040
  54. Ding, Y., Fu, Y., Ibrahim, O., Sitawarin, C., Chen, X., Alomair, B., Wagner, D., Ray, B., and Chen, Y. (2025). Vulnerability detection with code language models: How far are we?. 2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE), 1729-1741. https://doi.org/10.1109/ICSE55347.2025.00038
  55. Dolhansky, B., Bitton, J., Pflaum, B., Lu, J., Howes, R., Wang, M., and Canton Ferrer, C. (2020). The DeepFake Detection Challenge (DFDC) dataset. arXiv. arXiv preprint arXiv:2006.07397. https://arxiv.org/abs/2006.07397
  56. Domingos, P., and Pazzani, M. (1997). On the optimality of the simple Bayesian classifier under zero-one loss. Machine Learning, 29(2-3), 103-130. https://doi.org/10.1023/A:1007413511361
  57. Du, M., Li, F., Zheng, G., and Srikumar, V. (2017). DeepLog: Anomaly detection and diagnosis from system logs through deep learning. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS), 1285-1298. https://doi.org/10.1145/3133956.3134015
  58. Durall, R., Keuper, M., and Keuper, J. (2020). Watch your up-convolution: CNN based generative deep neural networks are failing to reproduce spectral distributions. 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 7887-7896. https://doi.org/10.1109/CVPR42600.2020.00791
  59. Dwork, C., and Roth, A. (2014). The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(3-4), 211-407. https://doi.org/10.1561/0400000042
  60. Dwork, C., McSherry, F., Nissim, K., and Smith, A. (2006). Calibrating noise to sensitivity in private data analysis. Theory of Cryptography (TCC 2006), Lecture Notes in Computer Science 3876, 265-284. Springer. https://doi.org/10.1007/11681878_14
  61. Elkan, C. (2001). The foundations of cost-sensitive learning. Proceedings of the Seventeenth International Joint Conference on Artificial Intelligence (IJCAI), 973-978. https://www.ijcai.org/Proceedings/01/IJCAI-2001-k.pdf
  62. Engelen, G., Rimmer, V., and Joosen, W. (2021). Troubleshooting an intrusion detection dataset: The CICIDS2017 case study. 2021 IEEE Security and Privacy Workshops (SPW), 7-12. https://doi.org/10.1109/SPW53761.2021.00009
  63. Ester, M., Kriegel, H.-P., Sander, J., and Xu, X. (1996). A density-based algorithm for discovering clusters in large spatial databases with noise. Proceedings of the Second International Conference on Knowledge Discovery and Data Mining (KDD-96), 226-231. AAAI Press. https://cdn.aaai.org/KDD/1996/KDD96-037.pdf
  64. European Commission (2026). AI Act. Shaping Europe's digital future, policy page, last updated 3 August 2026; accessed 15 October 2026. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
  65. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act). Official Journal of the European Union, L series. OJ L 2024/1689, 12 July 2024. http://data.europa.eu/eli/reg/2024/1689/oj
  66. European Parliament and Council of the European Union (2026). Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal of the European Union, L series. OJ L 2026/1744, 24 July 2026. http://data.europa.eu/eli/reg/2026/1744/oj
  67. Fawcett, T. (2006). An introduction to ROC analysis. Pattern Recognition Letters, 27(8), 861-874. https://doi.org/10.1016/j.patrec.2005.10.010
  68. Federal Bureau of Investigation (2024). Criminals use generative artificial intelligence to facilitate financial fraud. Internet Crime Complaint Center (IC3). Public service announcement I-120324-PSA, 3 December 2024. https://www.ic3.gov/PSA/2024/PSA241203
  69. Fernandez, P., Couairon, G., Jégou, H., Douze, M., and Furon, T. (2023). The Stable Signature: Rooting watermarks in latent diffusion models. 2023 IEEE/CVF International Conference on Computer Vision (ICCV), 22409-22420. https://doi.org/10.1109/ICCV51070.2023.02053
  70. Financial Crimes Enforcement Network (2024). FinCEN alert on fraud schemes involving deepfake media targeting financial institutions. U.S. Department of the Treasury. FIN-2024-Alert004, 13 November 2024. https://www.fincen.gov/sites/default/files/shared/FinCEN-Alert-DeepFakes-Alert508FINAL.pdf
  71. Frank, J., Eisenhofer, T., Schönherr, L., Fischer, A., Kolossa, D., and Holz, T. (2020). Leveraging frequency analysis for deep fake image recognition. Proceedings of the 37th International Conference on Machine Learning (ICML), PMLR, 119, 3247-3258. https://proceedings.mlr.press/v119/frank20a.html
  72. Fredrikson, M., Jha, S., and Ristenpart, T. (2015). Model inversion attacks that exploit confidence information and basic countermeasures. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (CCS), 1322-1333. https://doi.org/10.1145/2810103.2813677
  73. Friedman, J. H. (2001). Greedy function approximation: A gradient boosting machine. The Annals of Statistics, 29(5), 1189-1232. https://doi.org/10.1214/aos/1013203451
  74. Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., and Nepal, S. (2019). STRIP: A defence against trojan attacks on deep neural networks. Proceedings of the 35th Annual Computer Security Applications Conference (ACSAC), 113-125. https://doi.org/10.1145/3359789.3359790
  75. Gebru, T., Morgenstern, J., Vecchione, B., Vaughan, J. W., Wallach, H., Daumé III, H., and Crawford, K. (2021). Datasheets for datasets. Communications of the ACM, 64(12), 86-92. https://doi.org/10.1145/3458723
  76. Gers, F. A., Schmidhuber, J., and Cummins, F. (2000). Learning to forget: Continual prediction with LSTM. Neural Computation, 12(10), 2451-2471. https://doi.org/10.1162/089976600300015015
  77. Glorot, X., and Bengio, Y. (2010). Understanding the difficulty of training deep feedforward neural networks. Proceedings of the Thirteenth International Conference on Artificial Intelligence and Statistics, PMLR, 9, 249-256. https://proceedings.mlr.press/v9/glorot10a.html
  78. Gong, D., Liu, L., Le, V., Saha, B., Mansour, M. R., Venkatesh, S., and van den Hengel, A. (2019). Memorizing normality to detect anomaly: Memory-augmented deep autoencoder for unsupervised anomaly detection. 2019 IEEE/CVF International Conference on Computer Vision (ICCV), 1705-1714. https://doi.org/10.1109/ICCV.2019.00179
  79. Goodfellow, I. J., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y. (2014). Generative adversarial nets. Advances in Neural Information Processing Systems, 27. https://proceedings.neurips.cc/paper_files/paper/2014/hash/f033ed80deb0234979a61f95710dbe25-Abstract.html
  80. Goodfellow, I. J., Shlens, J., and Szegedy, C. (2015). Explaining and harnessing adversarial examples. International Conference on Learning Representations (ICLR). arXiv preprint arXiv:1412.6572. https://arxiv.org/abs/1412.6572
  81. Goodfellow, I., Bengio, Y., and Courville, A. (2016). Deep Learning. MIT Press. https://www.deeplearningbook.org
  82. Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., and Fritz, M. (2023). Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec), 79-90. https://doi.org/10.1145/3605764.3623985
  83. Grinsztajn, L., Oyallon, E., and Varoquaux, G. (2022). Why do tree-based models still outperform deep learning on typical tabular data?. Advances in Neural Information Processing Systems 35, Datasets and Benchmarks Track, 507-520. https://doi.org/10.52202/068431-0037
  84. Grosse, K., Papernot, N., Manoharan, P., Backes, M., and McDaniel, P. (2017). Adversarial examples for malware detection. Computer Security, ESORICS 2017, Lecture Notes in Computer Science 10493, 62-79. https://doi.org/10.1007/978-3-319-66399-9_4
  85. Grother, P., Ngan, M., and Hanaoka, K. (2019). Face recognition vendor test (FRVT) part 3: Demographic effects. National Institute of Standards and Technology. NISTIR 8280, December 2019. https://doi.org/10.6028/NIST.IR.8280
  86. Gu, T., Liu, K., Dolan-Gavitt, B., and Garg, S. (2019). BadNets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7, 47230-47244. https://doi.org/10.1109/ACCESS.2019.2909068
  87. Han, S., Hu, X., Huang, H., Jiang, M., and Zhao, Y. (2022). ADBench: Anomaly detection benchmark. Advances in Neural Information Processing Systems 35 (NeurIPS 2022), Datasets and Benchmarks Track, 32142-32159. https://doi.org/10.52202/068431-2329
  88. Hardt, M., Price, E., and Srebro, N. (2016). Equality of opportunity in supervised learning. Advances in Neural Information Processing Systems, 29. https://papers.nips.cc/paper_files/paper/2016/hash/6a9659feb1216f14f7384ba499518b38-Abstract.html
  89. He, K., Zhang, X., Ren, S., and Sun, J. (2015). Delving deep into rectifiers: Surpassing human-level performance on ImageNet classification. 2015 IEEE International Conference on Computer Vision (ICCV), 1026-1034. https://doi.org/10.1109/ICCV.2015.123
  90. He, K., Zhang, X., Ren, S., and Sun, J. (2016). Deep residual learning for image recognition. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 770-778. https://doi.org/10.1109/CVPR.2016.90
  91. He, P., Zhu, J., Zheng, Z., and Lyu, M. R. (2017). Drain: An online log parsing approach with fixed depth tree. 2017 IEEE International Conference on Web Services (ICWS), 33-40. https://doi.org/10.1109/ICWS.2017.13
  92. Heiding, F., Schneier, B., Vishwanath, A., Bernstein, J., and Park, P. S. (2024). Devising and detecting phishing emails using large language models. IEEE Access, 12, 42131-42146. https://doi.org/10.1109/ACCESS.2024.3375882
  93. Hines, K., Lopez, G., Hall, M., Zarfati, F., Zunger, Y., and Kiciman, E. (2024). Defending against indirect prompt injection attacks with spotlighting. Proceedings of the Conference on Applied Machine Learning in Information Security (CAMLIS 2024), CEUR Workshop Proceedings 3920, 48-62. https://ceur-ws.org/Vol-3920/paper03.pdf
  94. Ho, J., Jain, A., and Abbeel, P. (2020). Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, 33, 6840-6851. https://proceedings.neurips.cc/paper_files/paper/2020/hash/4c5bcfec8584af0d967f1ab10179ca4b-Abstract.html
  95. Hochreiter, S., and Schmidhuber, J. (1997). Long short-term memory. Neural Computation, 9(8), 1735-1780. https://doi.org/10.1162/neco.1997.9.8.1735
  96. Holtzman, A., Buys, J., Du, L., Forbes, M., and Choi, Y. (2020). The curious case of neural text degeneration. International Conference on Learning Representations (ICLR). https://openreview.net/forum?id=rygGQyrFvH
  97. Hornik, K., Stinchcombe, M., and White, H. (1989). Multilayer feedforward networks are universal approximators. Neural Networks, 2(5), 359-366. https://doi.org/10.1016/0893-6080(89)90020-8
  98. Householder, A. D., Wassermann, G., Manion, A., and King, C. (2017). The CERT guide to coordinated vulnerability disclosure. Software Engineering Institute, Carnegie Mellon University. Special report CMU/SEI-2017-SR-022, 15 August 2017. https://doi.org/10.1184/R1/12367340.v1
  99. Hugging Face (2024). SmolLM2-360M-Instruct model card. Model repository HuggingFaceTB/SmolLM2-360M-Instruct, created 31 October 2024, revision a10cc15; accessed 15 October 2026. https://huggingface.co/HuggingFaceTB/SmolLM2-360M-Instruct
  100. Hugging Face (2026). safetensors: Simple, safe way to store and distribute tensors. Repository README and documentation; accessed 15 October 2026. https://github.com/huggingface/safetensors
  101. Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., and Madry, A. (2019). Adversarial examples are not bugs, they are features. Advances in Neural Information Processing Systems, 32. https://proceedings.neurips.cc/paper_files/paper/2019/hash/e2c420d928d4bf8ce0ff2ec19b371514-Abstract.html
  102. International Organization for Standardization and International Electrotechnical Commission (2018). ISO/IEC 29147:2018 Information technology: Security techniques: Vulnerability disclosure. ISO/IEC JTC 1/SC 27. Edition 2, October 2018. https://www.iso.org/standard/72311.html
  103. International Organization for Standardization and International Electrotechnical Commission (2023). ISO/IEC 42001:2023 Information technology: Artificial intelligence: Management system. ISO/IEC JTC 1/SC 42. Edition 1, December 2023. https://www.iso.org/standard/42001
  104. Jagielski, M., Ullman, J., and Oprea, A. (2020). Auditing differentially private machine learning: How private is private SGD?. Advances in Neural Information Processing Systems, 33, 22205-22216. https://proceedings.neurips.cc/paper_files/paper/2020/hash/fc4ddc15f9f4b4b06ef7844d6bb53abf-Abstract.html
  105. Ji, Z., Lee, N., Frieske, R., Yu, T., Su, D., Xu, Y., Ishii, E., Bang, Y. J., Madotto, A., and Fung, P. (2023). Survey of hallucination in natural language generation. ACM Computing Surveys, 55(12), 1-38. https://doi.org/10.1145/3571730
  106. Jia, Y., Zhang, Y., Weiss, R., Wang, Q., Shen, J., Ren, F., Chen, Z., Nguyen, P., Pang, R., Lopez Moreno, I., and Wu, Y. (2018). Transfer learning from speaker verification to multispeaker text-to-speech synthesis. Advances in Neural Information Processing Systems, 31. https://proceedings.neurips.cc/paper_files/paper/2018/hash/6832a7b24bc06775d02b7406880b93fc-Abstract.html
  107. Jolliffe, I. T., and Cadima, J. (2016). Principal component analysis: A review and recent developments. Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences, 374(2065), 20150202. https://doi.org/10.1098/rsta.2015.0202
  108. Juuti, M., Szyller, S., Marchal, S., and Asokan, N. (2019). PRADA: Protecting against DNN model stealing attacks. 2019 IEEE European Symposium on Security and Privacy (EuroS&P), 512-527. https://doi.org/10.1109/EuroSP.2019.00044
  109. Kairouz, P., Oh, S., and Viswanath, P. (2015). The composition theorem for differential privacy. Proceedings of the 32nd International Conference on Machine Learning (ICML), PMLR, 37, 1376-1385. https://proceedings.mlr.press/v37/kairouz15.html
  110. Kalai, A. T., and Vempala, S. S. (2024). Calibrated language models must hallucinate. Proceedings of the 56th Annual ACM Symposium on Theory of Computing (STOC), 160-171. https://doi.org/10.1145/3618260.3649777
  111. Kapoor, S., and Narayanan, A. (2023). Leakage and the reproducibility crisis in machine-learning-based science. Patterns, 4(9), 100804. https://doi.org/10.1016/j.patter.2023.100804
  112. Karras, T., Laine, S., and Aila, T. (2019). A style-based generator architecture for generative adversarial networks. 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 4396-4405. https://doi.org/10.1109/CVPR.2019.00453
  113. Kaufman, S., Rosset, S., and Perlich, C. (2011). Leakage in data mining: Formulation, detection, and avoidance. Proceedings of the 17th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 556-563. https://doi.org/10.1145/2020408.2020496
  114. Ke, G., Meng, Q., Finley, T., Wang, T., Chen, W., Ma, W., Ye, Q., and Liu, T.-Y. (2017). LightGBM: A highly efficient gradient boosting decision tree. Advances in Neural Information Processing Systems 30. https://proceedings.neurips.cc/paper_files/paper/2017/hash/6449f44a102fde848669bdd9eb6b76fa-Abstract.html
  115. Kingma, D. P., and Ba, J. L. (2015). Adam: A method for stochastic optimization. 3rd International Conference on Learning Representations (ICLR 2015). https://arxiv.org/abs/1412.6980
  116. Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., and Goldstein, T. (2023). A watermark for large language models. Proceedings of the 40th International Conference on Machine Learning (ICML), PMLR, 202, 17061-17084. https://proceedings.mlr.press/v202/kirchenbauer23a.html
  117. Kleinberg, J., Mullainathan, S., and Raghavan, M. (2017). Inherent trade-offs in the fair determination of risk scores. 8th Innovations in Theoretical Computer Science Conference (ITCS 2017), Leibniz International Proceedings in Informatics (LIPIcs), 67, 43:1-43:23. https://doi.org/10.4230/LIPIcs.ITCS.2017.43
  118. Kohavi, R. (1995). A study of cross-validation and bootstrap for accuracy estimation and model selection. Proceedings of the Fourteenth International Joint Conference on Artificial Intelligence (IJCAI), 1137-1143. https://www.ijcai.org/Proceedings/95-2/Papers/016.pdf
  119. Kolter, J. Z., and Maloof, M. A. (2006). Learning to detect and classify malicious executables in the wild. Journal of Machine Learning Research, 7, 2721-2744. https://www.jmlr.org/papers/v7/kolter06a.html
  120. Krizhevsky, A. (2009). Learning multiple layers of features from tiny images. University of Toronto. Technical report. https://www.cs.toronto.edu/~kriz/learning-features-2009-TR.pdf
  121. Kurakin, A., Goodfellow, I. J., and Bengio, S. (2017). Adversarial examples in the physical world. International Conference on Learning Representations (ICLR) Workshop Track. arXiv preprint arXiv:1607.02533. https://arxiv.org/abs/1607.02533
  122. Kurita, K., Michel, P., and Neubig, G. (2020). Weight poisoning attacks on pretrained models. Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, 2793-2806. https://doi.org/10.18653/v1/2020.acl-main.249
  123. Lakhina, A., Crovella, M., and Diot, C. (2004). Diagnosing network-wide traffic anomalies. Proceedings of the 2004 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM 2004), 219-230. https://doi.org/10.1145/1015467.1015492
  124. Le, V.-H., and Zhang, H. (2022). Log-based anomaly detection with deep learning: How far are we?. Proceedings of the 44th International Conference on Software Engineering (ICSE), 1356-1367. https://doi.org/10.1145/3510003.3510155
  125. LeCun, Y., Bottou, L., Bengio, Y., and Haffner, P. (1998). Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11), 2278-2324. https://doi.org/10.1109/5.726791
  126. Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., Küttler, H., Lewis, M., Yih, W.-t., Rocktäschel, T., Riedel, S., and Kiela, D. (2020). Retrieval-augmented generation for knowledge-intensive NLP tasks. Advances in Neural Information Processing Systems, 33, 9459-9474. https://proceedings.neurips.cc/paper_files/paper/2020/hash/6b493230205f780e1bc26945df7481e5-Abstract.html
  127. Li, Z., Zou, D., Xu, S., Ou, X., Jin, H., Wang, S., Deng, Z., and Zhong, Y. (2018). VulDeePecker: A deep learning-based system for vulnerability detection. Proceedings of the 2018 Network and Distributed System Security Symposium (NDSS). https://doi.org/10.14722/ndss.2018.23158
  128. Li, Y., Yang, X., Sun, P., Qi, H., and Lyu, S. (2020). Celeb-DF: A large-scale challenging dataset for DeepFake forensics. 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 3204-3213. https://doi.org/10.1109/CVPR42600.2020.00327
  129. Liu, F. T., Ting, K. M., and Zhou, Z.-H. (2008). Isolation forest. 2008 Eighth IEEE International Conference on Data Mining, 413-422. https://doi.org/10.1109/ICDM.2008.17
  130. Liu, X., Wang, X., Sahidullah, M., Patino, J., Delgado, H., Kinnunen, T., Todisco, M., Yamagishi, J., Evans, N., Nautsch, A., and Lee, K. A. (2023). ASVspoof 2021: Towards spoofed and deepfake speech detection in the wild. IEEE/ACM Transactions on Audio, Speech, and Language Processing, 31, 2507-2522. https://doi.org/10.1109/TASLP.2023.3285283
  131. Liu, Y., Jia, Y., Geng, R., Jia, J., and Gong, N. Z. (2024). Formalizing and benchmarking prompt injection attacks and defenses. Proceedings of the 33rd USENIX Security Symposium, 1831-1847. https://www.usenix.org/conference/usenixsecurity24/presentation/liu-yupei
  132. Lloyd, S. P. (1982). Least squares quantization in PCM. IEEE Transactions on Information Theory, 28(2), 129-137. https://doi.org/10.1109/TIT.1982.1056489
  133. Loshchilov, I., and Hutter, F. (2019). Decoupled weight decay regularization. 7th International Conference on Learning Representations (ICLR 2019). https://arxiv.org/abs/1711.05101
  134. Lukas, N., Jiang, E., Li, X., and Kerschbaum, F. (2022). SoK: How robust is image classification deep neural network watermarking?. 2022 IEEE Symposium on Security and Privacy (SP), 787-804. https://doi.org/10.1109/SP46214.2022.9833693
  135. Lundberg, S. M., and Lee, S.-I. (2017). A unified approach to interpreting model predictions. Advances in Neural Information Processing Systems 30. https://proceedings.neurips.cc/paper_files/paper/2017/hash/8a20a8621978632d76c43dfd28b67767-Abstract.html
  136. Ma, J., Saul, L. K., Savage, S., and Voelker, G. M. (2009). Beyond blacklists: Learning to detect malicious web sites from suspicious URLs. Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 1245-1254. https://doi.org/10.1145/1557019.1557153
  137. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (2018). Towards deep learning models resistant to adversarial attacks. International Conference on Learning Representations (ICLR). arXiv preprint arXiv:1706.06083. https://arxiv.org/abs/1706.06083
  138. Magramo, K. (2024). Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee. CNN. Published 17 May 2024. https://edition.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk/index.html
  139. McCallum, A., and Nigam, K. (1998). A comparison of event models for naive Bayes text classification. Learning for Text Categorization: Papers from the 1998 Workshop, AAAI Technical Report WS-98-05, 41-48. https://cdn.aaai.org/Workshops/1998/WS-98-05/WS98-05-007.pdf
  140. McHugh, J. (2000). Testing intrusion detection systems: A critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory. ACM Transactions on Information and System Security, 3(4), 262-294. https://doi.org/10.1145/382912.382923
  141. Mironov, I. (2017). Rényi differential privacy. 2017 IEEE 30th Computer Security Foundations Symposium (CSF), 263-275. https://doi.org/10.1109/CSF.2017.11
  142. Mirsky, Y., Doitshman, T., Elovici, Y., and Shabtai, A. (2018). Kitsune: An ensemble of autoencoders for online network intrusion detection. Network and Distributed System Security Symposium (NDSS 2018). https://doi.org/10.14722/ndss.2018.23204
  143. Mitchell, T. M. (1997). Machine learning. McGraw-Hill.
  144. Mitchell, M., Wu, S., Zaldivar, A., Barnes, P., Vasserman, L., Hutchinson, B., Spitzer, E., Raji, I. D., and Gebru, T. (2019). Model cards for model reporting. Proceedings of the Conference on Fairness, Accountability, and Transparency, 220-229. https://doi.org/10.1145/3287560.3287596
  145. MITRE Corporation (2026). MITRE ATLAS (Adversarial Threat Landscape for AI Systems). Content release 2026.09, dated 15 September 2026, accessed 15 October 2026. https://atlas.mitre.org/
  146. Mnih, V., Kavukcuoglu, K., Silver, D., Rusu, A. A., Veness, J., Bellemare, M. G., Graves, A., Riedmiller, M., Fidjeland, A. K., Ostrovski, G., Petersen, S., Beattie, C., Sadik, A., Antonoglou, I., King, H., Kumaran, D., Wierstra, D., Legg, S., and Hassabis, D. (2015). Human-level control through deep reinforcement learning. Nature, 518(7540), 529-533. https://doi.org/10.1038/nature14236
  147. Morris, J., Kuleshov, V., Shmatikov, V., and Rush, A. (2023). Text embeddings reveal (almost) as much as text. Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, 12448-12460. https://doi.org/10.18653/v1/2023.emnlp-main.765
  148. Nataraj, L., Karthikeyan, S., Jacob, G., and Manjunath, B. S. (2011). Malware images: Visualization and automatic classification. Proceedings of the 8th International Symposium on Visualization for Cyber Security (VizSec), 1-7. https://doi.org/10.1145/2016904.2016908
  149. National Institute of Standards and Technology (2024a). Artificial intelligence risk management framework: Generative artificial intelligence profile. National Institute of Standards and Technology. NIST AI 600-1, July 2024. https://doi.org/10.6028/NIST.AI.600-1
  150. National Institute of Standards and Technology (2024b). Reducing risks posed by synthetic content: An overview of technical approaches to digital content transparency. National Institute of Standards and Technology. NIST AI 100-4, November 2024. https://doi.org/10.6028/NIST.AI.100-4
  151. Nelson, B., Barreno, M., Chi, F. J., Joseph, A. D., Rubinstein, B. I. P., Saini, U., Sutton, C., Tygar, J. D., and Xia, K. (2008). Exploiting machine learning to subvert your spam filter. First USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET '08). https://www.usenix.org/conference/leet-08/exploiting-machine-learning-subvert-your-spam-filter
  152. Niculescu-Mizil, A., and Caruana, R. (2005). Predicting good probabilities with supervised learning. Proceedings of the 22nd International Conference on Machine Learning, 625-632. https://doi.org/10.1145/1102351.1102430
  153. Odena, A., Dumoulin, V., and Olah, C. (2016). Deconvolution and checkerboard artifacts. Distill, 1(10). https://doi.org/10.23915/distill.00003
  154. Ojha, U., Li, Y., and Lee, Y. J. (2023). Towards universal fake image detectors that generalize across generative models. 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 24480-24489. https://doi.org/10.1109/CVPR52729.2023.02345
  155. Orekondy, T., Schiele, B., and Fritz, M. (2019). Knockoff Nets: Stealing functionality of black-box models. 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 4949-4958. https://doi.org/10.1109/CVPR.2019.00509
  156. Ouyang, L., Wu, J., Jiang, X., Almeida, D., Wainwright, C., Mishkin, P., Zhang, C., Agarwal, S., Slama, K., Ray, A., Schulman, J., Hilton, J., Kelton, F., Miller, L., Simens, M., Askell, A., Welinder, P., Christiano, P. F., Leike, J., and Lowe, R. (2022). Training language models to follow instructions with human feedback. Advances in Neural Information Processing Systems, 35, 27730-27744. https://proceedings.neurips.cc/paper_files/paper/2022/hash/b1efde53be364a73914f58805a001731-Abstract-Conference.html
  157. OWASP Foundation (2024). OWASP Top 10 for LLM Applications 2025. OWASP Gen AI Security Project. Version 2025, released 18 November 2024. https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/
  158. OWASP Foundation (2026). OWASP Top 10 for LLM Applications 2026. OWASP Gen AI Security Project. Version 2026, listed on the project site on 3 August 2026. https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/
  159. Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., and Swami, A. (2017). Practical black-box attacks against machine learning. Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security (ASIA CCS), 506-519. https://doi.org/10.1145/3052973.3053009
  160. Pearson, K. (1901). On lines and planes of closest fit to systems of points in space. The London, Edinburgh, and Dublin Philosophical Magazine and Journal of Science, 2(11), 559-572. https://doi.org/10.1080/14786440109462720
  161. Pendlebury, F., Pierazzi, F., Jordaney, R., Kinder, J., and Cavallaro, L. (2019). TESSERACT: Eliminating experimental bias in malware classification across space and time. Proceedings of the 28th USENIX Security Symposium, 729-746. https://www.usenix.org/conference/usenixsecurity19/presentation/pendlebury
  162. Perez, F., and Ribeiro, I. (2022). Ignore previous prompt: Attack techniques for language models. ML Safety Workshop, 36th Conference on Neural Information Processing Systems (NeurIPS 2022). arXiv preprint arXiv:2211.09527. https://arxiv.org/abs/2211.09527
  163. Pierazzi, F., Pendlebury, F., Cortellazzi, J., and Cavallaro, L. (2020). Intriguing properties of adversarial ML attacks in the problem space. 2020 IEEE Symposium on Security and Privacy (SP), 1332-1349. https://doi.org/10.1109/SP40000.2020.00073
  164. Pineau, J., Vincent-Lamarre, P., Sinha, K., Larivière, V., Beygelzimer, A., d'Alché-Buc, F., Fox, E., and Larochelle, H. (2021). Improving reproducibility in machine learning research (a report from the NeurIPS 2019 reproducibility program). Journal of Machine Learning Research, 22(164), 1-20. https://jmlr.org/papers/v22/20-303.html
  165. Pleiss, G., Raghavan, M., Wu, F., Kleinberg, J., and Weinberger, K. Q. (2017). On fairness and calibration. Advances in Neural Information Processing Systems, 30. https://proceedings.neurips.cc/paper_files/paper/2017/hash/b8b9c74ac526fffbeb2d39ab038d1cd7-Abstract.html
  166. Python Software Foundation (2026). pickle: Python object serialization. Python 3 standard library documentation; accessed 15 October 2026. https://docs.python.org/3/library/pickle.html
  167. PyTorch Contributors (2026). Serialization semantics, and torch.load. PyTorch 2.14 documentation; accessed 15 October 2026. https://docs.pytorch.org/docs/2.14/notes/serialization.html
  168. Quinlan, J. R. (1986). Induction of decision trees. Machine Learning, 1(1), 81-106. https://doi.org/10.1007/BF00116251
  169. Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., and Sutskever, I. (2021). Learning transferable visual models from natural language supervision. Proceedings of the 38th International Conference on Machine Learning (ICML), PMLR, 139, 8748-8763. https://proceedings.mlr.press/v139/radford21a.html
  170. Rafailov, R., Sharma, A., Mitchell, E., Manning, C. D., Ermon, S., and Finn, C. (2023). Direct preference optimization: Your language model is secretly a reward model. Advances in Neural Information Processing Systems, 36, 53728-53741. https://proceedings.neurips.cc/paper_files/paper/2023/hash/a85b405ed65c6477a4fe8302b5e06ce7-Abstract-Conference.html
  171. Raji, I. D., Smart, A., White, R. N., Mitchell, M., Gebru, T., Hutchinson, B., Smith-Loud, J., Theron, D., and Barnes, P. (2020). Closing the AI accountability gap: Defining an end-to-end framework for internal algorithmic auditing. Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency, 33-44. https://doi.org/10.1145/3351095.3372873
  172. Rice, L., Wong, E., and Kolter, Z. (2020). Overfitting in adversarially robust deep learning. Proceedings of the 37th International Conference on Machine Learning (ICML), PMLR, 119, 8093-8104. https://proceedings.mlr.press/v119/rice20a.html
  173. Ringberg, H., Soule, A., Rexford, J., and Diot, C. (2007). Sensitivity of PCA for traffic anomaly detection. Proceedings of the 2007 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems, 109-120. https://doi.org/10.1145/1254882.1254895
  174. Roesch, M. (1999). Snort: Lightweight intrusion detection for networks. Proceedings of LISA '99, the 13th Systems Administration Conference, 229-238. https://www.usenix.org/legacy/event/lisa99/full_papers/roesch/roesch.pdf
  175. Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. (2022). High-resolution image synthesis with latent diffusion models. 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 10674-10685. https://doi.org/10.1109/CVPR52688.2022.01042
  176. Rousseeuw, P. J. (1987). Silhouettes: A graphical aid to the interpretation and validation of cluster analysis. Journal of Computational and Applied Mathematics, 20, 53-65. https://doi.org/10.1016/0377-0427(87)90125-7
  177. Rumelhart, D. E., Hinton, G. E., and Williams, R. J. (1986). Learning representations by back-propagating errors. Nature, 323(6088), 533-536. https://doi.org/10.1038/323533a0
  178. Rössler, A., Cozzolino, D., Verdoliva, L., Riess, C., Thies, J., and Nießner, M. (2019). FaceForensics++: Learning to detect manipulated facial images. 2019 IEEE/CVF International Conference on Computer Vision (ICCV), 1-11. https://doi.org/10.1109/ICCV.2019.00009
  179. Saberi, M., Sadasivan, V. S., Rezaei, K., Kumar, A., Chegini, A., Wang, W., and Feizi, S. (2024). Robustness of AI-image detectors: Fundamental limits and practical attacks. 12th International Conference on Learning Representations (ICLR 2024). https://openreview.net/forum?id=dLoAdIKENc
  180. Sahami, M., Dumais, S., Heckerman, D., and Horvitz, E. (1998). A Bayesian approach to filtering junk e-mail. Learning for Text Categorization: Papers from the 1998 Workshop, AAAI Technical Report WS-98-05, 55-62. https://cdn.aaai.org/Workshops/1998/WS-98-05/WS98-05-009.pdf
  181. Saito, T., and Rehmsmeier, M. (2015). The precision-recall plot is more informative than the ROC plot when evaluating binary classifiers on imbalanced datasets. PLOS ONE, 10(3), e0118432. https://doi.org/10.1371/journal.pone.0118432
  182. Satvat, K., Gjomemo, R., and Venkatakrishnan, V. N. (2021). Extractor: Extracting attack behavior from threat reports. 2021 IEEE European Symposium on Security and Privacy (EuroS&P), 598-615. https://doi.org/10.1109/EuroSP51992.2021.00046
  183. Sauer, A., Lorenz, D., Blattmann, A., and Rombach, R. (2024). Adversarial diffusion distillation. Computer Vision, ECCV 2024, Lecture Notes in Computer Science 15144, 87-103. https://doi.org/10.1007/978-3-031-73016-0_6
  184. Schwartz, J., and Kurniawati, H. (2019). Autonomous penetration testing using reinforcement learning. University of Queensland. Bachelor of Science (Honours) thesis; arXiv preprint arXiv:1905.05965. https://arxiv.org/abs/1905.05965
  185. Schölkopf, B., Platt, J. C., Shawe-Taylor, J., Smola, A. J., and Williamson, R. C. (2001). Estimating the support of a high-dimensional distribution. Neural Computation, 13(7), 1443-1471. https://doi.org/10.1162/089976601750264965
  186. Sennrich, R., Haddow, B., and Birch, A. (2016). Neural machine translation of rare words with subword units. Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 1715-1725. https://doi.org/10.18653/v1/P16-1162
  187. Severi, G., Meyer, J., Coull, S., and Oprea, A. (2021). Explanation-guided backdoor poisoning attacks against malware classifiers. Proceedings of the 30th USENIX Security Symposium, 1487-1504. https://www.usenix.org/conference/usenixsecurity21/presentation/severi
  188. Shafahi, A., Huang, W. R., Najibi, M., Suciu, O., Studer, C., Dumitras, T., and Goldstein, T. (2018). Poison frogs! Targeted clean-label poisoning attacks on neural networks. Advances in Neural Information Processing Systems, 31. https://proceedings.neurips.cc/paper_files/paper/2018/hash/22722a343513ed45f14905eb07621686-Abstract.html
  189. Sharafaldin, I., Habibi Lashkari, A., and Ghorbani, A. A. (2018). Toward generating a new intrusion detection dataset and intrusion traffic characterization. Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP), 108-116. https://doi.org/10.5220/0006639801080116
  190. Shokri, R., Stronati, M., Song, C., and Shmatikov, V. (2017). Membership inference attacks against machine learning models. 2017 IEEE Symposium on Security and Privacy (SP), 3-18. https://doi.org/10.1109/SP.2017.41
  191. Sommer, R., and Paxson, V. (2010). Outside the closed world: On using machine learning for network intrusion detection. 2010 IEEE Symposium on Security and Privacy, 305-316. https://doi.org/10.1109/SP.2010.25
  192. Sparck Jones, K. (1972). A statistical interpretation of term specificity and its application in retrieval. Journal of Documentation, 28(1), 11-21. https://doi.org/10.1108/eb026526
  193. Srivastava, N., Hinton, G., Krizhevsky, A., Sutskever, I., and Salakhutdinov, R. (2014). Dropout: A simple way to prevent neural networks from overfitting. Journal of Machine Learning Research, 15(56), 1929-1958. https://jmlr.org/papers/v15/srivastava14a.html
  194. Standen, M., Lucas, M., Bowman, D., Richer, T. J., Kim, J., and Marriott, D. (2021). CybORG: A gym for the development of autonomous cyber agents. IJCAI-21 1st International Workshop on Adaptive Cyber Defense. arXiv preprint arXiv:2108.09118. https://arxiv.org/abs/2108.09118
  195. Strobl, C., Boulesteix, A.-L., Zeileis, A., and Hothorn, T. (2007). Bias in random forest variable importance measures: Illustrations, sources and a solution. BMC Bioinformatics, 8, 25. https://doi.org/10.1186/1471-2105-8-25
  196. Sutton, R. S., and Barto, A. G. (2018). Reinforcement Learning: An Introduction. MIT Press, second edition. http://incompleteideas.net/book/the-book-2nd.html
  197. Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2014). Intriguing properties of neural networks. International Conference on Learning Representations (ICLR). arXiv preprint arXiv:1312.6199. https://arxiv.org/abs/1312.6199
  198. Tabassi, E. (2023). Artificial intelligence risk management framework (AI RMF 1.0). National Institute of Standards and Technology. NIST AI 100-1, January 2023. https://doi.org/10.6028/NIST.AI.100-1
  199. Tan, T. J. L., and Shokri, R. (2020). Bypassing backdoor detection algorithms in deep learning. 2020 IEEE European Symposium on Security and Privacy (EuroS&P), 175-183. https://doi.org/10.1109/EuroSP48549.2020.00019
  200. Tan, G., Poletto, M., Guttag, J., and Kaashoek, F. (2003). Role classification of hosts within enterprise networks based on connection patterns. Proceedings of the General Track: 2003 USENIX Annual Technical Conference, 15-28. https://www.usenix.org/legacy/event/usenix03/tech/full_papers/tan/tan.pdf
  201. Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A. A. (2009). A detailed analysis of the KDD CUP 99 data set. 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, 1-6. https://doi.org/10.1109/CISDA.2009.5356528
  202. Thies, J., Zollhöfer, M., Stamminger, M., Theobalt, C., and Nießner, M. (2016). Face2Face: Real-time face capture and reenactment of RGB videos. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2387-2395. https://doi.org/10.1109/CVPR.2016.262
  203. Tibshirani, R. (1996). Regression shrinkage and selection via the lasso. Journal of the Royal Statistical Society, Series B (Methodological), 58(1), 267-288. https://doi.org/10.1111/j.2517-6161.1996.tb02080.x
  204. Tolosana, R., Vera-Rodriguez, R., Fierrez, J., Morales, A., and Ortega-Garcia, J. (2020). Deepfakes and beyond: A survey of face manipulation and fake detection. Information Fusion, 64, 131-148. https://doi.org/10.1016/j.inffus.2020.06.014
  205. Tramèr, F., and Boneh, D. (2019). Adversarial training and robustness for multiple perturbations. Advances in Neural Information Processing Systems, 32. https://proceedings.neurips.cc/paper_files/paper/2019/hash/5d4ae76f053f8f2516ad12961ef7fe97-Abstract.html
  206. Tramèr, F., Zhang, F., Juels, A., Reiter, M. K., and Ristenpart, T. (2016). Stealing machine learning models via prediction APIs. Proceedings of the 25th USENIX Security Symposium, 601-618. https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_tramer.pdf
  207. Tramèr, F., Carlini, N., Brendel, W., and Madry, A. (2020). On adaptive attacks to adversarial example defenses. Advances in Neural Information Processing Systems, 33, 1633-1645. https://proceedings.neurips.cc/paper_files/paper/2020/hash/11f38f8ecd71867b42433548d1078e38-Abstract.html
  208. Tran, B., Li, J., and Madry, A. (2018). Spectral signatures in backdoor attacks. Advances in Neural Information Processing Systems, 31. https://proceedings.neurips.cc/paper_files/paper/2018/hash/280cf18baf4311c92aa5a042336587d3-Abstract.html
  209. Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., and Madry, A. (2019). Robustness may be at odds with accuracy. International Conference on Learning Representations (ICLR). arXiv preprint arXiv:1805.12152. https://arxiv.org/abs/1805.12152
  210. Tuor, A., Kaplan, S., Hutchinson, B., Nichols, N., and Robinson, S. (2017). Deep learning for unsupervised insider threat detection in structured cybersecurity data streams. The AAAI Workshop on Artificial Intelligence for Cyber Security (WS-17-04), 224-231. Association for the Advancement of Artificial Intelligence. Also available as arXiv:1710.00811. https://arxiv.org/abs/1710.00811
  211. UNSW Canberra (n.d.). The UNSW-NB15 dataset. Dataset page of the Cyber Range Lab, UNSW Canberra at ADFA, accessed 15 October 2026. https://research.unsw.edu.au/projects/unsw-nb15-dataset
  212. Vassilev, A., Oprea, A., Fordyce, A., Anderson, H., Davies, X., and Hamin, M. (2025). Adversarial machine learning: A taxonomy and terminology of attacks and mitigations. National Institute of Standards and Technology. NIST AI 100-2e2025, March 2025. https://doi.org/10.6028/NIST.AI.100-2e2025
  213. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, Ł., and Polosukhin, I. (2017). Attention is all you need. Advances in Neural Information Processing Systems, 30. https://proceedings.neurips.cc/paper_files/paper/2017/hash/3f5ee243547dee91fbd053c1c4a845aa-Abstract.html
  214. Wallace, E., Xiao, K., Leike, R., Weng, L., Heidecke, J., and Beutel, A. (2024). The instruction hierarchy: Training LLMs to prioritize privileged instructions. arXiv preprint arXiv:2404.13208. https://arxiv.org/abs/2404.13208
  215. Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., and Zhao, B. Y. (2019). Neural Cleanse: Identifying and mitigating backdoor attacks in neural networks. 2019 IEEE Symposium on Security and Privacy (SP), 707-723. https://doi.org/10.1109/SP.2019.00031
  216. Wang, S.-Y., Wang, O., Zhang, R., Owens, A., and Efros, A. A. (2020). CNN-generated images are surprisingly easy to spot ... for now. 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 8692-8701. https://doi.org/10.1109/CVPR42600.2020.00872
  217. Watkins, C. J. C. H., and Dayan, P. (1992). Q-learning. Machine Learning, 8(3-4), 279-292. https://doi.org/10.1007/BF00992698
  218. Wei, A., Haghtalab, N., and Steinhardt, J. (2023). Jailbroken: How does LLM safety training fail?. Advances in Neural Information Processing Systems, 36, 80079-80110. https://proceedings.neurips.cc/paper_files/paper/2023/hash/fd6613131889a4b656206c50a8bd7790-Abstract-Conference.html
  219. Wilson, A. C., Roelofs, R., Stern, M., Srebro, N., and Recht, B. (2017). The marginal value of adaptive gradient methods in machine learning. Advances in Neural Information Processing Systems 30 (NIPS 2017). https://proceedings.neurips.cc/paper_files/paper/2017/hash/81b3833e2504647f9d794f7d7b9bf341-Abstract.html
  220. Wong, E., Rice, L., and Kolter, J. Z. (2020). Fast is better than free: Revisiting adversarial training. International Conference on Learning Representations (ICLR). arXiv preprint arXiv:2001.03994. https://arxiv.org/abs/2001.03994
  221. Yeom, S., Giacomelli, I., Fredrikson, M., and Jha, S. (2018). Privacy risk in machine learning: Analyzing the connection to overfitting. 2018 IEEE 31st Computer Security Foundations Symposium (CSF), 268-282. https://doi.org/10.1109/CSF.2018.00027
  222. Yosinski, J., Clune, J., Bengio, Y., and Lipson, H. (2014). How transferable are features in deep neural networks?. Advances in Neural Information Processing Systems, 27. https://proceedings.neurips.cc/paper_files/paper/2014/hash/532a2f85b6977104bc93f8580abbb330-Abstract.html
  223. Yousefpour, A., Shilov, I., Sablayrolles, A., Testuggine, D., Prasad, K., Malek, M., Nguyen, J., Ghosh, S., Bharadwaj, A., Zhao, J., Cormode, G., and Mironov, I. (2021). Opacus: User-friendly differential privacy library in PyTorch. arXiv. arXiv preprint arXiv:2109.12298. https://arxiv.org/abs/2109.12298
  224. Zeiler, M. D., and Fergus, R. (2014). Visualizing and understanding convolutional networks. Computer Vision, ECCV 2014, Lecture Notes in Computer Science 8689, 818-833. https://doi.org/10.1007/978-3-319-10590-1_53
  225. Zhang, H., Yu, Y., Jiao, J., Xing, E., El Ghaoui, L., and Jordan, M. (2019). Theoretically principled trade-off between robustness and accuracy. Proceedings of the 36th International Conference on Machine Learning (ICML), PMLR, 97, 7472-7482. https://proceedings.mlr.press/v97/zhang19p.html
  226. Zhao, X., Zhang, K., Su, Z., Vasan, S., Grishchenko, I., Kruegel, C., Vigna, G., Wang, Y.-X., and Li, L. (2024). Invisible image watermarks are provably removable using generative AI. Advances in Neural Information Processing Systems, 37, 8643-8672. https://proceedings.neurips.cc/paper_files/paper/2024/hash/10272bfd0371ef960ec557ed6c866058-Abstract-Conference.html
  227. Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J. Z., and Fredrikson, M. (2023). Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043. https://arxiv.org/abs/2307.15043
  228. Zou, W., Geng, R., Wang, B., and Jia, J. (2025). PoisonedRAG: Knowledge corruption attacks to retrieval-augmented generation of large language models. Proceedings of the 34th USENIX Security Symposium, 3827-3844. https://www.usenix.org/conference/usenixsecurity25/presentation/zou-poisonedrag