Search

The articles in this special section provide a glimpse of the diverse research challenges in adopting blockchain technology into mainstream applications. The four articles focus on the following core issues: scalability, transparency versus privacy, standardization, ecosystem, and integration.

A reliable LULC model aims at predicting the spatial distribution of specific LULC classes for a later year by utilizing the trends from previous years thereby helps in appropriate LULC planning. The Ganga River Basin (GRB) has undergone significant LULC changes during past decades. The changes in LULC pattern was investigated for 1975 and 2010 to have better understanding of the conversion process and thereby predicting the future trend for 2045 using Dyna-CLUE (Conversion of Land-Use and its Effects) model. Four types of data were fed into the model i.e., (a) spatial policies and restrictions; (b) LULC type specific conversion settings; (c) LULC requirements (demands) and (d) location characteristics. The possible and impossible conversions among LULC classes were dealt with through Restriction and No Restriction area. The land conversion allocation was determined by establishing preference between LULC classes and the driving factors using binary logistic regression. Relative Operating Characteristic curves provided an overall value of 0.86 implying acceptability of regression results. The simulated result (with ‘no restriction’ area criteria) showed 578,296 km2 agriculture area in 2010 and 579,235 km2 for 2045, wherein 575,874 km2 (99.58%) of agriculture area could remain unchanged during 2010–2045; while with the restricted area, agriculture area of 577,675 km2 in 2010 and 578,516 km2 for 2045; whereas 576,242 km2 (99.75%) of agriculture area may remain unchanged during 2010–2045. Biophysical drivers namely altitude, slope, aspect, soil types, precipitation and temperature, emerged as major controlling factors for LULC change in GRB. Logistic regression analysis showed that population density is positively related with agriculture and expansion of settlements.

Deep learning models such as Convolutional Neural Networks (CNNs) have shown the potential to classify medical images for accurate diagnosis. These techniques will face regulatory compliance challenges related to privacy of user data, especially when they are deployed as a service on a cloud platform. Fully Homomorphic Encryption (FHE) can enable CNN inference on encrypted data and help mitigate such concerns. However, encrypted CNN inference faces the fundamental challenge of optimizing the computations to achieve an acceptable trade-off between accuracy and practical computational feasibility. Current approaches for encrypted CNN inference demonstrate feasibility typically on smaller images (e.g., MNIST and CIFAR-10 datasets) and shallow neural networks. This work is the first to show encrypted inference results on a real-world dataset for melanoma detection with large-sized images of skin lesions based on the Cheon-Kim-Kim-Song (CKKS) encryption scheme available in the open-source HElib library. The practical challenges related to encrypted inference are first analyzed and inference experiments are conducted on encrypted MNIST images to evaluate different optimization strategies and their role in determining the throughput and latency of the inference process. Using these insights, a modified LeNet-like architecture is designed and implemented to achieve the end goal of enabling encrypted inference on melanoma dataset. The results demonstrate that 80% classification accuracy can be achieved on encrypted skin lesion images (security of 106 bits) with a latency of 51 seconds for single image inference and a throughput of 18,000 images per hour for batched inference, which shows that privacy-preserving machine learning as a service (MLaaS) based on encrypted data is indeed practically feasible.

Research in face recognition has seen tremendous growth over the past couple of decades. Beginning from algorithms capable of performing recognition in constrained environments, the current face recognition systems achieve very high accuracies on large-scale unconstrained face datasets. While upcoming algorithms continue to achieve improved performance, a majority of the face recognition systems are susceptible to failure under disguise variations, one of the most challenging covariate of face recognition. Most of the existing disguise datasets contain images with limited variations, often captured in controlled settings. This does not simulate a real world scenario, where both intentional and unintentional unconstrained disguises are encountered by a face recognition system. In this paper, a novel Disguised Faces in the Wild (DFW) dataset is proposed which contains over 11000 images of 1000 identities with different types of disguise accessories. The dataset is collected from the Internet, resulting in unconstrained face images similar to real world settings. This is the first-of-a-kind dataset with the availability of impersonator and genuine obfuscated face images for each subject. The proposed dataset has been analyzed in terms of three levels of difficulty: (i) easy, (ii) medium, and (iii) hard in order to showcase the challenging nature of the problem. It is our view that the research community can greatly benefit from the DFW dataset in terms of developing algorithms robust to such adversaries. The proposed dataset was released as part of the First International Workshop and Competition on Disguised Faces in the Wild at CVPR, 2018. This paper presents the DFW dataset in detail, including the evaluation protocols, baseline results, performance analysis of the submissions received as part of the competition, and three levels of difficulties of the DFW challenge dataset.

Deep neural network (DNN) architecture based models have high expressive power and learning capacity. However, they are essentially a black box method since it is not easy to mathematically formulate the functions that are learned within its many layers of representation. Realizing this, many researchers have started to design methods to exploit the drawbacks of deep learning based algorithms questioning their robustness and exposing their singularities. In this paper, we attempt to unravel three aspects related to the robustness of DNNs for face recognition: (i) assessing the impact of deep architectures for face recognition in terms of vulnerabilities to attacks, (ii) detecting the singularities by characterizing abnormal filter response behavior in the hidden layers of deep networks; and (iii) making corrections to the processing pipeline to alleviate the problem. Our experimental evaluation using multiple open-source DNN-based face recognition networks, and three publicly available face databases demonstrates that the performance of deep learning based face recognition algorithms can suffer greatly in the presence of such distortions. We also evaluate the proposed approaches on four existing quasi-imperceptible distortions: DeepFool, Universal adversarial perturbations, $$l_2$$ , and Elastic-Net (EAD). The proposed method is able to detect both types of attacks with very high accuracy by suitably designing a classifier using the response of the hidden layers in the network. Finally, we present effective countermeasures to mitigate the impact of adversarial attacks and improve the overall robustness of DNN-based face recognition.

Adversarial perturbations have demonstrated the vulnerabilities of deep learning algorithms to adversarial attacks. Existing adversary detection algorithms attempt to detect the singularities; however, they are in general, loss-function, database, or model dependent. To mitigate this limitation, we propose DAMAD--a generalized perturbation detection algorithm which is agnostic to model architecture, training data set, and loss function used during training. The proposed adversarial perturbation detection algorithm is based on the fusion of autoencoder embedding and statistical texture features extracted from convolutional neural networks. The performance of DAMAD is evaluated on the challenging scenarios of cross-database, cross-attack, and cross-architecture training and testing along with traditional evaluation of testing on the same database with known attack and model. Comparison with state-of-the-art perturbation detection algorithms showcase the effectiveness of the proposed algorithm on six databases: ImageNet, CIFAR-10, Multi-PIE, MEDS, point and shoot challenge (PaSC), and MNIST. Performance evaluation with nearly a quarter of a million adversarial and original images and comparison with recent algorithms show the effectiveness of the proposed algorithm.

Modern AI systems are reaping the advantage of novel learning methods. With their increasing usage, we are realizing the limitations and shortfalls of these systems. Brittleness to minor adversarial changes in the input data, ability to explain the decisions, address the bias in their training data, high opacity in terms of revealing the lineage of the system, how they were trained and tested, and under which parameters and conditions they can reliably guarantee a certain level of performance, are some of the most prominent limitations. Ensuring the privacy and security of the data, assigning appropriate credits to data sources, and delivering decent outputs are also required features of an AI system. We propose the tutorial on “Trustworthy AI” to address six critical issues in enhancing user and public trust in AI systems, namely: (i) bias and fairness, (ii) explainability, (iii) robust mitigation of adversarial attacks, (iv) improved privacy and security in model building, (v) being decent, and (vi) model attribution, including the right level of credit assignment to the data sources, model architectures, and transparency in lineage.

Blockchain has emerged as a leading technology that ensures security in a distributed framework. Recently, it has been shown that blockchain can be used to convert traditional blocks of any deep learning models into secure systems. In this research, we model a trained biometric recognition system in an architecture which leverages the blockchain technology to provide fault tolerant access in a distributed environment. The advantage of the proposed approach is that tampering in one particular component alerts the whole system and helps in easy identification of `any' possible alteration. Experimentally, with different biometric modalities, we have shown that the proposed approach provides security to both deep learning model and the biometric template., Published in IEEE BTAS 2019

In many areas in machine learning, decision trees play a crucial role in classification and regression. When a decision tree based classifier is hosted as a service in a critical application with the need for privacy protection of the service as well as the user data, fully homomorphic encrypted can be employed. However, a decision node in a decision tree can’t be directly implemented in FHE. In this paper, we describe an end-to-end approach to support privacyenhanced decision tree classification using IBM supported open-source library HELib. Using several options for building a decision node and employing oblivious computations coupled with an argmax function in FHE we show that a highly secure and trusted decision tree service can be enabled.

Several successful adversarial attacks have demonstrated the vulnerabilities of deep learning algorithms. These attacks are detrimental in building deep learning based dependable AI applications. Therefore, it is imperative to build a defense mechanism to protect the integrity of deep learning models. In this paper, we present a novel "defense layer" in a network which aims to block the generation of adversarial noise and prevents an adversarial attack in black-box and gray-box settings. The parameter-free defense layer, when applied to any convolutional network, helps in achieving protection against attacks such as FGSM, L 2 , Elastic-Net, and DeepFool. Experiments are performed with different CNN architectures, including VGG, ResNet, and DenseNet, on three databases, namely, MNIST, CIFAR-10, and PaSC. The results showcase the efficacy of the proposed defense layer without adding any computational overhead. For example, on the CIFAR-10 database, while the attack can reduce the accuracy of the ResNet-50 model to as low as 6.3%, the proposed "defense layer" retains the original accuracy of 81.32%.