{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T14:55:20Z","timestamp":1785336920292,"version":"3.55.0"},"reference-count":278,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/"}],"funder":[{"name":"National Science and Technology Council, Taiwan","award":["112-2221-E-033-050-MY3"],"award-info":[{"award-number":["112-2221-E-033-050-MY3"]}]},{"name":"National Science and Technology Council, Taiwan","award":["113-2640-E-008-001"],"award-info":[{"award-number":["113-2640-E-008-001"]}]},{"DOI":"10.13039\/501100001381","name":"National Research Foundation, Prime Minister?s Office, Singapore","doi-asserted-by":"crossref","award":["CREATE programme IN_CYPHER"],"award-info":[{"award-number":["CREATE programme IN_CYPHER"]}],"id":[{"id":"10.13039\/501100001381","id-type":"DOI","asserted-by":"crossref"}]},{"name":"The University Development Fund of the Chinese University of Hong Kong, Shenzhen","award":["UDF01003337"],"award-info":[{"award-number":["UDF01003337"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["2023TA0037"],"award-info":[{"award-number":["2023TA0037"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE J. Emerg. Sel. Topics Circuits Syst."],"published-print":{"date-parts":[[2024]]},"DOI":"10.1109\/jetcas.2024.3477348","type":"journal-article","created":{"date-parts":[[2024,10,9]],"date-time":"2024-10-09T17:51:08Z","timestamp":1728496268000},"page":"1-1","source":"Crossref","is-referenced-by-count":23,"title":["An Overview of Trustworthy AI: Advances in IP Protection, Privacy-preserving Federated Learning, Security Verification, and GAI Safety Alignment"],"prefix":"10.1109","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4992-6475","authenticated-orcid":false,"given":"Yue","family":"Zheng","sequence":"first","affiliation":[{"name":"School of Science and Engineering, The Chinese University of Hong Kong, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8897-6176","authenticated-orcid":false,"given":"Chip-Hong","family":"Chang","sequence":"additional","affiliation":[{"name":"School of Electrical and Electronic Engineering, Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8908-8384","authenticated-orcid":false,"given":"Shih-Hsu","family":"Huang","sequence":"additional","affiliation":[{"name":"Department of Electronic Engineering, Chung Yuan Christian University, Taoyuan, Taiwan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1039-8369","authenticated-orcid":false,"given":"Pin-Yu","family":"Chen","sequence":"additional","affiliation":[{"name":"IBM Research, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Stjepan","family":"Picek","sequence":"additional","affiliation":[{"name":"Institute for Computing and Information Sciences, Radboud University, The Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"AI risk management should incorporate both safety and security","author":"Qi","year":"2024","journal-title":"arXiv:2405.19524"},{"key":"ref2","volume-title":"Federated Learning: Theory and Practice","author":"Nguyen","year":"2024"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3395118"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2022.3233793"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/OJCS.2023.3267221"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3355816"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2023.101805"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/JETCAS.2021.3084400"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3589506"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-56877-1_7"},{"key":"ref12","first-page":"1281","article-title":"With great training comes great vulnerability: Practical attacks against transfer learning","volume-title":"Proc. 27th USENIX Secur. Symp.","author":"Wang"},{"key":"ref13","first-page":"3593","article-title":"Teacher model fingerprinting attacks against transfer learning","volume-title":"Proc. 31st USENIX Secur. Symp. (USENIX Secur.)","author":"Chen"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP53844.2022.00029"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/HOST55342.2024.10545405"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/DAC.2018.8465773"},{"key":"ref17","article-title":"Security analysis of deep neural networks operating in the presence of cache side-channel attacks","author":"Hong","year":"2018","journal-title":"arXiv:1810.03487"},{"key":"ref18","article-title":"Stealing neural networks via timing side channels","author":"Duddu","year":"2018","journal-title":"arXiv:1812.11720"},{"key":"ref19","first-page":"515","article-title":"$CSI $$N N$: Reverse engineering of neural network architectures through electromagnetic side channel","volume-title":"Proc. 28th USENIX Secur. Symp. (USENIX Secur.)","author":"Batina"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/HOST45689.2020.9300274"},{"key":"ref21","first-page":"1","article-title":"Hermes attack: Steal DNN models with lossless inference accuracy","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Secur.)","author":"Zhu"},{"key":"ref22","volume-title":"BarraCUDA: GPUs do leak DNN weights","author":"Horvath","year":"2024"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-61486-6_10"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-81645-2_7"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ISSPIT.2018.8642683"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00509"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i01.5432"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3579856.3590336"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24178"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560586"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01360"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20065-6_12"},{"key":"ref33","first-page":"1309","article-title":"Exploring connections between active learning and model extraction","volume-title":"Proc. 29th USENIX Secur. Symp. (USENIX Secur.)","author":"Chandrasekaran"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363280"},{"key":"ref35","first-page":"3","volume-title":"Polynomial Time Cryptanalytic Extraction Neural Netw. Models","author":"Canales-Mart\u00ednez","year":"2024"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-97-2253-2_19"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.naacl-main.161"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3078971.3078974"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3323873.3325042"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2021.103004"},{"key":"ref41","first-page":"194","article-title":"Don\u2019t forget to sign the gradients!","volume-title":"Proc. Mach. Learn. Syst. (MLSys)","volume":"3","author":"Aramoon"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-019-04434-z"},{"key":"ref43","first-page":"1615","article-title":"Turning your weakness into a strength: Watermarking deep neural networks by backdooring","volume-title":"Proc. 27th USENIX Conf. Secur. Symp.","author":"Adi"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom50675.2020.00130"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/AICAS54282.2022.9869923"},{"key":"ref46","first-page":"17061","article-title":"A watermark for large language models","volume-title":"Proc. 40th Int. Conf. Mach. Learn.","author":"Kirchenbauer"},{"key":"ref47","first-page":"1125","article-title":"Undetectable watermarks for language models","volume-title":"Proc. 37th Annu. Conf. Learn. Theory","author":"Christ"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/ISCAS51556.2021.9401119"},{"key":"ref49","article-title":"Deep neural network fingerprinting by conferrable adversarial examples","author":"Lukas","year":"2019","journal-title":"arXiv:1912.00888"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3437526"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2019.12.016"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/80"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3198267"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/HOST45689.2020.9300276"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-62144-5_4"},{"key":"ref56","article-title":"Thieves on sesame street! Model extraction of BERT-based Apis","author":"Krishna","year":"2019","journal-title":"arXiv:1910.12366"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18074.2021.9586290"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/3595292"},{"key":"ref59","first-page":"1","article-title":"BoMaNet: Boolean masking of an entire neural network","volume-title":"Proc. IEEE\/ACM Int. Conf. Comput. Aided Design (ICCAD)","author":"Dubey"},{"key":"ref60","doi-asserted-by":"crossref","first-page":"506","DOI":"10.46586\/tches.v2022.i1.506-556","article-title":"ModuloNET: Neural networks meet modular arithmetic for efficient hardware masking","volume":"2021","author":"Dubey","year":"2021","journal-title":"IACR Trans. Cryptograph. Hardw. Embedded Syst."},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"ref62","article-title":"Stateful detection of model extraction attacks","author":"Pal","year":"2021","journal-title":"arXiv:2107.05166"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/jiot.2024.3386670"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274740"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3320609"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3189638"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.5220\/0009061206110618"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00085"},{"key":"ref69","article-title":"Prediction poisoning: Towards defenses against DNN model stealing attacks","author":"Orekondy","year":"2019","journal-title":"arXiv:1906.10908"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18072.2020.9218651"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3505634"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2020.3018403"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/MDAT.2023.3303435"},{"key":"ref74","article-title":"Device-bind key-storageless hardware AI model IP protection: A PUF and permute-diffusion encryption-enabled approach","author":"Pan","year":"2022","journal-title":"arXiv:2212.11133"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/TCSII.2023.3309105"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/AICAS54282.2022.9869927"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/TETC.2022.3231012"},{"key":"ref78","first-page":"42614","article-title":"NNSplitter: An active defense solution for DNN model via automated weight obfuscation","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhou"},{"key":"ref79","first-page":"1","article-title":"ObfuNAS: A neural architecture search-based DNN obfuscation approach","volume-title":"Proc. IEEE\/ACM Int. Conf. Comput. Aided Design (ICCAD)","author":"Zhou"},{"key":"ref80","article-title":"DNN-alias: Deep neural network protection against side-channel attacks via layer balancing","author":"Ahmadi","year":"2023","journal-title":"arXiv:2303.06746"},{"key":"ref81","first-page":"1","article-title":"Rethinking deep neural network ownership verification: Embedding passports to defeat ambiguity attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Fan"},{"key":"ref82","first-page":"22619","article-title":"Passport-aware normalization for deep model protection","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Zhang"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2021.3088846"},{"key":"ref84","first-page":"22177","article-title":"Trapdoor normalization with irreversible ownership verification","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Liu"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.01169"},{"key":"ref86","article-title":"Copyright protection in generative AI: A technical perspective","author":"Ren","year":"2024","journal-title":"arXiv:2402.02333"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00363"},{"key":"ref88","article-title":"Watermarking diffusion model","author":"Liu","year":"2023","journal-title":"arXiv:2305.12502"},{"key":"ref89","first-page":"136","article-title":"Generative model watermarking based on human visual system","volume-title":"Proc. Int. Forum Digit. TV Wireless Multimedia Commun.","author":"Zhang"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/WIFS55849.2022.9975409"},{"key":"ref91","first-page":"7213","article-title":"UnGANable: Defending against GAN-based face manipulation","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX)","author":"Li"},{"key":"ref92","article-title":"Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples","author":"Liang","year":"2023","journal-title":"arXiv:2302.04578"},{"key":"ref93","article-title":"Raising the cost of malicious AI-powered image editing","author":"Salman","year":"2023","journal-title":"arXiv:2302.06588"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00019"},{"key":"ref95","article-title":"Large language model unlearning","author":"Yao","year":"2023","journal-title":"arXiv:2310.10683"},{"key":"ref96","first-page":"47783","article-title":"Understanding and mitigating copying in diffusion models","volume-title":"Proc. Adv. Neural Info. Process. Syst.","volume":"36","author":"Somepalli"},{"key":"ref97","article-title":"Deduplicating training data makes language models better","author":"Lee","year":"2021","journal-title":"arXiv:2107.06499"},{"key":"ref98","article-title":"DiffusionShield: A watermark for data copyright protection against generative diffusion models","volume-title":"Proc. NeurIPS Workshop Diffusion Models","author":"Cui"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2023.109844"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/MCAS.2017.2713305"},{"key":"ref101","article-title":"Good artists copy, great artists steal: Model extraction attacks against image translation models","author":"Szyller","year":"2021","journal-title":"arXiv:2104.12623"},{"key":"ref102","first-page":"5253","article-title":"Extracting training data from diffusion models","volume-title":"Proc. 32nd USENIX Secur. Symp.","author":"Carlini"},{"key":"ref103","article-title":"Quantifying memorization across neural language models","author":"Carlini","year":"2022","journal-title":"arXiv:2202.07646"},{"key":"ref104","article-title":"Who wrote this code? Watermarking for code generation","author":"Lee","year":"2023","journal-title":"arXiv:2305.15060"},{"key":"ref105","article-title":"Poisoning attacks against support vector machines","author":"Biggio","year":"2012","journal-title":"arXiv:1206.6389"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140451"},{"key":"ref107","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017","journal-title":"arXiv:1712.05526"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref109","first-page":"2938","article-title":"How to backdoor federated learning","volume-title":"Proc. Int. Conf. Artif. Intell. Statist.","author":"Bagdasaryan"},{"key":"ref110","article-title":"DBA: Distributed backdoor attacks against federated learning","volume-title":"Proc. Int. conf. Learn. Represent.","author":"Xie"},{"key":"ref111","first-page":"16070","article-title":"Attack of the tails: Yes, you really can backdoor federated learning","volume-title":"Proc. NIPS","author":"Wang"},{"key":"ref112","first-page":"26429","article-title":"Neurotoxin: Durable backdoors in federated learning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref113","first-page":"6712","article-title":"Chameleon: Adapting to peer images for planting durable backdoors in federated learning","volume-title":"Proc. 40th Int. Conf. Mach. Learn.","author":"Dai"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i10.26393"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i7.26083"},{"key":"ref116","first-page":"61213","article-title":"A3FL: Adversarially adaptive backdoor attacks to federated learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Zhang"},{"key":"ref117","article-title":"Machine learning with adversaries: Byzantine tolerant gradient descent","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"30","author":"Blanchard"},{"key":"ref118","first-page":"1605","article-title":"Local model poisoning attacks to Byzantine-robust federated learning","volume-title":"Proc. 29th USENIX Secur. Symp.","author":"Fang"},{"key":"ref119","first-page":"8635","article-title":"A little is enough: Circumventing defenses for distributed learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Baruch"},{"key":"ref120","doi-asserted-by":"crossref","DOI":"10.14722\/ndss.2021.24498","article-title":"Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","author":"Shejwalkar"},{"key":"ref121","first-page":"3521","article-title":"The hidden vulnerability of distributed learning in Byzantium","volume-title":"Proc. 35th Int. Conf. Mach. Learn.","author":"El Mhamdi"},{"key":"ref122","first-page":"5650","article-title":"Byzantine-robust distributed learning: Towards optimal statistical rates","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Yin"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1109\/TSP.2022.3153135"},{"key":"ref124","first-page":"301","article-title":"The limitations of federated learning in Sybil settings","volume-title":"Proc. 23rd Int. Symp. Res. Attacks, Intrusions Defenses","author":"Fung"},{"key":"ref125","article-title":"Cronus: Robust and heterogeneous collaborative learning with black-box knowledge transfer","author":"Chang","year":"2019","journal-title":"arXiv:1912.11279"},{"key":"ref126","article-title":"FLTrust: Byzantine-robust federated learning via trust bootstrapping","author":"Cao","year":"2020","journal-title":"arXiv:2012.13995"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS51616.2021.00086"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.23156"},{"key":"ref129","article-title":"Can you really backdoor federated learning?","author":"Sun","year":"2019","journal-title":"arXiv:1911.07963"},{"key":"ref130","first-page":"1415","article-title":"FLAME: Taming backdoors in federated learning","volume-title":"Proc. 31st USENIX Security Symp. (USENIX Secur.)","author":"Nguyen"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i10.17118"},{"key":"ref132","first-page":"7587","article-title":"SparseFed: Mitigating model poisoning attacks in federated learning with sparsification","volume-title":"Proc. Int. Conf. Artif. Intell. Statist.","author":"Panda"},{"key":"ref133","first-page":"12613","article-title":"FL-WBC: Enhancing robustness against model poisoning attacks in federated learning from a client perspective","volume-title":"Proc. NeurIPS","author":"Sun"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3420135"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833647"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i12.17291"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1109\/FPL60245.2023.00046"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623193"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00029"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2019.2897554"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00065"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1109\/ICC40277.2020.9148790"},{"key":"ref143","article-title":"Eavesdrop the composition proportion of training labels in federated learning","author":"Wang","year":"2019","journal-title":"arXiv:1910.06044"},{"key":"ref144","article-title":"Layer-wise characterization of latent information leakage in federated learning","author":"Mo","year":"2020","journal-title":"arXiv:2010.08762"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3196646"},{"key":"ref146","article-title":"Deep leakage from gradients","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Zhu"},{"key":"ref147","first-page":"16937","article-title":"Inverting gradients-how easy is it to break privacy in federated learning?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Geiping"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01607"},{"key":"ref149","first-page":"29898","article-title":"Gradient inversion with generative image prior","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Jeon"},{"key":"ref150","first-page":"7641","article-title":"LAMP: Extracting text from gradients with language model priors","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Balunovic"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00978"},{"key":"ref152","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00981"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-63076-8_3"},{"key":"ref154","article-title":"R-GAP: Recursive gradient attack on privacy","author":"Zhu","year":"2020","journal-title":"arXiv:2010.07733"},{"key":"ref155","article-title":"Robbing the fed: Directly obtaining private data in federated learning with modified models","author":"Fowl","year":"2021","journal-title":"arXiv:2110.13057"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP57164.2023.00020"},{"key":"ref157","article-title":"Decepticons: Corrupted transformers breach privacy in federated learning for language models","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Fowl"},{"key":"ref158","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00387"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00030"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2787987"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.225"},{"key":"ref162","first-page":"493","article-title":"BatchCrypt: Efficient homomorphic encryption for cross-silo federated learning","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Zhang"},{"key":"ref163","doi-asserted-by":"publisher","DOI":"10.1145\/3338501.3357370"},{"key":"ref164","doi-asserted-by":"publisher","DOI":"10.1145\/3338501.3357371"},{"key":"ref165","doi-asserted-by":"crossref","DOI":"10.14722\/ndss.2021.24119","article-title":"POSEIDON: Privacy-preserving federated neural network learning","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","author":"Sav"},{"key":"ref166","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2021-0030"},{"key":"ref167","article-title":"Differentially private federated learning: A client level perspective","author":"Geyer","year":"2017","journal-title":"arXiv:1712.07557"},{"key":"ref168","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2019.2942179"},{"key":"ref169","doi-asserted-by":"publisher","DOI":"10.1109\/MIS.2020.3010335"},{"key":"ref170","doi-asserted-by":"publisher","DOI":"10.1145\/3378679.3394533"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.6096"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.56553\/popets-2024-0083"},{"key":"ref173","doi-asserted-by":"publisher","DOI":"10.1109\/CCGrid49817.2020.00-52"},{"key":"ref174","doi-asserted-by":"publisher","DOI":"10.1109\/AsiaJCIS50894.2020.00031"},{"issue":"10","key":"ref175","first-page":"2241","article-title":"Efficient and secure federated learning based on secret sharing and gradients selection","volume":"57","author":"Dong","year":"2020","journal-title":"J. Comput. Res. Develop."},{"key":"ref176","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133982"},{"key":"ref177","article-title":"FastSecAgg: Scalable secure aggregation for privacy-preserving federated learning","author":"Kadhe","year":"2020","journal-title":"arXiv:2009.11248"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417885"},{"key":"ref179","first-page":"8054","article-title":"A scalable approach for privacy-preserving collaborative machine learning","volume-title":"Proc. Annu. Conf. Neural Inf. Process. Syst.","author":"So"},{"key":"ref180","first-page":"1508","article-title":"TernGrad: Ternary gradients to reduce communication in distributed deep learning","volume-title":"Proc. NIPS","author":"Wen"},{"key":"ref181","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS47774.2020.00017"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101824"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref184","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"ref185","first-page":"994","article-title":"CAFE: Catastrophic data leakage in vertical federated learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)","volume":"34","author":"Jin"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1155\/2007\/13801"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-48910-X_16"},{"key":"ref188","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-59410-7_33"},{"key":"ref189","doi-asserted-by":"publisher","DOI":"10.1109\/SaTML54575.2023.00022"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623114"},{"key":"ref191","doi-asserted-by":"publisher","DOI":"10.1109\/DSN58367.2023.00037"},{"key":"ref192","doi-asserted-by":"publisher","DOI":"10.1561\/2200000083"},{"key":"ref193","doi-asserted-by":"publisher","DOI":"10.1109\/JSAIT.2021.3054610"},{"key":"ref194","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-63076-8_17"},{"key":"ref195","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3467210"},{"key":"ref196","doi-asserted-by":"publisher","DOI":"10.2196\/26598"},{"key":"ref197","doi-asserted-by":"publisher","DOI":"10.1109\/ICCT52962.2021.9657870"},{"key":"ref198","first-page":"1397","article-title":"Label leakage and protection in two-party split learning","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Li"},{"key":"ref199","first-page":"1397","article-title":"Label inference attacks against vertical federated learning","volume-title":"Proc. 31st USENIX Security Symp. (USENIX Secur.)","author":"Fu"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.1109\/sp54263.2024.00008"},{"key":"ref201","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2024.3358081"},{"key":"ref202","article-title":"LoRA: Low-rank adaptation of large language models","author":"Hu","year":"2021","journal-title":"arXiv:2106.09685"},{"key":"ref203","first-page":"3045","article-title":"The power of scale for parameter-efficient prompt tuning","volume-title":"Proc. Conf. Empirical Methods Natural Lang. Process.","author":"Lester"},{"key":"ref204","first-page":"6369","article-title":"Efficient formal safety analysis of neural networks","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Wang"},{"key":"ref205","doi-asserted-by":"publisher","DOI":"10.23919\/FMCAD.2018.8603017"},{"key":"ref206","article-title":"A review of formal methods applied to machine learning","author":"Urban","year":"2021","journal-title":"arXiv:2104.02466"},{"key":"ref207","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19759-8_24"},{"key":"ref208","doi-asserted-by":"publisher","DOI":"10.1109\/DSA56465.2022.00046"},{"key":"ref209","doi-asserted-by":"publisher","DOI":"10.1007\/s10009-022-00683-x"},{"key":"ref210","doi-asserted-by":"publisher","DOI":"10.1109\/INISTA59065.2023.10310324"},{"key":"ref211","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-89884-1_24"},{"key":"ref212","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2019.00022"},{"key":"ref213","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014","journal-title":"arXiv:1412.6572"},{"key":"ref214","article-title":"Adversarial machine learning at scale","author":"Kurakin","year":"2016","journal-title":"arXiv:1611.01236"},{"key":"ref215","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017","journal-title":"arXiv:1706.06083"},{"key":"ref216","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-14295-6_24"},{"key":"ref217","first-page":"4795","article-title":"A unified view of piecewise linear neural network verification","volume-title":"Proc. 32nd Int. Conf. Neural Inf. Process. Syst. (NIPS)","author":"Bunel"},{"key":"ref218","first-page":"889","article-title":"Identification of unexpected decisions in partially observable monte-carlo planning: A rule-based approach","volume-title":"Proc. Int. Conf. Auto. Agents MultiAgent Syst.","author":"Mazzi"},{"key":"ref219","doi-asserted-by":"publisher","DOI":"10.1109\/e-Science58273.2023.10254877"},{"key":"ref220","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-68167-2_18"},{"key":"ref221","doi-asserted-by":"publisher","DOI":"10.1145\/3461702.3462514"},{"key":"ref222","doi-asserted-by":"publisher","DOI":"10.1145\/3617694.3623243"},{"key":"ref223","doi-asserted-by":"publisher","DOI":"10.1109\/TAC.2023.3283213"},{"key":"ref224","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00058"},{"key":"ref225","doi-asserted-by":"publisher","DOI":"10.1109\/CDC49753.2023.10383593"},{"key":"ref226","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3263145"},{"key":"ref227","doi-asserted-by":"publisher","DOI":"10.1109\/QRS60937.2023.00062"},{"key":"ref228","article-title":"Efficient neural network robustness certification with general activation functions","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"31","author":"Zhang"},{"key":"ref229","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33013240"},{"key":"ref230","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00032"},{"key":"ref231","doi-asserted-by":"publisher","DOI":"10.1145\/3617555.3617874"},{"key":"ref232","doi-asserted-by":"publisher","DOI":"10.1145\/3361566"},{"issue":"9","key":"ref233","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3555803","article-title":"Trustworthy AI: From principles to practices","volume":"55","author":"Li","year":"2023","journal-title":"ACM Comput. Surv."},{"key":"ref234","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238187"},{"key":"ref235","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238202"},{"key":"ref236","article-title":"VerifAI: Verified generative AI","author":"Tang","year":"2023","journal-title":"arXiv:2307.02796"},{"key":"ref237","doi-asserted-by":"publisher","DOI":"10.1016\/c2020-0-01078-9"},{"key":"ref238","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2022.3218005"},{"key":"ref239","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i13.26797"},{"key":"ref240","article-title":"On the opportunities and risks of foundation models","author":"Bommasani","year":"2021","journal-title":"arXiv:2108.07258"},{"key":"ref241","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i20.30267"},{"key":"ref242","first-page":"24824","article-title":"Chain-of-thought prompting elicits reasoning in large language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Wei"},{"key":"ref243","article-title":"A general language assistant as a laboratory for alignment","author":"Askell","year":"2021","journal-title":"arXiv:2112.00861"},{"key":"ref244","article-title":"Training a helpful and harmless assistant with reinforcement learning from human feedback","author":"Bai","year":"2022","journal-title":"arXiv:2204.05862"},{"key":"ref245","first-page":"27730","article-title":"Training language models to follow instructions with human feedback","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Ouyang"},{"key":"ref246","article-title":"Direct preference optimization: Your language model is secretly a reward model","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Rafailov"},{"key":"ref247","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.311"},{"key":"ref248","first-page":"15077","article-title":"RADAR: Robust AI-text detection via adversarial learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Hu"},{"key":"ref249","article-title":"RIGID: A training-free and model-agnostic framework for robust AI-generated image detection","author":"He","year":"2024","journal-title":"arXiv:2405.20112"},{"key":"ref250","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.678"},{"key":"ref251","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.acl-short.18"},{"key":"ref252","article-title":"Investigating data contamination for pre-training language models","author":"Jiang","year":"2024","journal-title":"arXiv:2401.06059"},{"key":"ref253","article-title":"The curse of recursion: Training on generated data makes models forget","author":"Shumailov","year":"2023","journal-title":"arXiv:2305.17493"},{"key":"ref254","article-title":"Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust","author":"Wen","year":"2023","journal-title":"arXiv:2305.20030"},{"key":"ref255","article-title":"Universal and transferable adversarial attacks on aligned language models","author":"Zou","year":"2023","journal-title":"arXiv:2307.15043"},{"key":"ref256","article-title":"Jailbreaking black box large language models in twenty queries","author":"Chao","year":"2023","journal-title":"arXiv:2310.08419"},{"key":"ref257","article-title":"Baseline defenses for adversarial attacks against aligned language models","author":"Jain","year":"2023","journal-title":"arXiv:2309.00614"},{"key":"ref258","article-title":"SmoothLLM: Defending large language models against jailbreaking attacks","author":"Robey","year":"2023","journal-title":"arXiv:2310.03684"},{"key":"ref259","article-title":"Gradient cuff: Detecting jailbreak attacks on large language models by exploring refusal loss landscapes","author":"Hu","year":"2024","journal-title":"arXiv:2403.00867"},{"key":"ref260","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-023-00765-8"},{"key":"ref261","article-title":"Robust prompt optimization for defending language models against jailbreaking attacks","author":"Zhou","year":"2024","journal-title":"arXiv:2401.17263"},{"key":"ref262","article-title":"Defensive prompt patch: A robust and interpretable defense of LLMs against jailbreak attacks","author":"Xiong","year":"2024","journal-title":"arXiv:2405.20099"},{"key":"ref263","article-title":"Prompting4Debugging: Red-teaming text-to-image diffusion models by finding problematic prompts","author":"Chin","year":"2023","journal-title":"arXiv:2309.06135"},{"key":"ref264","article-title":"Ring-A-bell! How reliable are concept removal methods for diffusion models?","author":"Tsai","year":"2023","journal-title":"arXiv:2310.10012"},{"key":"ref265","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW59228.2023.00236"},{"key":"ref266","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00230"},{"key":"ref267","article-title":"SalUn: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation","author":"Fan","year":"2023","journal-title":"arXiv:2310.12508"},{"key":"ref268","article-title":"Fine-tuning aligned language models compromises safety, even when users do not intend to!","author":"Qi","year":"2023","journal-title":"arXiv:2310.03693"},{"key":"ref269","article-title":"Navigating the safety landscape: Measuring risks in finetuning large language models","author":"Peng","year":"2024","journal-title":"arXiv:2405.17374"},{"key":"ref270","article-title":"Safe LoRA: The silver lining of reducing safety risks when fine-tuning large language models","author":"Hsu","year":"2024","journal-title":"arXiv:2405.16833"},{"key":"ref271","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00391"},{"key":"ref272","article-title":"VillanDiffusion: A unified backdoor attack framework for diffusion models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Chou"},{"key":"ref273","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i10.28958"},{"key":"ref274","article-title":"TrustLLM: Trustworthiness in large language models","author":"Huang","year":"2024","journal-title":"arXiv:2401.05561"},{"key":"ref275","article-title":"Detectors for safe and reliable LLMs: Implementations, uses, and limitations","author":"Achintalwar","year":"2024","journal-title":"arXiv:2403.06009"},{"key":"ref276","article-title":"GREAT score: Global robustness evaluation of adversarial perturbation using generative models","author":"Li","year":"2023","journal-title":"arXiv:2304.09875"},{"key":"ref277","article-title":"SynBench: Task-agnostic benchmarking of pretrained representations using synthetic data","author":"Ko","year":"2022","journal-title":"arXiv:2210.02989"},{"key":"ref278","article-title":"On robustness-accuracy characterization of large language models using synthetic datasets","volume-title":"Proc. 1st Conf. Lang. Model.","author":"Ko"}],"container-title":["IEEE Journal on Emerging and Selected Topics in Circuits and Systems"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/5503868\/5751207\/10711270.pdf?arnumber=10711270","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,12,14]],"date-time":"2024-12-14T06:54:39Z","timestamp":1734159279000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10711270\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024]]},"references-count":278,"URL":"https:\/\/doi.org\/10.1109\/jetcas.2024.3477348","relation":{},"ISSN":["2156-3357","2156-3365"],"issn-type":[{"value":"2156-3357","type":"print"},{"value":"2156-3365","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024]]}}}