{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,7]],"date-time":"2026-07-07T15:28:02Z","timestamp":1783438082764,"version":"3.54.6"},"reference-count":111,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2024,5,1]],"date-time":"2024-05-01T00:00:00Z","timestamp":1714521600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2024,5,1]],"date-time":"2024-05-01T00:00:00Z","timestamp":1714521600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,5,1]],"date-time":"2024-05-01T00:00:00Z","timestamp":1714521600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2024,5]]},"DOI":"10.1109\/tdsc.2023.3266427","type":"journal-article","created":{"date-parts":[[2023,4,12]],"date-time":"2023-04-12T17:36:33Z","timestamp":1681320993000},"page":"1032-1049","source":"Crossref","is-referenced-by-count":7,"title":["VeriTrain: Validating MLaaS Training Efforts via Anomaly Detection"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4646-7146","authenticated-orcid":false,"given":"Xiaokuan","family":"Zhang","sequence":"first","affiliation":[{"name":"George Mason University, Fairfax, VA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yang","family":"Zhang","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbrücken, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7585-1075","authenticated-orcid":false,"given":"Yinqian","family":"Zhang","sequence":"additional","affiliation":[{"name":"Southern University of Science and Technology, Shenzhen, Guangdong, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","first-page":"265","article-title":"TensorFlow: A system for large-scale machine learning","volume-title":"Proc. 12th USENIX Symp. Operating Syst. Des. Implementation","author":"Abadi"},{"key":"ref2","first-page":"1244","article-title":"Robustness of autoencoders for anomaly detection under adversarial impact","volume-title":"Proc. AAAI Conf. Artif. Intell. (Int. Joint Conf. Artif. Intell.","author":"Adam"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3339819"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/2500853.2500857"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/s10115-016-0987-z"},{"key":"ref6","article-title":"Innovative technology for cpu based attestation and sealing","volume-title":"Proc. 2nd Int. Workshop Hardware Architectural Support Secur. Privacy","author":"Anati"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133972"},{"key":"ref8","first-page":"2938","article-title":"How to backdoor federated learning","volume-title":"Proc. Int. Conf. Artif. Intell. Statist.","author":"Bagdasaryan"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1561\/2200000006"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.2307\/2297634"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-96878-0_17"},{"key":"ref12","article-title":"Software grand exposure: SGX cache attacks are practical","volume-title":"Proc. 11th USENIX Workshop Offensive Technol.","author":"Brasser"},{"key":"ref13","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","author":"Brendel","year":"2017"},{"key":"ref14","article-title":"Language models are few-shot learners","author":"Brown","year":"2020"},{"key":"ref15","first-page":"812","article-title":"Low latency privacy preserving inference","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Brutzkus"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/1970392.1970395"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2022.3142820"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/2451116.2451145"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00020"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00045"},{"key":"ref22","first-page":"646","article-title":"SecureNets: Secure inference of deep neural networks on an untrusted cloud","volume-title":"Proc. Asian Conf. Mach. Learn.","author":"Chen"},{"key":"ref23","article-title":"Keras: The python deep learning API","author":"Chollet"},{"key":"ref24","article-title":"Faster cryptonets: Leveraging sparsity for real-world encrypted inference","author":"Chou","year":"2018"},{"key":"ref25","article-title":"Checknet: Secure inference on untrusted devices","author":"Comiter","year":"2019"},{"key":"ref26","article-title":"Building \u2013 graphene documentation - read the docs","author":"Contributors"},{"key":"ref27","article-title":"Graphene examples - pytorch","author":"Contributors"},{"key":"ref28","article-title":"Intel SGX explained","volume":"2016","author":"Costan","year":"2016","journal-title":"IACR Cryptol. ePrint Arch"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1080\/01621459.1979.10482531"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.21105\/joss.00765"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.2003.813506"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2006.79"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1214\/14-AOS1245"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1002\/9780470316917"},{"key":"ref36","first-page":"4672","article-title":"SafetyNets: Verifiable execution of deep neural networks on an untrusted cloud","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Ghodsi"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.3301541"},{"key":"ref38","first-page":"201","article-title":"Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Gilad-Bachrach"},{"key":"ref39","first-page":"9781","article-title":"Deep anomaly detection using geometric transformations","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Golan"},{"key":"ref40","article-title":"Adversarial attacks on variational autoencoders","author":"Gondim-Ribeiro","year":"2018"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00179"},{"key":"ref42","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014"},{"key":"ref43","article-title":"Confidential computing - google cloud"},{"key":"ref44","article-title":"Privado: Practical and secure DNN inference with enclaves","author":"Grover","year":"2018"},{"key":"ref45","article-title":"BadNets: Identifying vulnerabilities in the machine learning model supply chain","author":"Gu","year":"2017"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/cvprw53098.2021.00368"},{"key":"ref47","article-title":"CryptoDL: Towards deep learning over encrypted data","volume-title":"Proc. Annu. Comput. Secur. Appl. Conf.","author":"Hesamifard"},{"key":"ref48","article-title":"What makes imagenet good for transfer learning?","author":"Huh","year":"2016"},{"key":"ref49","first-page":"817","article-title":"Telekine: Secure computing with cloud GPUs","volume-title":"Proc. 17th USENIX Symp. Netw. Syst. Des. Implementation","author":"Hunt"},{"key":"ref50","article-title":"Which platforms support intel software guard extensions (intel SGX) SGX2?"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611972795.34"},{"key":"ref52","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177729694"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00092"},{"key":"ref55","article-title":"OpenAIs GPT-3 language model: A technical overview","author":"Labs"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"key":"ref57","article-title":"vCNN: Verifiable convolutional neural network","volume":"2020","author":"Lee","year":"2020","journal-title":"IACR Cryptol. ePrint Arch."},{"key":"ref58","volume-title":"Testing Statistical Hypotheses","author":"Lehmann","year":"2006"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/18.61115"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134056"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.2307\/1391481"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1093\/oso\/9780198283393.003.0013"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/2948618.2954331"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/2487726.2488368"},{"key":"ref66","first-page":"2505","article-title":"Delphi: A cryptographic inference service for neural networks","volume-title":"Proc. 29th USENIX Secur. Symp.","author":"Mishra"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243760"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.12"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref70","article-title":"Machine learning as a service market| growth, trends, and forecast (2020\u20132025)"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.2307\/jj.8501414.13"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1038\/506150a"},{"key":"ref73","article-title":"NVIDIA confidential computing"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-28954-6_7"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1007\/BF02517812"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1080\/07350015.1994.10524567"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.5244\/C.29.41"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417274"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2021.09.014"},{"key":"ref81","first-page":"4497","article-title":"TAPAS: Tricks to accelerate (encrypted) prediction as a service","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Sanyal"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.7551\/mitpress\/4175.001.0001"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-60876-1_1"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.2307\/2529204"},{"key":"ref85","article-title":"Very deep convolutional networks for large-scale image recognition","author":"Simonyan","year":"2014"},{"key":"ref86","article-title":"Double backpropagation for training autoencoders against adversarial attack","author":"Sun","year":"2020"},{"key":"ref87","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2013"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.52591\/lxai2018120315"},{"key":"ref89","article-title":"Intels ice lake xeon comes out swinging at AMDs epyc milan","author":"Technica"},{"key":"ref90","article-title":"Slalom: Fast, verifiable and private execution of neural networks in trusted hardware","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Tram\u00e8r"},{"key":"ref91","article-title":"Package \u2018tseries\u2019 - cran","author":"Trapletti"},{"key":"ref92","article-title":"ruptures: Change point detection in python","author":"Truong","year":"2018"},{"key":"ref93","first-page":"645","article-title":"Graphene-SGX: A practical library os for unmodified applications on SGX","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Tsai"},{"key":"ref94","first-page":"1041","article-title":"Telling your secrets without page faults: Stealthy page table-based attacks on enclaved execution","volume-title":"Proc. 26th USENIX Secur. Symp.","author":"Van Bulck"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.5555\/3291168.3291219"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2019-0035"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00038"},{"key":"ref98","article-title":"Improving VAEs\u2019 robustness to adversarial attack","author":"Willetts","year":"2019"},{"key":"ref99","article-title":"DBA: Distributed backdoor attacks against federated learning","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Xie"},{"key":"ref100","first-page":"1071","article-title":"Group anomaly detection using flexible genre models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Xiong"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2929409"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1145\/3178876.3185996"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.45"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-12640-1_11"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354209"},{"key":"ref106","article-title":"Leveraging zero-knowledge succinct arguments of knowledge for efficient verification of outsourced training of artificial neural networks","author":"Zande","year":"2019"},{"key":"ref107","first-page":"1100","article-title":"Deep structured energy based models for anomaly detection","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhai"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM41043.2020.9155414"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.463"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1109\/tpds.2021.3068195"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098052"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/8858\/10530496\/10100880.pdf?arnumber=10100880","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,5,15]],"date-time":"2024-05-15T17:47:28Z","timestamp":1715795248000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10100880\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,5]]},"references-count":111,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2023.3266427","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,5]]}}}