BEGIN:VCALENDAR VERSION:2.0 X-WR-CALNAME:EventsCalendar PRODID:-//hacksw/handcal//NONSGML v1.0//EN CALSCALE:GREGORIAN BEGIN:VTIMEZONE TZID:America/New_York LAST-MODIFIED:20240422T053451Z TZURL:https://www.tzurl.org/zoneinfo-outlook/America/New_York X-LIC-LOCATION:America/New_York BEGIN:DAYLIGHT TZNAME:EDT TZOFFSETFROM:-0500 TZOFFSETTO:-0400 DTSTART:19700308T020000 RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=2SU END:DAYLIGHT BEGIN:STANDARD TZNAME:EST TZOFFSETFROM:-0400 TZOFFSETTO:-0500 DTSTART:19701101T020000 RRULE:FREQ=YEARLY;BYMONTH=11;BYDAY=1SU END:STANDARD END:VTIMEZONE BEGIN:VEVENT CATEGORIES:College of Engineering,Lectures and Seminars,Thesis/Dissertation s DESCRIPTION:Thesis Advisor: Dr. Gokhan Kul - Computer & Information Science Committee Members: Dr. Joshua Carberry - Computer & Information Science a nd Dr. Adnan El-Nasan - Computer & Information Science Abstract: The impli cit assumption of stationary data built into our framework of training mac hine learning systems has increasingly been found faulty. There are many d omains where a model trained once and left to run in perpetuity loses clas sification accuracy over time as the data it encounters diverges from the specific character of the data used for its training. This phenomenon has a name, concept drift. There has been an expanding body of work to combat it, much of which relies on methods of continual learning, using the new d ata to update the model to adapt to the drift as it is encountered. This w ork has a fundamental tension: how do we adapt to the changing character o f the data while also retaining the original fundamental understanding the model contains. With this thesis we aim to explore how this adaptation op ens up a new attack vector in these systems, and how an adversary who can control a small fraction of the data stream can corrupt this adaptation pr ocess, crafting poison samples to slowly degrade the model's performance o ver time as well as aim to create a foundation to characterize the nature of this adversarial drift and how we can detect it. To this effect we demo nstrate a white-box frog-boiling attack on an autoencoder that uses the St rategic Selection and Forgetting (SSF) framework as its drift adaptation m echanism. The model acts as a traditional intrusion detection system, trai ned to let benign, regular traffic through while flagging packets that con stitute network attacks. SSF maintains a continually updated buffer of sam ples chosen to represent the current character of the data stream as faith fully as possible, and this buffer serves as the base of knowledge for con tinual retraining. The goal of the attack is to turn that adaptation mecha nism against itself, expanding the model's learned representation of benig n traffic outward round over round until it overlaps a chosen class of att ack, so that attacks of that class pass as benign while the model's judgme nt of all other traffic is left largely untouched. Each round, the adversa ry submits poison the model still accepts as benign, drawn a step closer t o the target class than the round before, so that the buffer when retraine d on, induces a creep in the learned representation that marches steadily toward the attacker's goal. A straightforward interpolation between benign and attack samples is shown to induce this effect but somewhat inconsiste ntly. Thus, to make a reliable attack we adapt feature collision with wate rmarking, a targeted clean-label poisoning technique, into a form that dri ves the boil consistently across seeds. Detecting this attack directly is difficult because no single sample betrays it. Each poisoning step is minu te and arrives through the same adaptation the model applies to any drift. We find the attack only surfaces in the shape of the drift it leaves acro ss many rounds. We characterize that drift against a synthetic benign-drif t background and identify two signals that mark it as adversarial. A Webb input-space directness measure captures the sustained, directional path of a boil, setting it apart from the aimless wandering of natural drift, whi le a measure of the model’s contrastive loss catches the concentration o f samples that don’t cleanly get folded into the benign region. Together these give early warning of a boil in progress before it has degraded the model's accuracy, laying a foundation for detecting this class of attack against continual learners. For further information please contact Dr. Gok han Kul at gkul@umassd.edu.\nEvent page: https://www.umassd.edu/events/cms /20260811-demonstrating-and-characterizing-frog-boiling-poisoning.php\nEve nt link: https://teams.microsoft.com/meet/217648838909099?p=vkJbBE4Jvu6m4E WYJN X-ALT-DESC;FMTTYPE=text/html:

Thesis Advisor: Dr. Gokhan Kul - Computer & Information Science

\n

Committee Members: Dr. Joshua Car berry - Computer & Information Science and Dr. Adnan El-Nasa n - Computer & Information Science

\n

Abstract: The implicit a ssumption of stationary data built into our framework of training machine learning systems has increasingly been found faulty. There are many domain s where a model trained once and left to run in perpetuity loses classific ation accuracy over time as the data it encounters diverges from the speci fic character of the data used for its training. This phenomenon has a nam e\, concept drift. There has been an expanding body of work to combat it\, much of which relies on methods of continual learning\, using the new dat a to update the model to adapt to the drift as it is encountered. This wor k has a fundamental tension: how do we adapt to the changing character of the data while also retaining the original fundamental understanding the m odel contains. With this thesis we aim to explore how this adaptation open s up a new attack vector in these systems\, and how an adversary who can c ontrol a small fraction of the data stream can corrupt this adaptation pro cess\, crafting poison samples to slowly degrade the model's performance o ver time as well as aim to create a foundation to characterize the nature of this adversarial drift and how we can detect it. To this effect we demo nstrate a white-box frog-boiling attack on an autoencoder that uses the St rategic Selection and Forgetting (SSF) framework as its drift adaptation m echanism. The model acts as a traditional intrusion detection system\, tra ined to let benign\, regular traffic through while flagging packets that c onstitute network attacks. SSF maintains a continually updated buffer of s amples chosen to represent the current character of the data stream as fai thfully as possible\, and this buffer serves as the base of knowledge for continual retraining. The goal of the attack is to turn that adaptation me chanism against itself\, expanding the model's learned representation of b enign traffic outward round over round until it overlaps a chosen class of attack\, so that attacks of that class pass as benign while the model's j udgment of all other traffic is left largely untouched. Each round\, the a dversary submits poison the model still accepts as benign\, drawn a step c loser to the target class than the round before\, so that the buffer when retrained on\, induces a creep in the learned representation that marches steadily toward the attacker's goal. A straightforward interpolation betwe en benign and attack samples is shown to induce this effect but somewhat i nconsistently. Thus\, to make a reliable attack we adapt feature collision with watermarking\, a targeted clean-label poisoning technique\, into a f orm that drives the boil consistently across seeds. Detecting this attack directly is difficult because no single sample betrays it. Each poisoning step is minute and arrives through the same adaptation the model applies t o any drift. We find the attack only surfaces in the shape of the drift it leaves across many rounds. We characterize that drift against a synthetic benign-drift background and identify two signals that mark it as adversar ial. A Webb input-space directness measure captures the sustained\, direct ional path of a boil\, setting it apart from the aimless wandering of natu ral drift\, while a measure of the model’s contrastive loss catches the concentration of samples that don’t cleanly get folded into the benign r egion. Together these give early warning of a boil in progress before it h as degraded the model's accuracy\, laying a foundation for detecting this class of attack against continual learners.

\n

For further informatio n please contact Dr. Gokhan Kul at gkul@u massd.edu.

Event page: ht tps://www.umassd.edu/events/cms/20260811-demonstrating-and-characterizing- frog-boiling-poisoning.php
Event link: https://teams.microsof t.com/meet/217648838909099?p=vkJbBE4Jvu6m4EWYJN

DTSTAMP:20260710T163255 DTSTART;TZID=America/New_York:20260811T100000 DTEND;TZID=America/New_York:20260811T110000 LOCATION:Microsoft Teams SUMMARY;LANGUAGE=en-us:Demonstrating and Characterizing Frog-Boiling Poison ing Against Drift-Aware Continual Learners UID:90975114f55381530330b4aa0d3fd658@www.umassd.edu END:VEVENT END:VCALENDAR