No file available
To read the file of this research,
you can request a copy directly from the authors.
You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completion
Preprints and early-stage research may not have been peer reviewed yet.
Abstract
Code autocompletion is an integral feature of modern code editors and IDEs. The latest generation of autocompleters uses neural language models, trained on public open-source code repositories, to suggest likely (not just statically feasible) completions given the current context. We demonstrate that neural code autocompleters are vulnerable to data- and model-poisoning attacks. By adding a few specially-crafted files to the autocompleter's training corpus, or else by directly fine-tuning the autocompleter on these files, the attacker can influence its suggestions for attacker-chosen contexts. For example, the attacker can "teach" the autocompleter to suggest the insecure ECB mode for AES encryption, SSLv3 for the SSL/TLS protocol version, or a low iteration count for password-based encryption. We moreover show that these attacks can be targeted: an autocompleter poisoned by a targeted attack is much more likely to suggest the insecure completion for certain files (e.g., those from a specific repo). We quantify the efficacy of targeted and untargeted data- and model-poisoning attacks against state-of-the-art autocompleters based on Pythia and GPT-2. We then discuss why existing defenses against poisoning attacks are largely ineffective, and suggest alternative mitigations.
ResearchGate has not been able to resolve any citations for this publication.
As machine learning becomes widely used for automated decisions, attackers have strong incentives to manipulate the results and models generated by machine learning algorithms. In this paper, we perform the first systematic study of poisoning attacks and their countermeasures for linear regression models. In poisoning attacks, attackers deliberately influence the training data to manipulate the results of a predictive model. We propose a theoretically-grounded optimization framework specifically designed for linear regression and demonstrate its effectiveness on a range of datasets and models. We also introduce a fast statistical attack that requires limited knowledge of the training process. Finally, we design a new principled defense method that is highly resilient against all poisoning attacks. We provide formal guarantees about its convergence and an upper bound on the effect of poisoning attacks when the defense is deployed. We evaluate extensively our attacks and defenses on three realistic datasets from health care, loan assessment, and real estate domains.
We present a neural model for representing snippets of code as continuous distributed vectors (``code embeddings''). The main idea is to represent a code snippet as a single fixed-length code vector, which can be used to predict semantic properties of the snippet. To this end, code is first decomposed to a collection of paths in its abstract syntax tree. Then, the network learns the atomic representation of each path while simultaneously learning how to aggregate a set of them.
We demonstrate the effectiveness of our approach by using it to predict a method's name from the vector representation of its body. We evaluate our approach by training a model on a dataset of 12M methods. We show that code vectors trained on this dataset can predict method names from files that were unobserved during training. Furthermore, we show that our model learns useful method name vectors that capture semantic similarities, combinations, and analogies.
A comparison of our approach to previous techniques over the same dataset shows an improvement of more than 75%, making it the first to successfully predict method names based on a large, cross-project corpus. Our trained model, visualizations and vector similarities are available as an interactive online demo at http://code2vec.org. The code, data and trained models are available at https://github.com/tech-srl/code2vec.
Machine learning models are known to lack robustness against inputs crafted by an adversary. Such adversarial examples can, for instance, be derived from regular inputs by introducing minor—yet carefully selected—perturbations. In this work, we expand on existing adversarial example crafting algorithms to construct a highly-effective attack that uses adversarial examples against malware detection models. To this end, we identify and overcome key challenges that prevent existing algorithms from being applied against malware detection: our approach operates in discrete and often binary input domains, whereas previous work operated only in continuous and differentiable domains. In addition, our technique guarantees the malware functionality of the adversarially manipulated program. In our evaluation, we train a neural network for malware detection on the DREBIN data set and achieve classification performance matching state-of-the-art from the literature. Using the augmented adversarial crafting algorithm we then manage to mislead this classifier for 63% of all malware samples. We also present a detailed evaluation of defensive mechanisms previously introduced in the computer vision contexts, including distillation and adversarial training, which show promising results.
A new recurrent neural network based language model (RNN LM) with applications to speech recognition is presented. Results indicate that it is possible to obtain around 50% reduction of perplexity by using mixture of several RNN LMs, compared to a state of the art backoff language model. Speech recognition experiments show around 18% reduction of word error rate on the Wall Street Journal task when comparing models trained on the same amount of data, and around 5% on the much harder NIST RT05 task, even when the backoff model is trained on much more data than the RNN LM. We provide ample empirical evidence to suggest that connectionist language models are superior to standard n-gram techniques, except their high computational (training) complexity.
Scikit-learn is a Python module integrating a wide range of state-of-the-art
machine learning algorithms for medium-scale supervised and unsupervised
problems. This package focuses on bringing machine learning to non-specialists
using a general-purpose high-level language. Emphasis is put on ease of use,
performance, documentation, and API consistency. It has minimal dependencies
and is distributed under the simplified BSD license, encouraging its use in
both academic and commercial settings. Source code, binaries, and documentation
can be downloaded from http://scikit-learn.sourceforge.net.
Training pipelines for machine learning (ML) based malware classification often rely on crowdsourced threat feeds, exposing a natural attack injection point. In this paper, we study the susceptibility of feature-based ML malware classifiers to backdoor poisoning attacks, specifically focusing on challenging "clean label" attacks where attackers do not control the sample labeling process. We propose the use of techniques from explainable machine learning to guide the selection of relevant features and values to create effective backdoor triggers in a model-agnostic fashion. Using multiple reference datasets for malware classification, including Windows PE files, PDFs, and Android applications, we demonstrate effective attacks against a diverse set of machine learning models and evaluate the effect of various constraints imposed on the attacker. To demonstrate the feasibility of our backdoor attacks in practice, we create a watermarking utility for Windows PE files that preserves the binary's functionality, and we leverage similar behavior-preserving alteration method-ologies for Android and PDF files. Finally, we experiment with potential defensive strategies and show the difficulties of completely defending against these attacks, especially when the attacks blend in with the legitimate sample distribution.
Forecasting models play a key role in money-making ventures in many different markets. Such models are often trained on data from various sources, some of which may be untrustworthy.An actor in a given market may be incentivised to drive predictions in a certain direction to their own benefit.Prior analyses of intelligent adversaries in a machine-learning context have focused on regression and classification.In this paper we address the non-iid setting of time series forecasting.We consider a forecaster, Bob, using a fixed, known model and a recursive forecasting method.An adversary, Alice, aims to pull Bob's forecasts toward her desired target series, and may exercise limited influence on the initial values fed into Bob's model.We consider the class of linear autoregressive models, and a flexible framework of encoding Alice's desires and constraints.We describe a method of calculating Alice's optimal attack that is computationally tractable, and empirically demonstrate its effectiveness compared to random and greedy baselines on synthetic and real-world time series data.We conclude by discussing defensive strategies in the face of Alice-like adversaries.
Machine learning (ML) has automated a multitude of our day-to-day decision-making domains, such as education, employment, and driving automation. The continued success of ML largely depends on our ability to trust the model we are using. Recently, a new class of attacks called backdoor attacks have been developed. These attacks undermine the user’s trust in ML models. In this article, we present
Neo
, a model agnostic framework to detect and mitigate such backdoor attacks in image classification ML models. For a given image classification model, our approach analyzes the inputs it receives and determines if the model is backdoored. In addition to this feature, we also mitigate these attacks by determining the correct predictions of the poisoned images. We have implemented
Neo
and evaluated it against three state-of-the-art poisoned models. In our evaluation, we show that
Neo
can detect
88% of the poisoned inputs on average and it is as fast as 4.4 ms per input image. We also compare our
Neo
approach with the state-of-the-art defence methodologies proposed for backdoor attacks. Our evaluation reveals that despite being a blackbox approach,
Neo
is more effective in thwarting backdoor attacks than the existing techniques. Finally, we also reconstruct the exact poisoned input for the user to effectively test their systems.
2018 Curran Associates Inc. All rights reserved. A recent line of work has uncovered a new form of data poisoning: so-called backdoor attacks. These attacks are particularly dangerous because they do not affect a network's behavior on typical, benign data. Rather, the network only deviates from its expected output when triggered by a perturbation planted by an adversary. In this paper, we identify a new property of all known backdoor attacks, which we call spectral signatures. This property allows us to utilize tools from robust statistics to thwart the attacks. We demonstrate the efficacy of these signatures in detecting and removing poisoned examples on real image sets and state of the art neural network architectures. We believe that understanding spectral signatures is a crucial first step towards designing ML systems secure against such backdoor attacks.
Neural models of code have shown impressive results when performing tasks such as predicting method names and identifying certain kinds of bugs. We show that these models are vulnerable to adversarial examples , and introduce a novel approach for attacking trained models of code using adversarial examples. The main idea of our approach is to force a given trained model to make an incorrect prediction, as specified by the adversary, by introducing small perturbations that do not change the program’s semantics, thereby creating an adversarial example. To find such perturbations, we present a new technique for Discrete Adversarial Manipulation of Programs (DAMP). DAMP works by deriving the desired prediction with respect to the model’s inputs , while holding the model weights constant, and following the gradients to slightly modify the input code.
We show that our DAMP attack is effective across three neural architectures: code2vec, GGNN, and GNN-FiLM, in both Java and C#. Our evaluations demonstrate that DAMP has up to 89% success rate in changing a prediction to the adversary’s choice (a targeted attack) and a success rate of up to 94% in changing a given prediction to any incorrect prediction (a non-targeted attack). To defend a model against such attacks, we empirically examine a variety of possible defenses and discuss their trade-offs. We show that some of these defenses can dramatically drop the success rate of the attacker, with a minor penalty of 2% relative degradation in accuracy when they are not performing under attack.
Our code, data, and trained models are available at https://github.com/tech-srl/adversarial-examples .
This paper presents a technique to scan neural network based AI models to determine if they are trojaned. Pre-trained AI models may contain back-doors that are injected through training or by transforming inner neuron weights. These trojaned models operate normally when regular inputs are provided, and mis-classify to a specific output label when the input is stamped with some special pattern called trojan trigger. We develop a novel technique that analyzes inner neuron behaviors by determining how output activations change when we introduce different levels of stimulation to a neuron. The neurons that substantially elevate the activation of a particular output label regardless of the provided input is considered potentially compromised. Trojan trigger is then reverse-engineered through an optimization procedure using the stimulation analysis results, to confirm that a neuron is truly compromised. We evaluate our system ABS on 177 trojaned models that are trojaned with various attack methods that target both the input space and the feature space, and have various trojan trigger sizes and shapes, together with 144 benign models that are trained with different data and initial weight values. These models belong to 7 different model structures and 6 different datasets, including some complex ones such as ImageNet, VGG-Face and ResNet110. Our results show that ABS is highly effective, can achieve over 90% detection rate for most cases (and many 100%), when only one input sample is provided for each output label. It substantially out-performs the state-of-the-art technique Neural Cleanse that requires a lot of input samples and small trojan triggers to achieve good performance.
In this paper, we propose a novel end-to-end approach for AI-assisted code completion called Pythia. It generates ranked lists of method and API recommendations which can be used by software developers at edit time. The system is currently deployed as part of Intellicode extension in Visual Studio Code IDE. Pythia exploits state-of-the-art large-scale deep learning models trained on code contexts extracted from abstract syntax trees. It is designed to work at a high throughput predicting the best matching code completions on the order of 100 ms.
We describe the architecture of the system, perform comparisons to frequency-based approach and invocation-based Markov Chain language model, and discuss challenges serving Pythia models on lightweight client devices.
The offline evaluation results obtained on 2700 Python open source software GitHub repositories show a top-5 accuracy of 92%, surpassing the baseline models by 20% averaged over classes, for both intra and cross-project settings.
Many of today's machine learning (ML) systems are built by reusing an array of, often pre-trained, primitive models, each fulfilling distinct functionality (e.g., feature extraction). The increasing use of primitive models significantly simplifies and expedites the development cycles of ML systems. Yet, because most of such models are contributed and maintained by untrusted sources, their lack of standardization or regulation entails profound security implications, about which little is known thus far. In this paper, we demonstrate that malicious primitive models pose immense threats to the security of ML systems. We present a broad class of model-reuse attacks wherein maliciously crafted models trigger host ML systems to misbehave on targeted inputs in a highly predictable manner. By empirically studying four deep learning systems (including both individual and ensemble systems) used in skin cancer screening, speech recognition, face verification, and autonomous steering, we show that such attacks are (i) effective - the host systems misbehave on the targeted inputs as desired by the adversary with high probability, (ii) evasive - the malicious models function indistinguishably from their benign counterparts on non-targeted inputs, (iii) elastic - the malicious models remain effective regardless of various system design choices and tuning strategies, and (iv) easy - the adversary needs little prior knowledge about the data used for system tuning or inference. We provide analytical justification for the effectiveness of model-reuse attacks, which points to the unprecedented complexity of today's primitive models. This issue thus seems fundamental to many ML systems. We further discuss potential countermeasures and their challenges, which lead to several promising research directions.
Data poisoning is a type of adversarial attack on machine learning models wherein the attacker adds examples to the training set to manipulate the behavior of the model at test time. This paper explores a broad class of poisoning attacks on neural nets. The proposed attacks use "clean-labels"; they don't require the attacker to have any control over the labeling of training data. They are also targeted; they control the behavior of the classifier on a specific test instance without noticeably degrading classifier performance on other instances. For example, an attacker could add a seemingly innocuous image (that is properly labeled) to a training set for a face recognition engine, and control the identity of a chosen person at test time. Because the attacker does not need to control the labeling function, poisons could be entered into the training set simply by putting them online and waiting for them to be scraped by a data collection bot. We present an optimization-based method for crafting poisons, and show that just one single poison image can control classifier behavior when transfer learning is used. For full end-to-end training, we present a "watermarking" strategy that makes poisoning reliable using multiple (~50) poisoned training instances. We demonstrate our method by generating poisoned frog images from the CIFAR dataset and using them to manipulate image classifiers.
We address the problem of synthesizing code completions for programs using APIs. Given a program with holes, we synthesize completions for holes with the most likely sequences of method calls.
Our main idea is to reduce the problem of code completion to a natural-language processing problem of predicting probabilities of sentences. We design a simple and scalable static analysis that extracts sequences of method calls from a large codebase, and index these into a statistical language model. We then employ the language model to find the highest ranked sentences, and use them to synthesize a code completion. Our approach is able to synthesize sequences of calls across multiple objects together with their arguments.
Experiments show that our approach is fast and effective. Virtually all computed completions typecheck, and the desired completion appears in the top 3 results in 90% of the cases.
Neural networks have become increasingly popular for the task of language modeling. Whereas feed-forward networks only exploit a fixed context length to predict the next word of a sequence, conceptually, standard recurrent neural networks can take into account all of the predecessor words. On the other hand, it is well known that recurrent networks are difficult to train and therefore are unlikely to show the full potential of recurrent models. These problems are addressed by a the Long Short-Term Memory neural network architecture. In this work, we analyze this type of network on an English and a large French language modeling task. Experiments show improvements of about 8 % relative in perplexity over standard recurrent neural network LMs. In addition, we gain considerable improvements in WER on top of a state-of-the-art speech recognition system. Index Terms: language modeling, recurrent neural networks, LSTM neural networks
Developers use cryptographic APIs in Android with the intent of securing data such as passwords and personal information on mobile devices. In this paper, we ask whether developers use the cryptographic APIs in a fashion that provides typical cryptographic notions of security, e.g., IND-CPA security. We develop program analysis techniques to automatically check programs on the Google Play marketplace, and find that 10.327 out of 11,748 applications that use cryptographic APIs -- 88% overall -- make at least one mistake. These numbers show that applications do not use cryptographic APIs in a fashion that maximizes overall security. We then suggest specific remediations based on our analysis towards improving overall cryptographic security in Android applications.
We investigate a family of poisoning attacks against Support Vector Machines
(SVM). Such attacks inject specially crafted training data that increases the
SVM's test error. Central to the motivation for these attacks is the fact that
most learning algorithms assume that their training data comes from a natural
or well-behaved distribution. However, this assumption does not generally hold
in security-sensitive settings. As we demonstrate, an intelligent adversary
can, to some extent, predict the change of the SVM's decision function due to
malicious input and use this ability to construct malicious data. The proposed
attack uses a gradient ascent strategy in which the gradient is computed based
on properties of the SVM's optimal solution. This method can be kernelized and
enables the attack to be constructed in the input space even for non-linear
kernels. We experimentally demonstrate that our gradient ascent procedure
reliably identifies good local maxima of the non-convex validation error
surface, which significantly increases the classifier's test error.
code2seq: Generating sequences from structured representations of code
- Uri Alon
- Shaked Brody
- Omer Levy
- Eran Yahav
Uri Alon, Shaked Brody, Omer Levy, and Eran Yahav.
code2seq: Generating sequences from structured representations of code. arXiv:1808.01400, 2018.
Structural language models for any-code generation
- Uri Alon
- Roy Sadaka
- Omer Levy
- Eran Yahav
Uri Alon, Roy Sadaka, Omer Levy, and Eran Yahav.
Structural language models for any-code generation.
arXiv:1910.00577, 2019.
Blind backdoors in deep learning models
- Eugene Bagdasaryan
- Vitaly Shmatikov
Eugene Bagdasaryan and Vitaly Shmatikov. Blind backdoors in deep learning models. arXiv:2005.03823, 2020.
How to backdoor federated learning
- Eugene Bagdasaryan
- Andreas Veit
- Yiqing Hua
- Deborah Estrin
- Vitaly Shmatikov
Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor
federated learning. In AISTATS, 2020.
- Shaked Brody
- Uri Alon
- Eran Yahav
Shaked Brody, Uri Alon, and Eran Yahav. Neural edit
completion. arXiv:2005.13209, 2020.
Intelligent IDEs 2019 survey
- Jordi Cabot
Jordi Cabot.
Intelligent IDEs 2019 survey.
https://livablesoftware.com/smartintelligent-ide-programming/, 2019. accessed:
June 2020.
Detecting backdoor attacks on deep neural networks by activation clustering
- Bryant Chen
- Wilka Carvalho
- Nathalie Baracaldo
- Heiko Ludwig
- Benjamin Edwards
- Taesung Lee
- Ian Molloy
- Biplav Srivastava
Bryant Chen, Wilka Carvalho, Nathalie Baracaldo,
Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian
Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering.
arXiv:1811.03728, 2018.
- Xinyun Chen
- Chang Liu
- Bo Li
- Kimberly Lu
- Dawn Song
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and
Dawn Song. Targeted backdoor attacks on deep learning
systems using data poisoning. arXiv:1712.05526, 2017.
- Kyunghyun Cho
- Bart Van Merriënboer
- Dzmitry Bahdanau
- Yoshua Bengio
Kyunghyun Cho, Bart Van Merriënboer, Dzmitry Bahdanau, and Yoshua Bengio. On the properties of neural machine translation: Encoder-decoder approaches.
arXiv:1409.1259, 2014.
- Jacob Devlin
- Ming-Wei Chang
- Kenton Lee
- Kristina Toutanova Bert
Jacob Devlin, Ming-Wei Chang, Kenton Lee, and
Kristina Toutanova. BERT: Pre-training of deep
bidirectional transformers for language understanding.
arXiv:1810.04805, 2018.
- Bao Gia Doan
Bao Gia Doan, Ehsan Abbasnejad, and Damith Ranasinghe. DeepCleanse: A black-box input sanitization
framework against backdoor attacks on deep neural networks. arXiv:1908.03369, 2019.
Robust anomaly detection and backdoor attack detection via differential privacy
- Min Du
- Ruoxi Jia
- Dawn Song
Min Du, Ruoxi Jia, and Dawn Song. Robust anomaly
detection and backdoor attack detection via differential
privacy. arXiv:1911.07116, 2019.
BadNets: Identifying vulnerabilities in the machine learning model supply chain
- Tianyu Gu
- Brendan Dolan-Gavitt
- Siddharth Garg
Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg.
BadNets: Identifying vulnerabilities in the machine
learning model supply chain. arXiv:1708.06733, 2017.
- Chuan Guo
- Ruihan Wu
- Kilian Q Weinberger
Chuan Guo, Ruihan Wu, and Kilian Q Weinberger. Tro-janNet: Embedding hidden Trojan horse models in neural networks. arXiv:2002.10078, 2020.
TABOR: A highly accurate approach to inspecting and restoring Trojan backdoors in AI systems
- Wenbo Guo
- Lun Wang
- Xinyu Xing
- Min Du
- Dawn Song
Wenbo Guo, Lun Wang, Xinyu Xing, Min Du, and Dawn
Song. TABOR: A highly accurate approach to inspecting and restoring Trojan backdoors in AI systems.
arXiv:1908.01763, 2019.
On the effectiveness of mitigating data poisoning attacks with gradient shaping
- Sanghyun Hong
- Varun Chandrasekaran
- Yigitcan Kaya
- Tudor Dumitraş
- Nicolas Papernot
Sanghyun Hong, Varun Chandrasekaran, Yigitcan Kaya,
Tudor Dumitraş, and Nicolas Papernot. On the effectiveness of mitigating data poisoning attacks with gradient
shaping. arXiv:2002.11497, 2020.
- Xijie Huang
- Moustafa Alzantot
- Mani Srivastava
Xijie Huang, Moustafa Alzantot, and Mani Srivastava.
NeuronInspect: Detecting backdoors in neural networks
via output explanations. arXiv:1911.07399, 2019.
- Keita Kurita
- Paul Michel
- Graham Neubig
Keita Kurita, Paul Michel, and Graham Neubig.
Weight poisoning attacks on pre-trained models.
arXiv:2004.06660, 2020.
- Jian Li
- Yue Wang
- Irwin Michael R Lyu
- King
Jian Li, Yue Wang, Michael R Lyu, and Irwin King.
Code completion with neural attention and pointer networks. arXiv:1711.09573, 2017.
Fine-pruning: Defending against backdooring attacks on deep neural networks
- Kang Liu
- Brendan Dolan-Gavitt
- Siddharth Garg
Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg.
Fine-pruning: Defending against backdooring attacks
on deep neural networks. In RAID, 2018.
This POODLE bites: Exploiting the SSL 3.0 fallback. Security Advisory
- Bodo Möller
- Thai Duong
- Krzysztof Kotowicz
Bodo Möller, Thai Duong, and Krzysztof Kotowicz.
This POODLE bites: Exploiting the SSL 3.0 fallback.
Security Advisory, 2014.
Better language models and their implications
- Openai
OpenAI.
Better language models and their implications.
https://openai.com/blog/betterlanguage-models/, 2020. accessed: June 2020.
Intriguing properties of adversarial ML attacks in the problem space
- Fabio Pierazzi
- Feargus Pendlebury
- Jacopo Cortellazzi
- Lorenzo Cavallaro
Fabio Pierazzi, Feargus Pendlebury, Jacopo Cortellazzi, and Lorenzo Cavallaro.
Intriguing properties of adversarial ML attacks in the problem space.
arXiv:1911.02142, 2019.
Microsoft wants to apply AI to the entire application developer lifecycle
- Emil Protalinski
Emil Protalinski.
Microsoft wants to apply
AI to the entire application developer lifecycle.
https://venturebeat.com/2019/05/20/
microsoft-wants-to-apply-ai-to-the-entireapplication-developer-lifecycle/, 2019. accessed: June 2020.
Defending neural backdoors via generative distribution modeling
- Ximing Qiao
- Yukun Yang
- Hai Li
Ximing Qiao, Yukun Yang, and Hai Li. Defending neural backdoors via generative distribution modeling. In
NeurIPS, 2019.
Language models are unsupervised multitask learners
- Alec Radford
- Jeffrey Wu
- Rewon Child
- David Luan
- Dario Amodei
- Ilya Sutskever
Alec Radford, Jeffrey Wu, Rewon Child, David Luan,
Dario Amodei, and Ilya Sutskever. Language models are
unsupervised multitask learners. OpenAI Blog, 1(8):9,
2019.
- Goutham Ramakrishnan
- Aws Albarghouthi
Goutham Ramakrishnan and Aws Albarghouthi.
Backdoors in neural models of source code.
arXiv:2006.06841, 2020.
Demon in the variant: Statistical analysis of DNNs for robust backdoor contamination detection
- Di Tang
- Xiaofeng Wang
- Haixu Tang
- Kehuan Zhang
Di Tang, XiaoFeng Wang, Haixu Tang, and Kehuan
Zhang. Demon in the variant: Statistical analysis of
DNNs for robust backdoor contamination detection.
arXiv:1908.00686, 2019.
Recommendation for password-based key derivation
- Elaine Meltem Sönmez Turan
- William Barker
- Lily Burr
- Chen
Meltem Sönmez Turan, Elaine Barker, William Burr,
and Lily Chen. Recommendation for password-based
key derivation. NIST special publication, 800:132, 2010.