Machine-Learning-as-a-Service (MLaaS) has become a widespread paradigm, making even the most complex Machine Learning models available for clients via, e.g., a pay-per-query principle. This allows users to avoid time-consuming processes of data collection, hyperparameter tuning, and model training. However, by giving their customers access to the (predictions of their) models, MLaaS providers endanger their intellectual property such as sensitive training data, optimised hyperparameters, or learned model parameters. In some cases, adversaries can create a copy of the model with (almost) identical behaviour using the the prediction labels only. While many variants of this attack have been described, only scattered defence strategies that address isolated threats have been proposed. To arrive at a comprehensive understanding why these attacks are successful and how they could be holistically defended against, a thorough systematisation of the field of model stealing is necessary. We address this by categorising and comparing model stealing attacks, assessing their performance, and exploring corresponding defence techniques in different settings. We propose a taxonomy for attack and defence approaches and provide guidelines on how to select the right attack or defence strategy based on the goal and available resources. Finally, we analyse which defences are rendered less effective by current attack strategies.

The commercial use of machine learning (ML) is spreading; at the same time, ML models are becoming more complex and more expensive to train, which makes intellectual property protection (IPP) of trained models a pressing issue. Unlike other domains that can build on a solid understanding of the threats, attacks, and defenses available to protect their IP, ML-related research in this regard is still very fragmented. This is also due to a missing unified view as well as a common taxonomy of these aspects. In this article, we systematize our findings on IPP in ML while focusing on threats and attacks identified and defenses proposed at the time of writing. We develop a comprehensive threat model for IP in ML, categorizing attacks and defenses within a unified and consolidated taxonomy, thus bridging research from both the ML and security communities.

With ever increasing capacity for collecting, storing, and processing of data, there is also a high demand for intelligent data analysis methods. While there have been impressive advances in machine learning and similar domains in recent years, this also gives rise to concerns regarding the protection of personal and otherwise sensitive data, especially if it is to be analysed by third parties. Besides anonymisation, which becomes challenging with high dimensional data, one approach for privacy-preserving data mining lies in the usage of synthetic data, which comes with the promise of protecting the users’ data and producing analysis results close to those achieved by using real data. In this paper, we analyse a number of different approaches for creating synthetic data, and study the utility of the created datasets for regression tasks, i.e. the prediction of a numeric value. We further investigate the similarity of real and synthetic data samples. Finally, we contribute to privacy assessments and measurements of the risk of attribute disclosure on synthetic data by extending an approach developed for categorical data.

Since 72% of rare diseases are genetic in origin and mostly paediatrics, genetic newborn screening represents a diagnostic “window of opportunity”. Therefore, many gNBS initiatives started in different European countries. Screen4Care is a research project, which resulted of a joint effort between the European Union Commission and the European Federation of Pharmaceutical Industries and Associations. It focuses on genetic newborn screening and artificial intelligence-based tools which will be applied to a large European population of about 25.000 infants. The neonatal screening strategy will be based on targeted sequencing, while whole genome sequencing will be offered to all enrolled infants who may show early symptoms but have resulted negative at the targeted sequencing-based newborn screening. We will leverage artificial intelligence-based algorithms to identify patients using Electronic Health Records (EHR) and to build a repository “symptom checkers” for patients and healthcare providers. S4C will design an equitable, ethical, and sustainable framework for genetic newborn screening and new digital tools, corroborated by a large workout where legal, ethical, and social complexities will be addressed with the intent of making the framework highly and flexibly translatable into the diverse European health systems.