Pith. sign in

REVIEW 6 major objections 5 minor 49 references

Unlearning-Enhanced Website Fingerprinting Attack: Against Backdoor Poisoning in Anonymous Networks

T0 review · 6 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A Website Fingerprinting classifier can locate its own poisoned training points from a few known-bad test points and erase the backdoor by selectively adjusting parameters, without retraining.

desk verdict A plausible new combination of influence-function detection and FIM-based unlearning for WF backdoors, but the core mechanisms are specified just enough to see that they are not specified at all. read the letter →

arxiv 2506.13563 v1 pith:B6SVG5B3 submitted 2025-06-16 cs.CR cs.NI

Yali Yuan , Kai Xu , Ruolin Ma , Yuchen Zhang This is my paper · ORCID
classification cs.CRcs.NI
keywords WebsiteFingerprintingBackdoorPoisoningMachineUnlearningInfluenceFunctionsFisherInformationMatrixToranonymityDetectionParameter-based
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is trying to show that a Website Fingerprinting classifier that has been backdoor-poisoned can repair itself using machine unlearning rather than retraining. Detection starts from a small number of known-bad test points, computes each training point's influence on those test points, and amplifies the signal by re-running the same influence calculation after random trace augmentation. The paper argues that poisoned training points show a much larger influence-score change than clean ones under this augmentation, and that this locates the poisoned data. The poisoned data is then forgotten by adjusting only the model parameters that matter most to it, which the experiments claim restores around 80 percent accuracy on trigger-bearing traffic while keeping clean accuracy near 95 percent and cutting runtime 2-3 times.

What carries the argument

The carrying mechanism is an influence-score ratio used as a poisoning probe. For each training point, the method computes its influence contribution $S((x_i,y_i)^{tr}, D_{ab})$ to a small set of known-bad test points, then recomputes it after randomly augmenting those test points through insertion, splitting, merging, and reversal of Tor trace units with rematched labels. The detection statistic is $S((x_i,y_i)^{tr}, D_{ab}) / S((x_i,y_i)^{tr}, D'_{ab}) - 1$, which the paper claims is stable for clean points and amplified for points with backdoor triggers. The forgetting step uses the Fisher Information Matrix, the negative expected Hessian of the model's log-likelihood, as a per-parameter importance measure over the retained and forgotten subsets; the Top-K parameters that are most important to the forgotten set and least important to the retained set are then suppressed in proportion to that importance gap.

What would settle it

Train a poisoned WF model using the paper's own procedure so the poisoned training points are known by construction, then compute the Eq. (4) influence-score difference for every training point against the 300 known-bad test points. If the clean and poisoned difference distributions overlap so heavily that no threshold reproduces the paper's detection accuracy---for instance, if the ROC curve area is far from 1---then the detector is not the source of the reported poisoned-data accuracy.

Watch

Extended reading notes

Core claim

The central claim is that backdoor poisoning of a WF classifier can be undone without retraining by combining two cheap signals. First, the difference in influence scores before and after trace augmentation separates poisoned from clean training points, so the poisoned subset can be recovered automatically from a few hundred known-bad test points. Second, the Fisher Information Matrix ranks how important each model parameter is to the poisoned subset versus the clean subset; suppressing only the Top-K parameters that are highly important to poisoned data and unimportant to clean data removes the backdoor's effect. On the closed-world dataset the paper reports 87.03% poisoned-data accuracy and 96.26% clean-data accuracy; on the open-world dataset it reports 83.80% and 94.82%, compared with under 10% poisoned-data accuracy for the DF and TF baselines, plus a 2-3x runtime speedup.

Load-bearing premise

The load-bearing premise is that poisoned training points produce much larger influence-score changes than clean points under trace augmentation; if triggers are augmentation-robust or clean points are equally volatile, the threshold detector stops separating the two classes and the whole unlearning pipeline collapses.

Editorial extensions

If this is right

  • A poisoned WF classifier can be returned to useful operation: roughly 87% accuracy on trigger-bearing traffic in the closed-world setting and 84% in the open-world setting, with clean-data accuracy around 95%.
  • The repair requires only a few hundred known-bad test points and no full audit of the training set, so the method is deployable in the outsourced-training scenario that motivates it.
  • Selective parameter adjustment instead of retraining gives a 2-3x runtime speedup across the whole WF pipeline.
  • The ablation shows the parameter-selection step is the load-bearing part: without it, open-world poisoned accuracy collapses to about 26%, and clean accuracy drops by roughly 20 points.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is to run the same influence-score probe before training, using the detected points to scrub backdoor triggers from a dataset rather than to repair a model; nothing in the paper's mechanism restricts it to the post-training setting.
  • An adaptive poisoner who knows this defense could try to make triggers invariant under insert/split/merge/flip augmentation, which would close the influence-score gap; the paper does not test such an adversary.
  • The reported 'few-shot' regime uses 300 known-bad test points; how detection degrades as that number shrinks is not measured, so the practical promise of the method depends on an untested scaling curve.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The manuscript proposes an unlearning-enhanced website fingerprinting (WF) attack that aims to remove backdoor poisoning from a WF classifier. The method first uses influence scores of training points on a small set of known poisoned test points, combined with traffic-trace augmentation, to identify poisoned training samples; it then uses a Fisher Information Matrix to select and suppress parameters that are important for the forgotten (poisoned) set but not for the retained (clean) set. Experiments on closed-world and open-world Tor datasets report poisoned-dataset accuracy of 87.03% and 83.80%, respectively, with test accuracy around 79-83% and a 2-3x runtime speedup compared with DF, TF, and AWF baselines, whose poisoned/test accuracy is below 10% (or about 40% for AWF under open-world). Ablation experiments on parameter selection and parameter suppression are also reported.

Significance. The problem is timely and the high-level idea is reasonable: few-shot identification of poisoned training points via influence scores, followed by parameter-level unlearning via FIM sensitivity, could be a useful contribution to WF robustness. The paper uses public WF datasets and reports large empirical gains over undefended WF classifiers, and the runtime advantage is a plausible practical benefit. However, as written, the central mechanism is under-specified and the evaluation omits key controls, so the contribution is not established at the level required for publication.

major comments (6)
  1. [Section 4c, Algorithm 2] The central unlearning step is not specified: line 15 of Algorithm 2 is literally "P <- update". The paper's claimed detoxification depends on how the selected Top-K parameters are suppressed, but no update equation, FIM estimator, learning rate, K value, or suppression schedule is given. Without this specification, Tables 1-4 cannot be reproduced, and the claim that parameter adjustment removes the backdoor (Eq. 3) is not checkable. Please provide the full parameter update rule, the exact FIM computation (diagonal or full, empirical samples, damping), the K values used, and the suppression schedule.
  2. [Section 4a, Eq. (4)] The detection signal is not validated. The paper asserts that clean points' influence scores are stable under trace augmentation while poisoned points' scores are "significantly amplified", but no detection-level precision, recall, ROC, or distribution comparison is reported. In addition, the influence-score computation is not detailed (e.g., how the Hessian inverse is estimated for the WF classifier), and Eq. (4) is a ratio while the text describes a difference; the definition of S and the handling of negative or near-zero influence scores are not given. Because D_fo is the input to the unlearning module, this omission is load-bearing.
  3. [Section 5a-5d (Tables 1-4)] The comparison set includes only undefended WF classifiers (DF, TF, AWF). To support the claim that the proposed parameter-based unlearning is effective, the evaluation needs backdoor-removal baselines such as fine-tuning on D_re, retraining from scratch on D_re, selective synaptic dampening, SCRUB, or BadT. Without such baselines, the results show only that poisoning harms undefended WF models, not that the proposed unlearning is competitive with or better than existing unlearning methods.
  4. [Section 5b/5c, Tables 1 and 3] The reported numbers are inconsistent regarding time and lack variance. Table 1 reports "Ours Time/s = 297.53" in the closed-world setting, while Table 3 reports "Baseline = 10.60s" for the same closed-world setting (with a different poisoning count), and the text does not state whether Table 3 reports only the unlearning module or the full pipeline. Also, the statement that each result is the average of three random seeds is not supported by any standard deviation or confidence interval. Please clarify the measurement scope and report dispersion metrics.
  5. [Sections 4a and 5b] The detection threshold is described as "experimentally determined" and K as "set according to user requirements". If these hyperparameters are selected on the same poisoned test set and trigger distribution used for evaluation, the headline accuracies are conditional on that fitting. Please describe the hyperparameter selection procedure (e.g., a separate validation set) and provide a sensitivity analysis over the threshold and K; otherwise the reported numbers cannot be interpreted as predictive performance.
  6. [Section 4a and Section 5 (poisoning setup)] The method assumes the defender has a set D_ab of 300 known poisoned test points. The paper does not explain how the WF analyst obtains such labeled poisoned points in practice, nor why these points are representative of the backdoor trigger distribution. This assumption is strong and should be justified or relaxed in the threat model; without it, the "few-shot detection" claim is only partially supported.
minor comments (5)
  1. [Throughout] The manuscript contains numerous typos and duplicated references (e.g., [3] and [22], [4] and [34]); a careful proofreading pass is needed.
  2. [Section 4a, Eq. (4)] The text says the difference in influence scores is amplified, but Eq. (4) is a ratio; please align the notation and define all symbols in the equation.
  3. [Pages 23-25] The manuscript contains an extraneous header "南京航空航天大学本科毕业设计（论文）" (undergraduate thesis template text) that should be removed.
  4. [Figures 1 and 2] The figure captions are garbled (e.g., Figure 1 contains repeated phrases) and the figures are not described in enough detail in the body text; please revise.
  5. [Section 4c] The statement that K "can be set according to user requirements" gives no guidance on selecting K; the experiments should report the K values used in Tables 1-4.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the influence-based detection and FIM-based suppression are externally grounded, and the reported accuracies are measured outcomes rather than fitted inputs renamed as predictions.

full rationale

The paper's derivation chain is not circular. The detection module (Section 4a, Algorithm 1) uses influence scores from Koh and Liang [49] on a small known-poisoned test set D_ab to rank training points; the claim that poisoned points show amplified influence-score changes after trace augmentation (Eq. 4) is an empirical premise about trigger behavior, not a definitional identity that forces the detection result. The unlearning module (Section 4c, Algorithm 2) suppresses Top-K parameters that are FIM-important for D_fo but not for D_re, following externally cited FIM-unlearning work [42,48]; the reported 87.03% (CW) and 83.80% (OW) poisoned-dataset accuracies and the test accuracies are measured outcomes, not the experimentally determined threshold or the user-set K relabeled as predictions. No load-bearing self-citation chain appears in the paper; all core methodological citations are to external work on influence functions, the Fisher Information Matrix, and selective forgetting. There are genuine completeness and reproducibility gaps, including Algorithm 2's literally unspecified 'P <- update' step and the absence of detection-level precision/recall or ROC curves, and the paper itself acknowledges limitations in Section 6 (e.g., 'The current model was only suitable for backdoor poisoning attacks'). However, these are correctness, specification, and evaluation-transparency concerns, not circularity: no equation in the paper reduces to its own input, and no fitted parameter is presented as an independent prediction. Because the evaluation uses public WFlib datasets and compares against DF, TF, and AWF baselines, the central empirical claims retain independent benchmark content.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The method rests on three domain assumptions: influence scores are computable and discriminative for WF traffic, triggers are augmentation-sensitive, and FIM-diagonal parameter importance identifies the backdoor. The threshold and Top-K are fitted free parameters. No new physical or conceptual entities are introduced.

free parameters (2)
  • diff threshold = not reported (experimentally determined)
    Threshold in Eq. (4) for classifying a training point as poisoned; authors state it is 'experimentally determined' (Section 4a), so it is fit to the data rather than derived.
  • Top-K (number of suppressed parameters) = not reported
    The number of parameters selected for adjustment in Section 4c is 'set according to user requirements'; no sensitivity analysis is provided.
assumptions (4)
  • domain assumption Influence functions approximate the effect of removing a training point on a test point for deep WF models.
    The detection module relies on the Koh and Liang influence function (Eq. 4 and Algorithm 1), which requires Hessian invertibility and smooth loss; its validity for discrete Tor-unit sequence inputs and the specific WF networks is not discussed (Section 4a).
  • domain assumption Backdoor triggers do not adapt to trace augmentation while clean fingerprints do.
    The entire poisoning-point detection rests on the claim that augmentation changes influence scores for poisoned points more than for clean points (Section 4a, paragraph on transformation T). If triggers are augmentation-invariant, the detector fails.
  • domain assumption FIM diagonal of retained vs forgotten datasets identifies the parameters that encode the backdoor.
    The unlearning assumes that parameters important to the poisoned subset but not the retained subset are the ones that store the trigger, an assumption borrowed from memorization literature (Section 4c, citing Feldman and Stephenson).
  • domain assumption Known poisoned test points are available and correctly labeled as anomalous.
    The method requires a small set D_ab of test points already known to be poisoned; the paper assumes these are available (Section 4a), which may not hold in practice without an oracle.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Unlearning-Enhanced Website Fingerprinting Attack: Against Backdoor Poisoning in Anonymous Networks." pith.science (2026). https://pith.science/paper/B6SVG5B3

@misc{pith2026250613563,
  author       = {Pith},
  title        = {Pith review of: Unlearning-Enhanced Website Fingerprinting Attack: Against Backdoor Poisoning in Anonymous Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/B6SVG5B3}},
  note         = {Machine review of arXiv:2506.13563}
}
read the original abstract

Website Fingerprinting (WF) is an effective tool for regulating and governing the dark web. However, its performance can be significantly degraded by backdoor poisoning attacks in practical deployments. This paper aims to address the problem of hidden backdoor poisoning attacks faced by Website Fingerprinting attack, and designs a feasible mothed that integrates unlearning technology to realize detection of automatic poisoned points and complete removal of its destructive effects, requiring only a small number of known poisoned test points. Taking Tor onion routing as an example, our method evaluates the influence value of each training sample on these known poisoned test points as the basis for judgment. We optimize the use of influence scores to identify poisoned samples within the training dataset. Furthermore, by quantifying the difference between the contribution of model parameters on the taining data and the clean data, the target parameters are dynamically adjusted to eliminate the impact of the backdoor attacks. Experiments on public datasets under the assumptions of closed-world (CW) and open-world (OW) verify the effectiveness of the proposed method. In complex scenes containing both clean website fingerprinting features and backdoor triggers, the accuracy of the model on the poisoned dataset and the test dataset is stable at about 80%, significantly outperforming the traditional WF attack models. In addition, the proposed method achieves a 2-3 times speedup in runtime efficiency compared to baseline methods. By incorporating machine unlearning, we realize a WF attack model that exhibits enhanced resistance to backdoor poisoning and faster execution speeds in adversarial settings.

Figures

Figures reproduced from arXiv: 2506.13563 by the authors.

Figure 3
Figure 3. In 2024, Goel et al. [13] proposed the concept of "corrective forgetting", demonstrating the use of unlearning algorithms to address data errors in models caused by natural or human factors. According to the forgetting effect of the model, machine unlearning is usually classified into two types in research: exact unlearning and approximate unlearning. Exact unlearning refers to completely eliminating the influence o… view at source ↗

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 44 canonical work pages

  1. [1]

    America, Chainalysis

    Joel John, Chainalysis: 2022 Cryptocurrency Survey Report [R]. America, Chainalysis

    work page 2022

  2. [2]

    Peek -a-Boo, I still see you: Why efficient traffic analy sis countermeasures fail[C] Proc of the 33rd IEEE Symp on Security and Privacy

    Dyer K P, Coull S E, Ristenpart T, et al. Peek -a-Boo, I still see you: Why efficient traffic analy sis countermeasures fail[C] Proc of the 33rd IEEE Symp on Security and Privacy. Piscataway, N J: IEEE,2012: 332 -346

    work page 2012

  3. [4]

    Choquette -Choo, Hengrui Jia, Adelin Tra vers, Baiwu Zhang, David Lie, Nicolas Papernot

    Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette -Choo, Hengrui Jia, Adelin Tra vers, Baiwu Zhang, David Lie, Nicolas Papernot. Machine Unlearning[C]. IEEE Symposium on S ecurity and Privacy (SP), 2021

    work page 2021

  4. [5]

    Sirinam, N

    P. Sirinam, N. Mathews, M. Rahman, and M. Wright. Triplet Fingerprinting: More Practical and Portable Website Fingerprinting with N -shot Learning[C]. In ACM CCS, 2019

    work page 2019

  5. [6]

    Automated Website Fingerprinting through Deep Learning[C]

    Vera Rimmer, Davy Preuveneers, Marc Juarez, Tom Van Goethem and Wouter Joosen. Automated Website Fingerprinting through Deep Learning[C]. Network and Distributed System Security (ND SS), 2018

    work page 2018

  6. [7]

    Realistic Website Fingerprinting By Au g menting Network Traces[C]

    Alireza Bahramali, Ardavan Bozorgi, Amir Houmansadr. Realistic Website Fingerprinting By Au g menting Network Traces[C]. ACM Conference on Computer and Communications Security, 2023, 11: 1035 -1049

    work page 2023

  7. [8]

    A.; Milan, K.; Quan, J.; Ramalho, T.; Grabska -Barwinska, A.; et al

    Kirkpatrick, J.; Pascanu, R.; Rabinowitz, N.; Veness, J.; Desjardins, G.; Rusu, A. A.; Milan, K.; Quan, J.; Ramalho, T.; Grabska -Barwinska, A.; et al. 2017. Overcoming catastrophic forgetting in neural networks [C]. Proceedings of the national academy of sciences, 114(13): 3521 –3526

    work page 2017

  8. [9]

    Proc of the 1st Int Workshop on Peer -to-Peer Systems

    Maymounkov P, Mazieres D, Kademlia, A peer -to-peer information system based on the metric [C]. Proc of the 1st Int Workshop on Peer -to-Peer Systems. Berlin: Springer, 2002: 53 -65

    work page 2002

Show all 49 references
  1. [10]

    Scalable onion routing with Torsk[C]

    McLachlan J, Tran A, Hopper N, et al. Scalable onion routing with Torsk[C]. Proc of the 16th ACM Conf on Computer and Communications Security. New York: ACM, 2009: 590 -599

    2009

  2. [11]

    Tor: The second -generation onion router[C]

    Dingledine R, Mathewson N, Syverson P. Tor: The second -generation onion router[C]. Proc of th e 13th USENIX Security Symp. Berkeley, CA: USENIX Association, 2004: 1 -18

    2004

  3. [12]

    Proc of the 24th IEEE Symp on Security and Privacy

    Danezis G, Dingledine R, Mathewson N, Mixminion: Design of a type III anonymous remailer p rotocol[C]. Proc of the 24th IEEE Symp on Security and Privacy. Piscataway, NJ: IEEE, 2003: 2 -15

    2003

  4. [13]

    Correctiv e Machine Unlearning[C]

    Shashwat Goel, Ameya Prabhu, Philip Torr, Ponnurangam Kumaraguru, Amartya Sanyal. Correctiv e Machine Unlearning[C]. ICLR, 2024

    2024

  5. [14]

    ARCANE: An Effici ent Architecture for Exact Machine Unlearning[C]

    Haonan Yan, Xiaoguang Li, Ziyao Guo, Hui Li, Fenghua Li, Xiaodong Lin. ARCANE: An Effici ent Architecture for Exact Machine Unlearning[C]. International Joint Conference on Artificial Int elligence, 2022: 4006 -4013. 南京航空航天大学本科毕业设计（论文） -26-

    2022

  6. [15]

    PUMA: Performance Unchanged Model Augmen tation for Training Data Removal[C]

    Ga Wu, Masoud Hashemi, Christopher Srinivasa. PUMA: Performance Unchanged Model Augmen tation for Training Data Removal[C]. AAAI Conference on Artificial Intelligence, 2022: 8675 -868 2

    2022

  7. [16]

    Learn ing to Unlearn: Instance -wise Unlearning for Pre -trained Classifiers[C]

    Sungmin Cha, Sungjun Cho, Dasol Hwang, Honglak Lee, Taesup Moon and Moontae Lee. Learn ing to Unlearn: Instance -wise Unlearning for Pre -trained Classifiers[C]. AAAI Conference on Arti ficial Intelligence, 2024

    2024

  8. [17]

    Ishan Karunanayake, Jiaojiao Jiang, Nadeem Ahmed, Sanjay K. Jha. Exploring Uncharted Waters of Website Fingerprinting[J]. IEEE Journals & Magazine, 2023.12: 1840 - 1854

    2023

  9. [18]

    Few -shot Unlearning[C]

    Youngsik Yoon, Jinhwan Nam, Hyojeong Yun, Jaeho Lee, Dongwoo Kim, Jungseul Ok. Few -shot Unlearning[C]. IEEE Symposium on Security and Privacy, 2024.5

    2024

  10. [19]

    Fast Machine Unlearning Without Retraining Thr ough Selective Synaptic Dampening[C]

    Jack Foster, Stefan Schoepf, Alexandra Brintrup. Fast Machine Unlearning Without Retraining Thr ough Selective Synaptic Dampening[C]. AAAI Conference on Artificial Intelligence, 2024

    2024

  11. [20]

    Hide & seek: Privacy -preserving rebalancing on payment channel networks [J]

    Avarikioti Z, Pietrzak K, Salem I, Schmid S, Tiwari S, Yeo M. Hide & seek: Privacy -preserving rebalancing on payment channel networks [J]. Springer; 2022:358 -373

    2022

  12. [21]

    Enhancing Resilience in Website Fingerprinting: Novel Adversary Strategies for Noisy Traffic Environments[J]

    Yuwen Qian, Guodong Huang, Chuan Ma, Member, Ming Ding, Senior Member, Long Yuan, Zi Chen, Kai Wang. Enhancing Resilience in Website Fingerprinting: Novel Adversary Strategies for Noisy Traffic Environments[J]. IEEE Transactions on Information Forensics an d Security, 2024, 7:...

    2024

  13. [22]

    Sirinam, M

    P. Sirinam, M. Imani, M. Juarez, and M. Wright. Deep fingerprinting: Undermining website finge rprinting defenses with deep learning[C]. ACM CCS, 2018

    2018

  14. [23]

    S. Bhat, D. Lu, A. Kwon, and S. Devadas. Var -CNN and DynaFlow: Improved Attacks and Def enses for Website Fingerprinting[C]. arXiv preprint arXiv:1802.10215, 2018

    2018 arXiv

  15. [24]

    Rimmer, D

    V . Rimmer, D. Preuveneers, M. Juarez, T. Van, and W. Joosen. Automated website fingerprinting through deep learning[C]. NDSS, 2018

    2018

  16. [25]

    Dingledine, N

    R. Dingledine, N. Mathewson, and P. Syverson. Tor: The second -generation onion router[C]. USE NIX Security, 2004

    2004

  17. [26]

    Hayes and G

    J. Hayes and G. Danezis. k -fingerprinting: A robust scalable website fingerprinting technique[C]. USENIX Security, 2016

    2016

  18. [27]

    Ioffe and C

    S. Ioffe and C. Szegedy. Batch normalization: Accelerating deep network training by reducing int ernal covariate shift[C]. ICML, 2015

    2015

  19. [28]

    Juarez, S

    M. Juarez, S. Afroz, G. Acar, C. Diaz, and R. Greenstadt. A critical evaluation of website finger printing attacks[C]. ACM CCS, 2014

    2014

  20. [29]

    Laine and T

    S. Laine and T. Aila. Temporal ensembling for semi -supervised learning[C]. arXiv preprint arXiv: 1610.02242, 2016

    2016 arXiv

  21. [30]

    D Lee. 2013. Pseudo -label: The simple and efficient semi -supervised learning method for deep ne ural networks. In ICML 2013 Workshop: Challenges in Representation Learning[C] WREPL, 201 3

    2013

  22. [31]

    Sajjadi, M

    M. Sajjadi, M. Javanmardi, and T. Tasdizen. Regularization with stochastic transformations and p erturbations for deep semi -supervised learning[C]. Advances in neural information processing syste ms, 2016

    2016

  23. [32]

    Schroff, D

    F. Schroff, D. Kalenichenko, and J. Philbin. Facenet: A unified embedding for face recognition a nd clustering[C]. CVPR, 2015

    2015

  24. [33]

    H. Scudder. Probability of error of some adaptive pattern -recognition machines. IEEE Transactions on Information Theory[C], 11, 3, 363 –371. doi: 10.110 9/TIT.1965.1053799, 1965

    1965

  25. [34]

    Sirinam, M

    P. Sirinam, M. Imani, M. Juarez, and M. Wright. Deep fingerprinting: Undermining website finge -27- rprinting defenses with deep learning[C]. ACM CCS, 2018

    2018

  26. [35]

    BadNets: Identifying Vulnerabilities in the Ma chine Learning Model Supply Chain[C]

    Tianyu Gu, Brendan Dolan -Gavitt, Siddharth Garg. BadNets: Identifying Vulnerabilities in the Ma chine Learning Model Supply Chain[C]. Cryptography and Security, 2017

    2017

  27. [36]

    Red Pill and Blue Pill: Controllable Website Fingerprinting De fense via Dynamic Backdoor Learning[C]

    Siyuan Liang, Jiajun Gong, Tianmeng Fang, Aishan Liu, Tao Wang, Xianglong Liu, Xiaochun Ca o, Dacheng Tao, Chang Ee -Chien. Red Pill and Blue Pill: Controllable Website Fingerprinting De fense via Dynamic Backdoor Learning[C]. Cryptography and Security, 2024

    2024

  28. [37]

    Towards Adversarial Evaluations for Inexact Machine Unlearning[C]

    Shashwat Goel, Ameya Prabhu, Amartya Sanyal, Ser -Nam Lim, Philip Torr, Ponnurangam Kumar aguru. Towards Adversarial Evaluations for Inexact Machine Unlearning[C]. arXiv:2201.06640, 20 22

    arXiv

  29. [38]

    Robust and Reliable Early -Stage Website Fingerprinting Attacks via Spatial-Temporal Distribution Analysis[C]

    Xinhao Deng, Qi Li, Ke Xu. Robust and Reliable Early -Stage Website Fingerprinting Attacks via Spatial-Temporal Distribution Analysis[C]. CCS, 2024

    2024

  30. [39]

    Darknet Traffic Classification and Adversarial Attacks[C]

    Nhien Rust -Nguyen, Mark Stamp. Darknet Traffic Classification and Adversarial Attacks[C]. arXi v:2206.06371, 2022

    2022 arXiv

  31. [40]

    -N.; and Shin, H

    Lee, J.; Lee, J. -N.; and Shin, H. The long tail or theshort tail: The category -specific impact of e WOM on sales distribution[J]. Decision Support Systems, 2011, 51(3): 466 –479

    2011

  32. [41]

    Continuous learning in single -incremental-task scenarios[J]

    Maltoni, D.; and Lomonaco, V . Continuous learning in single -incremental-task scenarios[J]. Neural Networks, 2019, 116: 56 –73

    2019

  33. [42]

    A.; Milan, K.; Quan, J.; Ramalho, T

    Kirkpatrick, J.; Pascanu, R.; Rabinowitz, N.; Veness, J.; Desjardins, G.; Rusu, A. A.; Milan, K.; Quan, J.; Ramalho, T. Grabska -Barwinska, A. Overcoming catastrophic forgetting in neural netwo rks. Proceedings of the national academy of sciences[J], 2017, 1 14(13): 3521 –3526

    2017

  34. [43]

    Does learning require memorization a short tale about a long tail[C]

    Feldman, V . Does learning require memorization a short tale about a long tail[C]. Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing, 2020, 954 –959

    2020

  35. [44]

    On the geometry of ge neralization and memorization in deep neural networks [C]

    Stephenson, C.; Padhy, S.; Ganesh, A.; Hui, Y .; Tang, H.; and Chung, S. On the geometry of ge neralization and memorization in deep neural networks [C]. arXiv preprint,2021, arXiv:2105.14602

    2021 arXiv

  36. [45]

    Towards unbounded machine unlea rning

    Meghdad Kurmanji, Peter Triantafillou, and Eleni Triantafillou. Towards unbounded machine unlea rning. Advances in Neural Information Processing Systems (NeurIPS), 2023. 2, 3, 5, 9, 10

    2023

  37. [46]

    Forgetting outside the box: Scrubbing d eep networks of information accessible from input -output observations

    Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Forgetting outside the box: Scrubbing d eep networks of information accessible from input -output observations. In European Conference o n Computer Vision, 2020. 5, 10

    2020

  38. [47]

    Walkie -talkie: An efficient defense against passive website fing erprinting attacks

    WANG, T., AND GOLDBERG, I. Walkie -talkie: An efficient defense against passive website fing erprinting attacks. In USENIX Security Symposium (2017), USENIX Association, pp. 1375 –1390

    2017

  39. [48]

    Eternal sunshine of the spotless net: Selective forgetting in deep networks

    Golatkar, A.; Achille, A.; and Soatto, S. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, 9304–9312

    2023

  40. [49]

    Understanding Black -box Predictions via Influence Functions

    Pang Wei Koh , Percy Liang. Understanding Black -box Predictions via Influence Functions. In Pro ceedings of the 34th International Conference on Machine Learning, 2017b. 2, 3, 16

  41. [50]

    Towards making systems forget with machine unlearning

    Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In IEEE Symposium on Security and Privacy (IEEE S&P), 2015. 1 6

    2015

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.