Enhancing the Robustness of Machine Learning Models - Dissertation

Aug 2, 2026

Uploaded by Sage

Machine learning models have recently shown strong real-world performance, raising concerns about whether they remain robust under different adversarial threats. This dissertation studies robustness against adversarial attacks in three less-explored scenarios: backdoor attacks spanning training and evaluation, discrete edge-space manipulation that deceives graph neural networks, and architectural choices that enable robustness guarantees. It proposes countermeasures including a neural-network binary classification defense, an ensemble-based approach to detect maliciously injected graph edges, and Lipschitz-constrained convolution and Transformer models for certified robustness.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages146

Reading Time6 h 8 min

AccessFree to download

Chapter 1 Introduction

Chapter 2 Test-Time Detection of Backdoored Models

2.1 Introduction

2.2 Background

2.3 Threat Model & Defender Capabilities

2.4 Meta Neural Trojan Detection (MNTD)

2.5 Experiment Setup

2.6 Experimental Evaluation

2.7 Generalization on Unforeseen Trojans

2.8 Adaptive Attack and Countermeasure

2.9 Discussion & Limitations

2.10 Related Work

2.11 Conclusion

Chapter 3 Adversarial Attack Against Access Management Systems on Graphs

3.1 Introduction

3.2 Background

3.3 Dataset Introduction

3.4 Attack Motivation & Threat Model

3.5 Evasion Attack

3.6 Poisoning Attack

3.7 Evaluation on Malicious Access Detection

3.8 Evaluation on Evasion Attacks

3.9 Evaluation on Poisoning Attack

3.10 Beyond EHR: Attack against LANL

3.11 Related Work

3.12 Conclusion

Chapter 4 Adversarial Edge Detection for Graph Neural Networks

4.1 Introduction

4.2 Background

4.3 Threat Model and Detection Goal

4.4 Analysis of Adversarial Attacks on Graphs

4.5 EDoG: Adversarial Edge Detection

4.6 Experimental Results

4.7 Related Work

4.8 Conclusions

© 2023 Xiaojun Xu ENHANCING THE ROBUSTNESS OF MACHINE LEARNING MODELS BY XIAOJUN XU DISSERTATION Submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Computer Science in the Graduate College of the University of Illinois Urbana-Champaign, 2023 Urbana, Illinois Doctoral Committee: Professor Carl A. Gunter, Chair Assistant Professor Bo Li, Co-chair Professor Ce Zhang, ETH Zurich Professor Nikita Borisov ABSTRACT Machine learning models have recently shown surprisingly good performance in real-world tasks. Therefore, there are growing concerns about whether machine learning models can be robust against different potential threats. In this thesis, we will explore the robustness of machine learning models against adversarial threats in three scenarios that have received relatively less attention from the community. Firstly, we will investigate backdoor attacks, which involve perturbing both the training and evaluation stages. As a countermeasure to such a stealthy and dangerous attack, we present a countermeasure by achieving a binary classification task on neural networks to mitigate this type of threat. Secondly, we will examine the robustness of graph data. We demonstrate the potential threat for discrete edge space manipulation to deceive graph neural networks and make desired actions with stealthy perturbations. We also offer a countermeasure to detect the maliciously injected edges on graph data with an ensemble of multiple models. Finally, we will discuss how model architecture design can provide a robustness guarantee. We present two Lipschitz-constrained models, one for convolution networks and another for Transformer networks. We show that such Lipschitz-constrained models can achieve good certified model robustness. Our work enhances machine learning robustness against various adversarial threats with effective countermeasures. ACKNOWLEDGMENTS I would like to thank my distinguished and helpful Ph.D. committee. I would like to thank my advisor and committee chair Prof. Carl A. Gunter and co-advisor and committee [co-chair Prof. Bo Li for their help and efforts spent during my Ph.D. career. Without their](co-chair Prof. Bo Li for their help and efforts spent during my Ph.D. career. Without their)[ ](co-chair Prof. Bo Li for their help and efforts spent during my Ph.D. career. Without their)[help](help), [I will never be able to finish my Ph.D](I will never be able to finish my Ph.D). smoothly. I would like to thank my committee members Prof. Nikita Borisov and Prof. Ce Zhang for their expertise and experience in our collaboration, and the valuable suggestions on my Ph.D. thesis. I would like to thank my supportive and insightful qualifying exam committee. I would like to thank Prof. Paris Smaragdis, Prof. Oluwasanmi Koyejo and Prof. Bo Li for their suggestions and help during the discussion. I would like to thank all my labmates and collaborators. They have provided insightful advice and friendly support that help me a lot. This thesis cannot be done without their help. I would like to thank my academic advisors during my undergraduate. I would like to thank Prof. Yong Yu, Prof. Weinan Zhang, Dr. Chang Liu and Prof. Dawn Song. They offered great help with patience when I was new to academic research. Finally, I would like to thank my family. I would like to thank my father Wenhua Xu, my mother Xuemei Chen and my wife Huichen Li for their unconditional love. They encourage me to face the challenges and keep moving forward. I would never be who I am without their help and love. TABLE OF CONTENTS Chapter 1 INTRODUCTION .............................. 1 Chapter 2 TEST-TIME DETECTION OF BACKDOORED MODELS ....... 3 2.1 Introduction .................................... 3 2.2 Background .................................... 6 2.3 Threat Model & Defender Capabilities ..................... 10 2.4 Meta Neural Trojan Detection (MNTD) ........

FAQs

What threats to machine learning robustness are investigated in the thesis?

The thesis examines robustness against backdoor attacks that affect both training and evaluation, discrete edge-space manipulation that targets graph neural networks, and architecture-driven robustness guarantees via Lipschitz constraints.

How does the thesis counter backdoor attacks during evaluation?

It introduces a countermeasure that formulates a binary classification task on neural networks to mitigate stealthy backdoor behavior.

What method is proposed to detect maliciously injected edges in graph data?

An ensemble of multiple models is used to detect adversarially injected edges on graph data.

Aug 2, 2026

Uploaded by Sage