[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-121942-en":3,"doc-seo-121942-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},121942,137441390410,"Hazel","https://ap-avatar.wpscdn.com/avatar/2000252f4ab5702993?_k=1776741390130283984",8,"Research & Report","FINDING AND FIXING FRAGILITY IN MACHINE LEARNING - Dissertation","This dissertation addresses the general problem that machine learning models are fragile. Fragility arises when models are composed into systems or deployed in real operational environments, and also when inputs are perturbed, even slightly, including adversarially chosen perturbations. The work applies System Theoretic Process Analysis (STPA) to concrete ML applications with notable social and ethical risks, providing a systematic argument for safe and trustworthy ML in sociotechnical systems. It further proposes LAD-SRNA, a novel stochastic NOTA defense for DNN classifiers that surpasses state-of-the-art adversarial robustness on CIFAR-10 and CIFAR-100. The dissertation also introduces 16 adaptive attacks that modify existing attacks to overcome both NOTA and stochastic defenses, including combinations of the two.","Calhoun: The NPS Institutional Archive  \nDSpace Repository  \n\n| NPS Scholarship | Theses |\n| --- | --- |\n\n2023-06  \nFINDING AND FIXING FRAGILITY IN MACHINE LEARNING  \nJatho, Edgar W. , III  \nMonterey, CA; Naval Postgraduate School  \n[https://hdl.handle.net/10945/72193](https://hdl.handle.net/10945/72193)  \nThis publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.  \nDownloaded from NPS Archive: Calhoun  \nNAVAL POSTGRADUATE  \nSCHOOL MONTEREY, CALIFORNIA  \nDISSERTATION  \nFINDING AND FIXING FRAGILITY IN MACHINE LEARNING  \nby  \nEdgar W. Jatho III  \nJune 2023  \nDissertation Supervisors: Peter J. Denning  \nArmon C. Barton Joshua A. Kroll  \nApproved for public release. Distribution is unlimited.  \nTHIS PAGE INTENTIONALLY LEFT BLANK  \n\n| REPORT DOCUMENTATION PAGE |  |  |  |  | Form Approved OMB No. 0704-0188 |  |  |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instruction, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188) Washington, DC, 20503. |  |  |  |  |  |  |  |\n| 1. AGENCY USE ONLY (Leave blank) |  | 2. REPORT DATE\u003Cbr>June 2023 |  | 3. REPORT TYPE AND DATES COVERED\u003Cbr>Dissertation |  |  |  |\n| 4. TITLE AND SUBTITLE\u003Cbr>FINDING AND FIXING FRAGILITY IN MACHINE LEARNING |  |  |  |  |  | 5. FUNDING NUMBERS |  |\n| 6. AUTHOR(S) Edgar W. Jatho III |  |  |  |  |  |  |  |\n| 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)\u003Cbr>Naval Postgraduate School\u003Cbr>Monterey, CA 93943-5000 |  |  |  |  |  | 8. PERFORMING\u003Cbr>ORGANIZATION REPORT NUMBER |  |\n| 9. SPONSORING / MONITORING AGENCY NAME(S) AND\u003Cbr>ADDRESS(ES)\u003Cbr>N/A |  |  |  |  |  | 10. SPONSORING / MONITORING AGENCY REPORT NUMBER |  |\n| 11. SUPPLEMENTARY NOTES The views expressed in this thesis are those of the author and do not reflect the official policy or position of the Department of Defense or the U.S. Government. |  |  |  |  |  |  |  |\n| 12a. DISTRIBUTION / AVAILABILITY STATEMENT\u003Cbr>Approved for public release. Distribution is unlimited. |  |  |  |  |  | 12b. DISTRIBUTION CODE\u003Cbr>A |  |\n| 13. ABSTRACT (maximum 200 words)\u003Cbr>This dissertation addresses the general problem that machine learning models are fragile. Fragility arises when composing models into systems or using them in real operational environments. It also arises when model inputs are perturbed, even by small amounts, especially when perturbations are chosen by adversaries. This dissertation applies an existing state-of-the-art safety analysis methodology, System Theoretic Process Analysis (STPA), borrowed from systems safety engineering, to concrete ML applications with notable social and ethical risks to demonstrate a systematic means to argue for safe and trustworthy ML in sociotechnical systems. STPA bridges high-level goals like safety and the AI ethical principles to low level ML life-cycle design and implementation decisions. At the technical level, the dissertation introduces a novel defense for deep neural network (DNN) classifiers which exceeds state-of-the-art adversarial robustness against benchmark attacks for CIFAR-10 and CIFAR-100 datasets. The best defense, a novel stochastic, none-of-the-above (NOTA) defense, LAD-SRNA, achieves AutoAttack attack success rates less than the natural error rate in both datasets with near state-of-the-art accuracy and better than state-of-the-art rob","cbCaidvEvVHUDgOa","https://ap.wps.com/l/cbCaidvEvVHUDgOa","pdf",10406745,1,133,"English","en",105,"# Abstract\n## Problem: fragility in ML models\n## Method: STPA for safety and trustworthiness\n## Technical contributions: LAD-SRNA defense\n## Evaluation and attacks: adaptive attack suite","[{\"question\":\"What problem does the dissertation focus on regarding machine learning?\",\"answer\":\"It focuses on the general problem that machine learning models are fragile, especially under system composition, real operational deployment, and adversarial or even small input perturbations.\"},{\"question\":\"How does the dissertation connect safety analysis to machine learning?\",\"answer\":\"It applies System Theoretic Process Analysis (STPA), borrowed from systems safety engineering, to argue systematically for safe and trustworthy ML in sociotechnical systems.\"},{\"question\":\"What is LAD-SRNA and what does it achieve?\",\"answer\":\"LAD-SRNA is a novel stochastic none-of-the-above (NOTA) defense for deep neural network classifiers. It achieves adversarial robustness on CIFAR-10 and CIFAR-100 by keeping AutoAttack success rates below natural error rates while maintaining near state-of-the-art accuracy.\"}]","FINDING AND FIXING FRAGILITY IN MACHINE LEARNING - Dissertation | PDF",1785807857,335,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"finding-and-fixing-fragility-in-machine-learning-dissertation","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/finding-and-fixing-fragility-in-machine-learning-dissertation/121942/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-04",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does the dissertation focus on regarding machine learning?","Question",{"text":75,"@type":76},"It focuses on the general problem that machine learning models are fragile, especially under system composition, real operational deployment, and adversarial or even small input perturbations.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does the dissertation connect safety analysis to machine learning?",{"text":80,"@type":76},"It applies System Theoretic Process Analysis (STPA), borrowed from systems safety engineering, to argue systematically for safe and trustworthy ML in sociotechnical systems.",{"name":82,"@type":73,"acceptedAnswer":83},"What is LAD-SRNA and what does it achieve?",{"text":84,"@type":76},"LAD-SRNA is a novel stochastic none-of-the-above (NOTA) defense for deep neural network classifiers. It achieves adversarial robustness on CIFAR-10 and CIFAR-100 by keeping AutoAttack success rates below natural error rates while maintaining near state-of-the-art accuracy.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]