Advancing Model Security, Data Privacy, and Performance for Widespread Adoption of Trustworthy Artificial Intelligence

As artificial intelligence (AI) becomes increasingly integrated into daily life, concerns aboutprivacy and security have escalated. In this work, we study privacy through Federated Learning(FL), learning from multiple datasets without exchanging raw data, and Differential Privacy(DP), a mathematical guarantee of data privacy for statistical databases. We also addresssecurity by developing defenses against backdoor attacks, where an adversary manipulates thetraining data to embed a hidden, harmful behavior in resulting models, which become criticalas publicly available large datasets become more popular. First, in Chapter 1, we introduce Trusted Aggregation (TAG), a defense mechanism againstbackdoor attacks in FL that filters out malicious updates to shared models that contain backdoorattacks. TAG enables robust model training even in the presence of many malicious participants,ensuring security without compromising performance. In Chapter 2, we propose FedDecay,which employs within-round learning rate decay to improve FL performance for heterogeneousdatasets, achieving benefits comparable to more computationally expensive personalized models.Together, these contribute to FL’s reliability by strengthening its security and performance. Next, in Chapter 3, we explore Differential Privacy in the context of Generative AdversarialNetworks (GANs), addressing key challenges such as computational overhead and performancedegradation in privacy-preserving generative models. Our work demonstrates that the Lipschitzconstraint in Wasserstein GANs naturally limits per-sample gradients, facilitating efficient batchcomputation under DP constraints. Additionally, we modify an orthogonalization algorithmfor noisy inputs, yielding an unbiased estimator to improve projection in the presence of DP’sadditive noise. While qualitative outputs for downstream tasks remain an area for furtherrefinement, our findings lay the foundation for more efficient privacy-preserving GAN training. Finally, Chapter 4 addresses data poisoning in prototype-based architectures, introducing anovel detection and defense mechanism for backdoor attacks. We develop methods for detectingmalicious training data and visualizing backdoor triggers by analyzing similarity scores withlearned prototypes. Our approach leverages bi-clustering to separate data into benign andmalicious partitions. Using poisoned data to purify backdoor behavior produces a more robustdefense. Furthermore, our proposals perform well even when limited data is available and witherrors in detection for partitioning. Our research contributes to developing trustworthy AI systems by enhancing privacy inFederated Learning and Differential Privacy while strengthening security through defensesagainst data poisoning in adversarial machine learning.