SEARCH · Search NASA
Results for “Data Poisoning”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Systematic Evaluation of Backdoor Data Poisoning Attacks on Image Classifiers
Backdoor data poisoning attacks have recently been demonstrated in computer vision research as a potential safety risk for machine learning (ML) systems. Traditional data poisoning attacks manipulate training data to induce unreliability of an ML model, whereas backdoor data poisoning attacks maintain system performance unless the MLmodel is presented with an input containing an embedded“trigger” that provides a predetermined response advantageous to the adversary. Our work builds upon prior back-door data-poisoning research for ML image classifiers and systematically assesses different experimental conditions including types of trigger patterns, persistence of trigger patterns during retraining, poisoning strategies, architectures (ResNet-50, NasNet, NasNet-Mobile), datasets (Flowers, CIFAR-10), and potential defensive regularization techniques (Contrastive Loss, Logit Squeezing, Manifold Mixup,Soft-Nearest-Neighbors Loss). Experiments yield four key findings. First, the success rate of backdoor poisoning at-tacks varies widely, depending on several factors, including model architecture, trigger pattern and regularization technique. Second, we find that poisoned models are hard to detect through performance inspection alone. Third, regularization typically reduces backdoor success rate, although it can have no effect or even slightly increase it, depending on the form of regularization. Finally, backdoors inserted through data poisoning can be rendered ineffective after just a few epochs of additional training on a small set of clean data without affecting the model’s performance.
A Compound Data Poisoning Technique with Significant Adversarial Effects on Transformer-based Sentiment Classification Tasks
Transformer-based models have demonstrated much success in various natural language processing tasks. However, they are often vulnerable to adversarial attacks, such as data poisoning, which can intentionally fool the model into generating incorrect results. In this article, we present a novel, compound variant of a data poisoning attack on a transformer-based model that maximizes the poisoning effect while minimizing the scope of poisoning. Here we do so by combining the established data poisoning technique (label flipping) with a novel adversarial artifact selection and insertion technique aimed at minimizing detectability and the scope of the poisoning footprint. We find that by using a combination of these two techniques, we achieve a state-of-the-art attack success rate of approximately 90% while poisoning only 0.5% of the original training set, thus minimizing the scope and detectability of the poisoning action. These findings have the potential to advance the development of better data poisoning detection methods.
Quantifying the robustness of deep multispectral segmentation models against natural perturbations and data poisoning
In overhead image segmentation tasks, including additional spectral bands beyond the traditional RGB channels can improve model performance. However, it is still unclear how incorporating this additional data impacts model robustness to adversarial attacks and natural perturbations. For adversarial robustness, the additional in-formation could improve the model’s ability to distinguish malicious inputs, or simply provide new attack avenues and vulnerabilities. For natural perturbations, the additional information could better inform model decisions and weaken perturbation effects or have no significant influence at all. In this work, we seek to characterize the performance and robustness of a multispectral (RGB and near infrared) image segmentation model subjected to adversarial attacks and natural perturbations. While existing adversarial and natural robustness research has focused primarily on digital perturbations, we prioritize on creating realistic perturbations designed with physical world conditions in mind. For adversarial robustness, we focus on data poisoning attacks whereas for natural robustness, we focus on extending ImageNet-C common corruptions for fog and snow that coherently and self-consistently perturbs the input data. Overall, we find both RGB and multispectral models are vulnerable to data poisoning attacks regardless of input or fusion architectures and that while physically-realizable natural perturbations still degrade model performance, the impact differs based on fusion architecture and input data.
The use of analgesics for intentional self-poisoning: Trends in U.S. poison center data
In the U.S., intentional self-poisonings with analgesics that are available without a prescription increased from 2000 to 2018. Given concerns regarding mental health outcomes during the COVID-19 pandemic, we examined and compared trends in pediatric and adult intentional self-poisoning with acetaminophen, aspirin, ibuprofen, and naproxen from 2016 to 2021 using the National Poison Data System (NPDS) to see if these trends have continued. We extracted annual case counts of all suspected suicide attempts from intentional poisoning, and of suspected suicide attempts resulting in major effects or death, from the NPDS for non-prescription single ingredient adult formulation acetaminophen, non-prescription single ingredient adult formulation aspirin, single ingredient formulation ibuprofen, and single ingredient formulation naproxen. We enumerated the cases by year, age, and gender. Most cases of intentional self-poisoning within the review period involved acetaminophen and ibuprofen and the 13–19-year-olds constituted the highest proportion of intentional self-poisoning cases across age groups for all four analgesics. Cases involving females predominated cases involving males by 3:1 or greater. Here, the 13–19-year-old age group also represented the largest proportion of cases that resulted in major clinical effects or deaths. An increasing trend in suicide poisoning cases with acetaminophen and ibuprofen was observed in the 6-19-years age group and this trend appeared to exacerbate from 2020 to 2021 corresponding with the start of the COVID-19 pandemic period.
TrojAI Alternate Analysis
In this portion of the TrojAI evaluation, we focus on the cyber-network-c2-mar2024 dataset. Recall that in this round ResNet18 and ResNet34 neural networks (NN) were trained on the USTC-TFC2016 dataset with the aim of distinguishing between benign versus botnet command and control (c2) packets. A range of bytes from each packet was reformatted into a 28x28 pixel image, and the collection of reformatted packets served as the training (and testing) data for the two ResNet models. For some of the data a trigger watermark was strategically placed to affect various inputs to the NNs. This watermarked, or poisoned, data in turn created a poisoned, or trojaned NN. The data were poisoned in different ways ultimately creating different trojaned NNs. This collection of trojaned NNs was combined with various versions of not trojaned NNs and served as the training and testing data for the performers. The performers’ task was to construct a classifier to distinguish between the trojaned and not trojaned models. It was previously noted that the performers struggled with the cyber-network-c2-mar2024 dataset, motivating this investigation of potential reasons the performers experienced challenges.
Chromium Poisoning ERMINE Model Data
This is the data from the paper "Systematic and Predictive Trends to Chromium Poisoning in Solid Oxide Fuel Cell Cathodes" by Hokon Kim et al., appearing in the Journal of Power Sources. The files here are the microstructures, mesh files, and outputs from the ERMINE finite element model of chromium poisoning in SOFC cathodes. Further description can be found in Readme.rtf and in the paper..
NNREPAIR: Constraint-based Repair of Neural Network Classifiers
We present NNREPAIR, a constraint-based technique for repairing neural network classifiers by i) fixing the logic of the network at an intermediate layer, and ii) fixing the decision conditions of the network at the last layer. NNREPAIR first uses fault localization to find potentially faulty network parameters (specifically weights) and then performs repair using constraint solving to apply small modifications to remedy the defects. We present novel strategies to enable precise yet efficient repair such as inferring correctness specifications to act as oracles for intermediate layer repair, and generation of experts wrt each class. We demonstrate the technique in the context of three different scenarios: (1) Improving the over all accuracy of a model, (2) Fixing security vulnerabilities caused by poisoning of training data and (3) Improving the robustness of the network against adversarial attacks. Our evaluation on MNIST and CIFAR-10 models shows that NNREPAIR can improve the accuracy by 45.56% on poisoned data and 11.11% on adversarial data. NNREPAIR also provides improvement, albeit modest, in the overall accuracy of models, without requiring new data or re-training.
Assurance Issues for Remote Operations: an AI/ML Cybersecurity Perspective
Explore the source record for details and available documents.
Alkaloids are associated with increased microbial diversity and metabolic function in poison frogs
Shifts in host-associated microbiomes can impact both host and microbes. It is of interest to understand how perturbations, like the introduction of exogenous chemicals, impact microbiomes. In poison frogs (family Dendrobatidae), the skin microbiome is exposed to alkaloids that the frogs sequester for defense. These alkaloids are antimicrobial; however, their effect on the frogs’ skin microbiome is unknown. To test this, we characterized microbial communities from field-collected dendrobatid frogs. Then, we conducted a laboratory experiment to monitor the effect of the alkaloid decahydroquinoline (DHQ) on the microbiome of two frog species with contrasting alkaloid loads in nature. In both datasets, we found that alkaloid-exposed microbiomes were more phylogenetically diverse, with an increase in diversity among rare taxa. Further, to better understand the isolate-specific response to alkaloids, we cultured microbial isolates from poison frog skin and found that many isolates exhibited enhanced growth or were not impacted by the addition of DHQ. To further explore the microbial response to alkaloids, we sequenced the metagenomes from high- and low-alkaloid frogs and observed a greater diversity of genes associated with nitrogen and carbon metabolism in high-alkaloid frogs. From these data, we hypothesized that some strains may metabolize the alkaloids. We used stable isotope tracing coupled to nanoSIMS (nanoscale secondary ion mass spectrometry), which supported the idea that some of these isolates are able to metabolize DHQ. Together, these data suggest that poison frog alkaloids open new niches for skin-associated microbes with specific adaptations, such as alkaloid metabolism, that enable survival in this environment.
Model Residuals as Shields: A Two-Level Formulation to Defend Smart Grids From Poisoning Attacks
The advancement of smart grids presents both vast opportunities and heightened cybersecurity risks. Data-driven defense mechanisms, though designed as a shield against these threats, can fall prey to poisoning attacks. We delve into regression settings, underscoring the imperative to fortify defenses against a spectrum of poison ratios, notably those above 0.5—an issue scarcely addressed in prior studies. Recognizing the susceptibilities of smart grids and their manipulable sensors, we exploit the very intent of poisoning attacks, compromising model accuracy, as our defense mechanism. Our proposed two-level optimization framework discerns between poisoned and authentic data based on model residuals, outperforming or matching existing methods in 72% to 77% of precision and 75% to 80% of recalls across various poisoning attacks, poison ratios, and datasets. Once the authentic data are identified, the trained model is adaptable for a variety of applications. Comprehensive evaluations on different smart grid datasets, pitted against myriad poisoning schemes, validate our methodology’s edge over existing methods. Here, we also shed light on the implications of model misspecification originating from temporal auto-correlation, a common feature in Internet of Things and smart grid data.
Neutronic Consideration of TREAT Facility Fuel SiC Recladding
The Transient Reactor Test (TREAT) Facility is an air-cooled reactor composed of graphite-urania fuel encapsulated in zirconium alloy canisters and surrounded by ~2 ft (~61 cm) of nuclear grade graphite. The primary role of TREAT is to provide in-pile nuclear-heated safety research via transient testing [1]. Benchmark efforts have demonstrated sensitivity of TREAT neutronics models to graphite cross section data and key neutron poisons found in the fuel assemblies [2]. During fabrication of TREAT fuel assemblies, a small concentration of boron was inadvertently introduced with variable concentration into the aggregate of fuel blocks prepared for TREAT use. The concentration of boron, and its respective uncertainty, represent the most sensitive component in a neutronics study; unfortunately, nothing can be done to reduce or otherwise mitigate its impact. Hydrogen in the fuel blocks reduces the mean free path of the core and its true quantity and uncertainty is approximated. The hydrogen remains from pitch binder used in the fuel fabrication process and was not completely released due to incomplete fuel graphitization. Destructive fuel testing is necessary to quantify the actual hydrogen content and to improve benchmark model quality. A third neutron poison of some significance is the hafnium impurity in the Zircaloy-3 (Zry-3) assembly cladding. The quantity of hafnium is expected to be within nominal manufacturing limits for nuclear grade zircaloy. Recladding the fuel assemblies with material that is less neutron absorbing is expected to benefit reactor neutron economy. Moreover, TREAT’s total transient energy is restricted based on the rate of Zry-3 oxidation in TREAT’s air coolant environment. Hence, cladding with more benign air reaction kinetics could dramatically uprate the facility’s experimental capability. Silicon carbide (SiC) has been proposed as a candidate material for recladding TREAT assemblies, as SiC/SiC demonstrate favorable properties within nuclear environments [3]. The current operational limits of TREAT are restricted by the oxidation of Zry-3. Change of the cladding to SiC could feasibly double the current temperature limitation. Recladding opportunities allow for previously damaged fuel assemblies to be returned to service, as Zry-3 is not commercially available. The initial effort required to consider proceeding with any recladding effort is to neutronically characterize key reactor parameters while replacing Zry-3 with SiC. A characterization summary, with respective results, is provided herein.
Documentation of the recording environment
The distortion and degradation of the informational content of satellite sensed data by scene generation and atmospheric propagation are discussed. A method is described for obtaining a system point spread function representing the fractional radiance poisoning each pixel gives and receives. The sensor data output is then reprocessed or restored. The degree of restoration is signal to noise dependent. A technique is given for approximating the impact of the atmosphere on the propagation of scene radiance.
Testing the Jump Finding Code for NEXUS Qubit Analysis
At Fermilab, the NEXUS dilution refrigerator is repeating the same experiment from Wilen et al. 1 underground to further investigate the effect of ionizing radiation and cosmic ray muons on qubit decoherence. This refrigerator is 100m underground in the MINOS cavern to significantly lower the incident rate of cosmic ray muons, meaning the majority of incidents is due to ionizing radiation. To gain a better understanding of how the rate of ionizing radiation affects the qubits, we use 4 radiation configurations to collect data from the chip. In this work, we examine the efficiency of our jump detection code to find jumps of various sizes. We do so using simulated data with a known number of injected jumps of known sizes. These jumps are charge offsets of the qubit, thought to be due to quasiparticle poisoning. To test this, we run the jump finding code on an array of simulated data in which two main parameters, the smoothing factor and the threshold at which a charge offset is considered a jump, are changed to test an array of these parameters. We then perform a χ2 analysis to find the best combination of these two parameters.
FY25 Mid-Year Report: FNCL Enhancements Implementation
During the first half of FY25 the FNCL team has made consistent progress toward the completion of our project goals. The FNCL prototype panel design has been successfully applied to a fully instrumented 3-panel system which is actively under construction. The FNCL Demonstrator System contains solid scintillators instrumented with SiPMs, which operate on an updated CAEN digitizer, requires no high-voltage, and has a smaller overall footprint. The onboard software will include the LLNL-developed GMM-PSD signal processing. Later this year the system will be experimentally tested alongside the baseline FNCL instrument at LLNLs ISSA facility. In addition to a full systems test, the performance of a DD generator for active interrogation measurements compared to the standard AmLi source will be established for both systems. The data collected at the ISSA facility will be used to experimentally validate the FNCL-Fast Isotopic Fuel Assay’s (FIFA) capability to measure U-235 loading and to predict gadolinium poison content with passive interrogation. The FNCL-FIFA modal was benchmarked with simulation-based data and a user-friendly GUI was added earlier this year. Three separate codes have been submitted to the LLNL ESW system for review prior to their transfers. These include the Predictive Modeling Response toolkit, GMM-PSD firmware beta version, and the FNCL-FIFA analysis package with GUI and user documentation.
Characterization of Humanized Mouse Model of Organophosphate Poisoning and Detection of Countermeasures via MALDI-MSI
Organophosphoate (OP) chemicals are known to inhibit the enzyme acetylcholinesterase (AChE). Studying OP poisoning is difficult because common small animal research models have serum carboxylesterase, which contributes to animals’ resistance to OP poisoning. Historically, guinea pigs have been used for this research; however, a novel genetically modified mouse strain (KIKO) was developed with nonfunctional serum carboxylase (Es1 KO) and an altered acetylcholinesterase (AChE) gene, which expresses the amino acid sequence of the human form of the same protein (AChE KI). KIKO mice were injected with 1xLD50 of an OP nerve agent or vehicle control with or without atropine. After one to three minutes, animals were injected with 35 mg/kg of the currently fielded Reactivator countermeasure for OP poisoning. Postmortem brains were imaged on a Bruker RapifleX ToF/ToF instrument. Data confirmed the presence of increased acetylcholine in OP-exposed animals, regardless of treatment or atropine status. More interestingly, we detected a small amount of Reactivator within the brain of both exposed and unexposed animals; it is currently debated if reactivators can cross the blood–brain barrier. Further, we were able to simultaneously image acetylcholine, the primary affected neurotransmitter, as well as determine the location of both Reactivator and acetylcholine in the brain. This study, which utilized sensitive MALDI-MSI methods, characterized KIKO mice as a functional model for OP countermeasure development.
Measurement of the energy-differential 35 Cl( n, p 0 ) 35 S cross section via the ratio with 6 Li( n, α ) 3 H
Knowledge of the neutron-induced 35 Cl (n, x) cross sections is vital to the design and certification of molten chloride fast reactors (MCFRs) since the 35 Cl (n, p 0 ) 35 S reaction is believed to be a significant reactor poison. However, recently published measurements are inconsistent with each other and with evaluation. Here, the goal of this work is to measure the 35 Cl (n, p 0 ) reaction cross section using a technique that is different from recent measurements. The experiment was conducted at Lawrence Berkeley National Laboratory's (LBNL) 88-Inch Cyclotron using thick target deuteron breakup from a 14 MeV deuteron beam. Energy-differential 35 Cl (n, p 0 ) 35 S cross sections were obtained via ratio with the 6 Li (n, a) 3 H reaction using an active target experiment with a Cs 2 LiYCl 6 (CLYC) scintillator. The 35 Cl (n, p 0 ) reaction cross section was measured from 2.02 to 7.46 MeV. The results are consistent with Kuvin et al., confirming a roughly 50% reduction in magnitude relative to the ENDF/B-VIII.0 evaluation. These data provide new insight into the role of natural Cl as an MCFR poison. The reduction of the 35 Cl (n, p 0 ) reaction cross section compared to evaluation suggests that MCFR criticality is less sensitive to Cl enrichment. This may in turn reduce building and operating costs since isotope separation may not be needed.
Environmental Public Health Tracking: Health and Environment Linked for Information Exchange-Atlanta (HEXIX-Atlanta: A cooperative Program Between CDC and NASA for Development of an Environmental Public Health Tracking Network in the Atlanta Metropolitan Area
The Centers for Disease Control and Prevention (CDC) is coordinating HELIX- Atlanta to provide information regarding the five-county Metropolitan Atlanta Area (Clayton, Cobb, DeKalb, Fulton, and Gwinett) via a network of integrated environmental monitoring and public health data systems so that all sectors can take action to prevent and control environmentally related health effects. The HELIX-Atlanta Network is a tool to access interoperable information systems with optional information technology linkage functionality driven by scientific rationale. HELIX-Atlanta is a collaborative effort with local, state, federal, and academic partners, including the NASA Marshall Space Flight Center. The HELIX-Atlanta Partners identified the following HELIX-Atlanta initial focus areas: childhood lead poisoning, short-latency cancers, developmental disabilities, birth defects, vital records, respiratory health, age of housing, remote sensing data, and environmental monitoring, HELIX-Atlanta Partners identified and evaluated information systems containing information on the above focus areas. The information system evaluations resulted in recommendations for what resources would be needed to interoperate selected information systems in compliance with the CDC Public Health Information Network (PHIN). This presentation will discuss the collaborative process of building a network that links health and environment data for information exchange, including NASA remote sensing data, for use in HELIX-Atlanta.