Channel Coding meets Sequence Design via Machine Learning for Integrated Sensing and Communications

For integrated sensing and communications, an intriguing question is whether information-bearing channel-coded signals can be reused for sensing - specifically ranging. This question forces the hitherto non-overlapping fields of channel coding (communications) and sequence design (sensing) to intersect by motivating the design of error-correcting codes that have good autocorrelation properties. In this letter, we demonstrate how machine learning (ML) is well-suited for designing such codes, especially for short block lengths. As an example, for rate 1/2 and block length 32, we show that even an unsophisticated ML code has a bit-error rate performance similar to a Polar code with the same parameters, but with autocorrelation sidelobes 24dB lower. While a length-32 Zadoff-Chu (ZC) sequence has zero autocorrelation sidelobes, there are only 16 such sequences and hence, a 1/2 code rate cannot be realized by using ZC sequences as codewords. Hence, ML bridges channel coding and sequence design by trading off an ideal autocorrelation function for a large (i.e., rate-dependent) codebook size.

Privacy Against Agnostic Inference Attack in Vertical Federated Learning

A novel form of inference attack in vertical federated learning (VFL) is proposed, where two parties collaborate in training a machine learning (ML) model. Logistic regression is considered for the VFL model. One party, referred to as the active party, possesses the ground truth labels of the samples in the training phase, while the other, referred to as the passive party, only shares a separate set of features corresponding to these samples. It is shown that the active party can carry out inference attacks on both training and prediction phase samples by acquiring an ML model independently trained on the training samples available to them. This type of inference attack does not require the active party to be aware of the score of a specific sample, hence it is referred to as an agnostic inference attack. It is shown that utilizing the observed confidence scores during the prediction phase, before the time of the attack, can improve the performance of the active party's autonomous model, and thus improve the quality of the agnostic inference attack. As a countermeasure, privacy-preserving schemes (PPSs) are proposed. While the proposed schemes preserve the utility of the VFL model, they systematically distort the VFL parameters corresponding to the passive party's features. The level of the distortion imposed on the passive party's parameters is adjustable, giving rise to a trade-off between privacy of the passive party and interpretabiliy of the VFL outcomes by the active party. The distortion level of the passive party's parameters could be chosen carefully according to the privacy and interpretabiliy concerns of the passive and active parties, respectively, with the hope of keeping both parties (partially) satisfied. Finally, experimental results demonstrate the effectiveness of the proposed attack and the PPSs.

Privacy Against Inference Attacks in Vertical Federated Learning

Vertical federated learning is considered, where an active party, having access to true class labels, wishes to build a classification model by utilizing more features from a passive party, which has no access to the labels, to improve the model accuracy. In the prediction phase, with logistic regression as the classification model, several inference attack techniques are proposed that the adversary, i.e., the active party, can employ to reconstruct the passive party's features, regarded as sensitive information. These attacks, which are mainly based on a classical notion of the center of a set, i.e., the Chebyshev center, are shown to be superior to those proposed in the literature. Moreover, several theoretical performance guarantees are provided for the aforementioned attacks. Subsequently, we consider the minimum amount of information that the adversary needs to fully reconstruct the passive party's features. In particular, it is shown that when the passive party holds one feature, and the adversary is only aware of the signs of the parameters involved, it can perfectly reconstruct that feature when the number of predictions is large enough. Next, as a defense mechanism, a privacy-preserving scheme is proposed that worsen the adversary's reconstruction attacks, while preserving the full benefits that VFL brings to the active party. Finally, experimental results demonstrate the effectiveness of the proposed attacks and the privacy-preserving scheme.