Asymmetries in Adversarial Settings

Even without formal guarantees of their effectiveness, adversarial attacks against Machine Learning models frequently fool new defenses. We identify six key asymmetries that contribute to this phenomenon and formulate four guidelines to build future-proof defenses by preventing such asymmetries. We also prove that attacking a classifier is NP-complete, while defending from such attacks is Sigma_2^P-complete. We then introduce Counter-Attack (CA), an asymmetry-free metadefense that determines whether a model is robust on a given input by estimating its distance from the decision boundary. Under specific assumptions CA can provide theoretical detection guarantees. Additionally, we prove that while CA is NP-complete, fooling CA is Sigma_2^P-complete. Even when using heuristic relaxations, we show that our method can reliably identify non-robust points. As part of our experimental evaluation, we introduce UG100, a new dataset obtained by applying a provably optimal attack to six limited-scale networks (three for MNIST and three for CIFAR10), each trained in three different manners

Image embedding for denoising generative models

Denoising Diffusion models are gaining increasing popularity in the field of generative modeling for several reasons, including the simple and stable training, the excellent generative quality, and the solid probabilistic foundation. In this article, we address the problem of embedding an image into the latent space of Denoising Diffusion Models, that is finding a suitable “noisy” image whose denoising results in the original image. We particularly focus on Denoising Diffusion Implicit Models due to the deterministic nature of their reverse diffusion process. As a side result of our investigation, we gain a deeper insight into the structure of the latent space of diffusion models, opening interesting perspectives on its exploration, the definition of semantic trajectories, and the manipulation/conditioning of encodings for editing purposes. A particularly interesting property highlighted by our research, which is also characteristic of this class of generative models, is the independence of the latent representation from the networks implementing the reverse diffusion process. In other words, a common seed passed to different networks (each trained on the same dataset), eventually results in identical images

Rapid Single-Step Induction of Functional Neurons from Human Pluripotent Stem Cells

SummaryAvailable methods for differentiating human embryonic stem cells (ESCs) and induced pluripotent cells (iPSCs) into neurons are often cumbersome, slow, and variable. Alternatively, human fibroblasts can be directly converted into induced neuronal (iN) cells. However, with present techniques conversion is inefficient, synapse formation is limited, and only small amounts of neurons can be generated. Here, we show that human ESCs and iPSCs can be converted into functional iN cells with nearly 100% yield and purity in less than 2 weeks by forced expression of a single transcription factor. The resulting ES-iN or iPS-iN cells exhibit quantitatively reproducible properties independent of the cell line of origin, form mature pre- and postsynaptic specializations, and integrate into existing synaptic networks when transplanted into mouse brain. As illustrated by selected examples, our approach enables large-scale studies of human neurons for questions such as analyses of human diseases, examination of human-specific genes, and drug screening

The mitochondrial heme exporter FLVCR1b mediates erythroid differentiation

Feline leukemia virus subgroup C receptor 1 (FLVCR1) is a cell membrane heme exporter that maintains the balance between heme levels and globin synthesis in erythroid precursors. It was previously shown that Flvcr1-null mice died in utero due to a failure of erythropoiesis. Here, we identify Flvcr1b, a mitochondrial Flvcr1 isoform that promotes heme efflux into the cytoplasm. Flvcr1b overexpression promoted heme synthesis and in vitro erythroid differentiation, whereas silencing of Flvcr1b caused mitochondrial heme accumulation and termination of erythroid differentiation. Furthermore, mice lacking the plasma membrane isoform (Flvcr1a) but expressing Flvcr1b had normal erythropoiesis, but exhibited hemorrhages, edema, and skeletal abnormalities. Thus, FLVCR1b regulates erythropoiesis by controlling mitochondrial heme efflux, whereas FLVCR1a expression is required to prevent hemorrhages and edema. The aberrant expression of Flvcr1 isoforms may play a role in the pathogenesis of disorders characterized by an imbalance between heme and globin synthesis

Oligodendrocyte Death in Pelizaeus-Merzbacher Disease Is Rescued by Iron Chelation.

Pelizaeus-Merzbacher disease (PMD) is an X-linked leukodystrophy caused by mutations in Proteolipid Protein 1 (PLP1), encoding a major myelin protein, resulting in profound developmental delay and early lethality. Previous work showed involvement of unfolded protein response (UPR) and endoplasmic reticulum (ER) stress pathways, but poor PLP1 genotype-phenotype associations suggest additional pathogenetic mechanisms. Using induced pluripotent stem cell (iPSC) and gene-correction, we show that patient-derived oligodendrocytes can develop to the pre-myelinating stage, but subsequently undergo cell death. Mutant oligodendrocytes demonstrated key hallmarks of ferroptosis including lipid peroxidation, abnormal iron metabolism, and hypersensitivity to free iron. Iron chelation rescued mutant oligodendrocyte apoptosis, survival, and differentiationin vitro, and post-transplantation in vivo. Finally, systemic treatment of Plp1 mutant Jimpy mice with deferiprone, a small molecule iron chelator, reduced oligodendrocyte apoptosis and enabled myelin formation. Thus, oligodendrocyte iron-induced cell death and myelination is rescued by iron chelation in PMD pre-clinical models.H.N. acknowledges postdoctoral fellowship support from the European Leukodystrophy Association, and career transition fellowship support from National Multiple Sclerosis Society. M.C. acknowledges funding support from Career Development Grant awarded by Cerebral Palsy Alliance Research Foundation Inc. This work was supported by funding from the National Multiple Sclerosis Foundation (to M.W., D.H. R.), the European Leukodystrophy Association and the New York Stem Cell Foundation (to M.W.), and Action Medical Research, the Adelson Medical Research Foundation, the National Institute for Health Research Cambridge Biomedical Research Centre and the European Research Council (to D.H. R)

Inhibition of pluripotency networks by the Rb tumor suppressor restricts reprogramming and tumorigenesis

Mutations in the retinoblastoma tumor suppressor gene Rb are involved in many forms of human cancer. In this study, we investigated the early consequences of inactivating Rb in the context of cellular reprogramming. We found that Rb inactivation promotes the reprogramming of differentiated cells to a pluripotent state. Unexpectedly, this effect is cell cycle independent, and instead reflects direct binding of Rb to pluripotency genes, including Sox2 and Oct4, which leads to a repressed chromatin state. More broadly, this regulation of pluripotency networks and Sox2 in particular is critical for the initiation of tumors upon loss of Rb in mice. These studies therefore identify Rb as a global transcriptional repressor of pluripotency networks, providing a molecular basis for previous reports about its involvement in cell fate pliability, and implicate misregulation of pluripotency factors such as Sox2 in tumorigenesis related to loss of Rb function

Inhibition of pluripotency networks by the Rb tumor suppressor restricts reprogramming and tumorigenesis

Mutations in the retinoblastoma tumor suppressor gene Rb are involved in many forms of human cancer. In this study, we investigated the early consequences of inactivating Rb in the context of cellular reprogramming. We found that Rb inactivation promotes the reprogramming of differentiated cells to a pluripotent state. Unexpectedly, this effect is cell cycle independent, and instead reflects direct binding of Rb to pluripotency genes, including Sox2 and Oct4, which leads to a repressed chromatin state. More broadly, this regulation of pluripotency networks and Sox2 in particular is critical for the initiation of tumors upon loss of Rb in mice. These studies therefore identify Rb as a global transcriptional repressor of pluripotency networks, providing a molecular basis for previous reports about its involvement in cell fate pliability, and implicate misregulation of pluripotency factors such as Sox2 in tumorigenesis related to loss of Rb function

Computational Asymmetries in Robust Classification

In the context of adversarial robustness, we make three strongly related contributions. First, we prove that while attacking ReLU classifiers is $\mathit{NP}$-hard, ensuring their robustness at training time is $\Sigma^2_P$-hard (even on a single example). This asymmetry provides a rationale for the fact that robust classifications approaches are frequently fooled in the literature. Second, we show that inference-time robustness certificates are not affected by this asymmetry, by introducing a proof-of-concept approach named Counter-Attack (CA). Indeed, CA displays a reversed asymmetry: running the defense is $\mathit{NP}$-hard, while attacking it is $\Sigma_2^P$-hard. Finally, motivated by our previous result, we argue that adversarial attacks can be used in the context of robustness certification, and provide an empirical evaluation of their effectiveness. As a byproduct of this process, we also release UG100, a benchmark dataset for adversarial attacks