@article{gupta26-pr,

title = {Buffer-free Class-Incremental Learning with Out-of-Distribution Detection},

author = {Srishti Gupta and Daniele Angioni and Maura Pintor and Ambra Demontis and Lea Schönherr and Battista Biggio and Fabio Roli},

year  = {2026},

date = {2026-01-01},

journal = {Pattern Recognition},

volume = {172},

pages = {112441},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{ledda26-pr,

title = {On the Robustness of Adversarial Training Against Uncertainty Attacks},

author = {Emanuele Ledda and Giovanni Scodeller and Daniele Angioni and Giorgio Piras and Antonio Emanuele Cinà and Giorgio Fumera and Battista Biggio and Fabio Roli},

year  = {2026},

date = {2026-01-01},

journal = {Pattern Recognition},

volume = {172},

pages = {112519},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {From ‘wild west’ to ‘responsible’ AI testing ‘in-the-wild’: Lessons from Live Facial Recognition Testing by Law Enforcement Authorities in Europe},

author = {Karen Yeung and Wenlong Li},

url = {https://www.cambridge.org/core/journals/data-and-policy/article/from-wild-west-to-responsible-ai-testing-inthewild-lessons-from-live-facial-recognition-testing-by-law-enforcement-authorities-in-europe/3C1F920D9588C8872C195CE403AE3BDF},

year  = {2025},

date = {2025-09-19},

journal = {Data & Policy, Cambridge University Press},

volume = {7},

number = {e59},

abstract = {Although ‘in-the-wild’ technology testing provides an important opportunity to collect evidence about the performance of new technologies in real world deployment environments, such tests may themselves cause harm and wrongfully interfere with the rights of others. This paper critically examines real-world AI testing, focusing on live facial recognition technology (FRT) trials by European law enforcement agencies (in London, Wales, Berlin, and Nice) undertaken between 2016 and 2020, which serve as a set of comparative case studies. We argue that there is an urgent need for a clear framework of principles to govern real-world AI testing, which is currently a largely ungoverned ‘wild west’ without adequate safeguards or oversight. We propose a principled framework to ensure that these tests are undertaken in an epistemically, ethically, and legally responsible manner, thereby helping to ensure that such tests generate sound, reliable evidence while safeguarding the human rights and other vital interests of others. Although the case studies of FRT testing were undertaken prior to the passage of the EU’s AI Act, we suggest that these three kinds of responsibility should provide the foundational anchor points to inform the design and conduct of real-world testing of high-risk AI systems pursuant to Article 60 of the AI Act.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Transfer learning from inorganic materials to ivory detection},

author = {Agil Aghasanli, Plamen Angelov, Dmitry Kangin, Jemma Kerns, Rebecca Shepherd },

url = {https://www.nature.com/articles/s41598-025-98915-y#Abs1},

year  = {2025},

date = {2025-05-03},

journal = {nature scientific reports},

volume = {2025},

number = {15},

abstract = {This paper describes the automatic identification of ivory using Raman spectroscopy data and deep neural network (DNN) models pre-trained on open-source data from inorganic minerals. The proposed approach uses transfer learning (TL) from foundation models trained on a larger inorganic (minerals) spectroscopy dataset (MLROD). The results demonstrate, for the first time, the ability to transfer machine learning (ML) models from a Raman spectroscopy dataset of geological substances to classify biological ivory samples. Current identification methods, such as DNA analysis and radiocarbon dating, are costly and destructive. Recently, it was demonstrated that the use of Raman spectroscopy, a laser-based, non-destructive technique, in combination with well-known statistical techniques, has the potential to differentiate between mammoth and elephant ivory. However, this previous study had a small sample size due to difficulties in obtaining large amounts of labeled ivory data. To date, there has been no reported work on ivory classification using DNNs, and only limited studies using Raman spectra. The work proposed in this paper suggests that ML can provide high levels of accuracy in the classification of Raman spectroscopy data from ivory samples of different elephant species (up to 99.7%). This has the potential to create a quick and inexpensive method of identifying legal and illegal types of ivory to aid in enforcement of ivory trade bans. This study also demonstrated that DNN models initially pre-trained on inorganic minerals (from the MLROD dataset) that were not finetuned on ivory data had a high accuracy rate of 92%, alleviating the need for large amounts of training data from ivory specimens. Finally, the approach proposed in this paper, provides insight into the decision making and interpretation of the results using prototype-based models. This novel work demonstrates that: (1) ML methods can provide highly accurate classification of ivory from different species of elephant using data obtained using Raman spectroscopy and providing insight into the decision making (2) TL enables re-purposing the models trained on larger mineral datasets of inorganic materials (such as MLROD) to discriminating between the classes of ivory, containing inorganic and organic biological components, for the first time transgressing between non-biological and biological samples (3) the proposed method allows both training from labelled samples of ivory and the identification of unknown ivory samples through prototype-based methods.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{angelov2023interpretablebydesigndeeplearningalgorithms,

title = {Towards interpretable-by-design deep learning algorithms},

author = {Plamen Angelov and Dmitry Kangin and Ziyang Zhang},

url = {https://arxiv.org/abs/2311.11396},

doi = {10.48550/arXiv.2311.11396},

year  = {2025},

date = {2025-04-14},

urldate = {2025-04-14},

abstract = {The proposed framework named IDEAL (Interpretable-by-design DEep learning ALgorithms) recasts the standard supervised classification problem into a function of similarity to a set of prototypes derived from the training data, while taking advantage of existing latent spaces of large neural networks forming so-called Foundation Models (FM). This addresses the issue of explainability (stage B) while retaining the benefits from the tremendous achievements offered by DL models (e.g., visual transformers, ViT) pre-trained on huge data sets such as IG-3.6B + ImageNet-1K or LVD-142M (stage A). We show that one can turn such DL models into conceptually simpler, explainable-through-prototypes ones.

The key findings can be summarized as follows: (1) the proposed models are interpretable through prototypes, mitigating the issue of confounded interpretations, (2) the proposed IDEAL framework circumvents the issue of catastrophic forgetting allowing efficient class-incremental learning, and (3) the proposed IDEAL approach demonstrates that ViT architectures narrow the gap between finetuned and non-finetuned models allowing for transfer learning in a fraction of time textbf{without} finetuning of the feature space on a target dataset with iterative supervised methods.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Runtime Backdoor Detection for Federated Learning via Representational Dissimilarity Analysis},

author = {Xiyue Zhang, Xiaoyong Xue, Xiaoning Du, Xiaofei Xie, Yang Liu, Meng Sun},

url = {https://arxiv.org/abs/2503.04473},

issn = {1545‑5971},

year  = {2025},

date = {2025-03-01},

journal = {IEEE Transactions on Dependable and Secure Computing (TDSC) },

abstract = {Federated learning (FL), as a powerful learning paradigm, trains a shared model by aggregating model updates from distributed clients. However, the decoupling of model learning from local data makes FL highly vulnerable to backdoor attacks, where a single compromised client can poison the shared model. While recent progress has been made in backdoor detection, existing methods face challenges with detection accuracy and runtime effectiveness, particularly when dealing with complex model architectures. In this work, we propose a novel approach to detecting malicious clients in an accurate, stable, and efficient manner. Our method utilizes a sampling-based network representation method to quantify dissimilarities between clients, identifying model deviations caused by backdoor injections. We also propose an iterative algorithm to progressively detect and exclude malicious clients as outliers based on these dissimilarity measurements. Evaluations across a range of benchmark tasks demonstrate that our approach outperforms state-of-the-art methods in detection accuracy and defense effectiveness. When deployed for runtime protection, our approach effectively eliminates backdoor injections with marginal overheads.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{sukhija2025maxinforl,

title = {MaxInfoRL: Boosting exploration in reinforcement learning through information gain maximization},

author = {Bhavya Sukhija and Stelian Coros and Andreas Krause and Pieter Abbeel and Carmelo Sferrazza},

year  = {2025},

date = {2025-01-01},

journal = {ICLR},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{BARALDI2025104294,

title = {Learning to mask and permute visual tokens for Vision Transformer pre-training},

author = {Lorenzo Baraldi and Roberto Amoroso and Marcella Cornia and Lorenzo Baraldi and Andrea Pilzer and Rita Cucchiara},

url = {https://www.sciencedirect.com/science/article/pii/S1077314225000177},

doi = {https://doi.org/10.1016/j.cviu.2025.104294},

issn = {1077-3142},

year  = {2025},

date = {2025-01-01},

journal = {Computer Vision and Image Understanding},

volume = {252},

pages = {104294},

abstract = {The use of self-supervised pre-training has emerged as a promising approach to enhance the performance of many different visual tasks. In this context, recent approaches have employed the Masked Image Modeling paradigm, which pre-trains a backbone by reconstructing visual tokens associated with randomly masked image patches. This masking approach, however, introduces noise into the input data during pre-training, leading to discrepancies that can impair performance during the fine-tuning phase. Furthermore, input masking neglects the dependencies between corrupted patches, increasing the inconsistencies observed in downstream fine-tuning tasks. To overcome these issues, we propose a new self-supervised pre-training approach, named Masked and Permuted Vision Transformer (MaPeT), that employs autoregressive and permuted predictions to capture intra-patch dependencies. In addition, MaPeT employs auxiliary positional information to reduce the disparity between the pre-training and fine-tuning phases. In our experiments, we employ a fair setting to ensure reliable and meaningful comparisons and conduct investigations on multiple visual tokenizers, including our proposed k-CLIP which directly employs discretized CLIP features. Our results demonstrate that MaPeT achieves competitive performance on ImageNet, compared to baselines and competitors under the same model setting. We release an implementation of our code and models at https://github.com/aimagelab/MaPeT.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{ANGELOV2025129464,

title = {IDEAL: Interpretable-by-Design ALgorithms for learning from foundation feature spaces},

author = {Plamen Angelov and Dmitry Kangin and Ziyang Zhang},

url = {https://www.sciencedirect.com/science/article/pii/S0925231225001365},

doi = {https://doi.org/10.1016/j.neucom.2025.129464},

issn = {0925-2312},

year  = {2025},

date = {2025-01-01},

journal = {Neurocomputing},

volume = {626},

pages = {129464},

abstract = {The advance of foundation models (FM) makes it possible to avoid parametric tuning for transfer learning, taking advantage of pretrained feature spaces. In this study, we define a framework called IDEAL (Interpretable-by-design DEep learning ALgorithms) which tackles the problem of interpretable transfer learning by recasting the standard supervised classification problem into a function of similarity to a set of prototypes derived from the training data. This framework generalises previously-known prototypical approaches, such as ProtoPNet, xDNN and DNC, and decomposes the overall problem into two inherently connected stages: (A) feature extraction (FE), which maps the raw features of real-world data into a latent space, and (B) identification of representative prototypes and decision making based on similarity and association between the query and the prototypes. This addresses the issue of interpretability (stage B) while retaining the benefits of pretrained deep learning (DL) models. On a range of datasets (CIFAR-10, CIFAR-100, CalTech101, STL-10, Oxford-IIIT Pet, EuroSAT), we demonstrate, through an extensive set of experiments, how the choice of the latent space, prototype selection, and finetuning of the latent space affect accuracy and generalisation of the models on transfer learning scenarios for different backbones. Building upon this knowledge, we demonstrate that the proposed framework helps achieve an advantage over state-of-the-art baselines in class-incremental learning. The key findings can be summarised as follows: (1) the setting allows interpretability through prototypes, (2) lack of finetuning helps circumvent the issue of catastrophic forgetting, allowing efficient class-incremental transfer learning, while mitigating the issue of confounding bias, and (3) ViT architectures narrow the gap between finetuned and non-finetuned models allowing for transfer learning in a fraction of time without finetuning of the feature space on a target dataset with iterative supervised methods.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{as2025actsafe,

title = {Actsafe: Active exploration with safety constraints for reinforcement learning},

author = {Yarden As* and Bhavya Sukhija* and Lenart Treven and Carmelo Sferrazza and Stelian Coros and Andreas Krause},

year  = {2025},

date = {2025-01-01},

journal = {ICLR},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{piras25-pr,

title = {Adversarial Pruning: A Survey and Benchmark of Pruning Methods for Adversarial Robustness},

author = {Giorgio Piras and Maura Pintor and Ambra Demontis and Battista Biggio and Giorgio Giacinto and Fabio Roli},

url = {https://www.sciencedirect.com/science/article/pii/S0031320325004480},

doi = {10.1016/j.patcog.2025.111788},

year  = {2025},

date = {2025-01-01},

journal = {Pattern Recognition},

volume = {168},

pages = {111788},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{floris25-tifs,

title = {ModSec-AdvLearn: Countering Adversarial SQL Injections With Robust Machine Learning},

author = {Giuseppe Floris and Christian Scano and Biagio Montaruli and Luca Demetrio and Andrea Valenza and Luca Compagna and Davide Ariu and Luca Piras and Davide Balzarotti and Battista Biggio},

doi = {10.1109/TIFS.2025.3583234},

year  = {2025},

date = {2025-01-01},

journal = {IEEE Transactions on Information Forensics and Security},

volume = {20},

pages = {6693-6705},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{JMLR:v26:23-1428,

title = {On Consistent Bayesian Inference from Synthetic Data},

author = {Ossi Räisä and Joonas Jälkö and Antti Honkela},

url = {http://jmlr.org/papers/v26/23-1428.html},

year  = {2025},

date = {2025-01-01},

journal = {Journal of Machine Learning Research},

volume = {26},

number = {74},

pages = {1–65},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{piras25-arxiv,

title = {S2AP: Score-space Sharpness Minimization for Adversarial Pruning},

author = {Giorgio Piras and Qi Zhao and Fabio Brau and Maura Pintor and Christian Wressnegger and Battista Biggio},

year  = {2025},

date = {2025-01-01},

journal = {ArXiv e-prints},

volume = {2510.18381},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{ghiani25-arxiv,

title = {Regression-aware Continual Learning for Android Malware Detection},

author = {Daniele Ghiani and Daniele Angioni and Giorgio Piras and Angelo Sotgiu and Luca Minnei and Srishti Gupta and Maura Pintor and Fabio Roli and Battista Biggio},

year  = {2025},

date = {2025-01-01},

journal = {ArXiv e-prints},

volume = {2507.18313},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{guo25a-arxiv,

title = {Silent Until Sparse: Backdoor Attacks on Semi-Structured Sparsity},

author = {Wei Guo and Maura Pintor and Ambra Demontis and Battista Biggio},

year  = {2025},

date = {2025-01-01},

journal = {ArXiv e-prints},

volume = {2509.08747},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{guo25-arxiv,

title = {Prototype-Guided Robust Learning against Backdoor Attacks},

author = {Wei Guo and Maura Pintor and Ambra Demontis and Battista Biggio},

year  = {2025},

date = {2025-01-01},

journal = {ArXiv e-prints},

volume = {2509.08748},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{<LineBreak>aghasanli2025recursive,

title = {Recursive SNE: Fast Prototype-Based t-SNE for Large-Scale and Online Data},

author = {Agil Aghasanli and Plamen P Angelov},

url = {https://openreview.net/forum?id=7wCPAFMDWM},

issn = {2835-8856},

year  = {2025},

date = {2025-01-01},

urldate = {2025-01-01},

journal = {Transactions on Machine Learning Research},

abstract = {Dimensionality reduction techniques like t-SNE excel at visualizing structure in highdimensional data but incur high computational costs that limit their use on large or streaming datasets. We introduce the Recursive SNE (RSNE) framework, which extends t-SNE with two complementary strategies: i-RSNE for real-time, point-wise updates and Bi-RSNE for efficient batch processing. Across diverse settings, including standard image benchmarks (CIFAR10/CIFAR100) with DINOv2 and CLIP features, domain-specific iROADS road scenes, neuroimaging data from the Haxby fMRI dataset, and long-term climate records, RSNE delivers substantial speedups over Barnes–Hut t-SNE while maintaining or even improving cluster separability. By combining a lightweight prototype-based initialization with localized KL-divergence refinements, RSNE offers a scalable and adaptable framework for both large-scale offline embedding and on-the-fly visualization of streaming data.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}