Author name cluster

Amir Houmansadr

Possible papers associated with this exact author name in Arrow. This page groups case-insensitive exact name matches and is not a full identity disambiguation profile.

5 papers

2 author rows

TMLR Journal 2026 Journal Article

ULTra: Unveiling Latent Token Interpretability in Transformer-Based Understanding and Segmentation

Hesam Hosseini
Ghazal Hosseini Mighan
Amirabbas Afzali
Sajjad Amini
Amir Houmansadr

Transformers have revolutionized Computer Vision (CV) through self-attention mechanisms. However, their complexity makes latent token representations difficult to interpret. We introduce ULTra, a framework for interpreting Transformer embeddings and uncovering meaningful semantic patterns within them. ULTra enables unsupervised semantic segmentation using pre-trained models without requiring fine-tuning. Additionally, we propose a self-supervised training approach that refines segmentation performance by learning an external transformation matrix without modifying the underlying model. Our method achieves state-of-the-art performance in unsupervised semantic segmentation, outperforming existing segmentation methods. Furthermore, we validate ULTra for model interpretation on both synthetic and real-world scenarios, including Object Selection and interpretable text summarization using LLMs, demonstrating its broad applicability in explaining the semantic structure of latent token representations.

PDF Details

AAAI Conference 2025 Conference Paper

Improving Private Random Forest Prediction Using Matrix Representation

Arisa Tajima
Joie Wu
Amir Houmansadr

We introduce a novel matrix representation for differentially private training and prediction methods tailored to random forest classifiers. Our approach involves representing each root-to-leaf decision path in all trees as a row vector in a matrix. Similarly, inference queries are represented as a matrix. This representation enables us to collectively analyze privacy across multiple trees and inference queries, resulting in optimal DP noise allocation under the Laplace Mechanism. Our experimental results show significant accuracy improvements of up to 40% compared to state-of-the-art methods.

PDF Details DOI

NeurIPS Conference 2024 Conference Paper

OSLO: One-Shot Label-Only Membership Inference Attacks

Yuefeng Peng
Jaechul Roh
Subhransu Maji
Amir Houmansadr

We introduce One-Shot Label-Only (OSLO) membership inference attacks (MIAs), which accurately infer a given sample's membership in a target model's training set with high precision using just a single query, where the target model only returns the predicted hard label. This is in contrast to state-of-the-art label-only attacks which require $\sim6000$ queries, yet get attack precisions lower than OSLO's. OSLO leverages transfer-based black-box adversarial attacks. The core idea is that a member sample exhibits more resistance to adversarial perturbations than a non-member. We compare OSLO against state-of-the-art label-only attacks and demonstrate that, despite requiring only one query, our method significantly outperforms previous attacks in terms of precision and true positive rate (TPR) under the same false positive rates (FPR). For example, compared to previous label-only MIAs, OSLO achieves a TPR that is at least 7$\times$ higher under a 1\% FPR and at least 22$\times$ higher under a 0. 1\% FPR on CIFAR100 for a ResNet18 model. We evaluated multiple defense mechanisms against OSLO.

PDF Details DOI

ICML Conference 2023 Conference Paper

Effectively Using Public Data in Privacy Preserving Machine Learning

Milad Nasr
Saeed Mahloujifar
Xinyu Tang 0003
Prateek Mittal
Amir Houmansadr

Differentially private (DP) machine learning techniques are notorious for their degradation of model utility (e. g. , they degrade classification accuracy). A recent line of work has demonstrated that leveraging public data can improve the trade-off between privacy and utility when training models with DP guaranteed. In this work, we further explore the potential of using public data in DP models, showing that utility gains can in fact be significantly higher than what shown in prior works. Specifically, we introduce DOPE-SGD, a modified DP-SGD algorithm that leverages public data during its training. DOPE-SGD uses public data in two complementary ways: (1) it uses advance augmentation techniques that leverages public data to generate synthetic data that is effectively embedded in multiple steps of the training pipeline; (2) it uses a modified gradient clipping mechanism (which is a standard technique in DP training) to change the origin of gradient vectors using the information inferred from available public and synthetic data, therefore boosting utility. We also introduce a technique to ensemble intermediate DP models by leveraging the post processing property of differential privacy to further improve the accuracy of the predictions. Our experimental results demonstrate the effectiveness of our approach in improving the state-of-the-art in DP machine learning across multiple datasets, network architectures, and application domains. For instance, assuming access to $2, 000$ public images, and for a privacy budget of $\varepsilon=2, \delta=10^{-5}$, our technique achieves an accuracy of $75. 1%$ on CIFAR10, significantly higher than $68. 1%$ achieved by the state of the art.

Details

AAAI Conference 2021 Conference Paper

Membership Privacy for Machine Learning Models Through Knowledge Transfer

Virat Shejwalkar
Amir Houmansadr

Large capacity machine learning (ML) models are prone to membership inference attacks (MIAs), which aim to infer whether the target sample is a member of the target model’s training dataset. The serious privacy concerns due to the membership inference have motivated multiple defenses against MIAs, e. g. , differential privacy and adversarial regularization. Unfortunately, these defenses produce ML models with unacceptably low classification performances. Our work proposes a new defense, called distillation for membership privacy (DMP), against MIAs that preserves the utility of the resulting models significantly better than prior defenses. DMP leverages knowledge distillation to train ML models with membership privacy. We provide a novel criterion to tune the data used for knowledge transfer in order to amplify the membership privacy of DMP. Our extensive evaluation shows that DMP provides significantly better tradeoffs between membership privacy and classification accuracies compared to state-of-the-art MIA defenses. For instance, DMP achieves ∼100% accuracy improvement over adversarial regularization for DenseNet trained on CIFAR100, for similar membership privacy (measured using MIA risk): when the MIA risk is 53. 7%, adversarially regularized DenseNet is 33. 6% accurate, while DMPtrained DenseNet is 65. 3% accurate. We have released our code at github. com/vrt1shjwlkr/AAAI21-MIA-Defense.

PDF Details