Author name cluster

Asaf Shabtai

Possible papers associated with this exact author name in Arrow. This page groups case-insensitive exact name matches and is not a full identity disambiguation profile.

12 papers

2 author rows

AAMAS Conference 2026 Conference Paper

LumiMAS: A Comprehensive Framework for Real-Time Monitoring and Enhanced Observability in Multi-Agent Systems

Ron Solomon
Yarin Yerushalmi Levi
Lior Vaknin
Eran Aizikovich
Amit Baras
Etai Ohana
Amit Giloni
Shamik Bose

The incorporation of large language models in multi-agent systems (MASs) has the potential to significantly improve our ability to autonomously solve complex problems. However, such systems introduceuniquechallengesinmonitoring, interpreting, anddetecting system failures. Most existing MAS observability frameworks focus on analyzing each individual agent separately, overlooking failures associated with the entire MAS. To bridge this gap, we propose LumiMAS, a novel MAS observability framework that incorporates advanced analytics and monitoring techniques. The proposed framework consists of three key components: a monitoring and logging layer, anomaly detection layer, and anomaly explanation layer. LumiMAS’s first layer monitors MAS executions, creating detailed logs of the agents’ activity. These logs serve as input to the anomaly detection layer, which detects anomalies across the MAS workflow in real time. Then, the anomaly explanation layer performs classification and root cause analysis (RCA) of the detected anomalies. LumiMAS was evaluated on seven different MAS applications, implemented using two popular MAS platforms, and a diverse set of possible failures. The applications include two novel failure-tailored applications that illustrate the effects of a hallucination or bias on the MAS. The evaluation results demonstrate LumiMAS’s effectiveness in failure detection, classification, and RCA. This work is licensed under a Creative Commons Attribution International 4. 0 License. Proc. of the 25th International Conference on Autonomous Agents and Multiagent Systems (AAMAS 2026), C. Amato, L. Dennis, V. Mascardi, J. Thangarajah (eds.), May 25 – 29, 2026, Paphos, Cyprus. © 2026 International Foundation for Autonomous Agents and Multiagent Systems (www. ifaamas. org). https: //doi. org/10. 65109/PNWL9707

PDF

AAMAS Conference 2026 Conference Paper

MAStitch: Unifying Local and Global Perspectives for Anomaly Detection in Multi-Agent Systems

Lior Waknin
Yarin Yerushalmi Levi
Ron Solomon
Jaidip Kotak
Amit Giloni
Chiara Picardi
Roman Vainshtein
Yuval Elovici

Large language model (LLM)-based multi-agent systems (MASs) increasingly serve as decision-making and automation pipelines in diverse application domains. Although these systems are highly relied upon in many settings, they have been shown to be vulnerable to various threats, including threats exploited by malicious actors (e. g. , adversarial attacks) and threats stemming from dangerous behavior of the system (e. g. , insecure code generation). Those threats can be viewed as deviations from normal behavior (anomalies), requiring a robust anomaly detection solution. Most approaches for detecting such anomalies concentrate on individual agents, specific failure scenarios, or particular use cases, and often require additional training phases, limiting their applicability and ease of adoption across diverse MASs. To address these limitations, we introduce MAStitch, a platform- and threat-agnostic method for threat detection in MASs that does not require any training, making it well-suited for diverse environments and scenarios requiring plug-and-play detection capabilities. MAStitch leverages local and global perspectives, enabling comprehensive analysis of inter-agent interactions and intra-agent processes to detect anomalies. These perspectives are acquired by a pair of LLM-based agents: a Local Analyzer Agent (LAA), which evaluates each agent’s execution process, and a Global Analyzer Agent (GAA), which aggregates evidence from multiple agents to detect cross-agent failures. The GAA summarizes the anomalous patterns identified, classifies the entire execution log, and provides an explanation when threats are detected. We evaluate our method’s detection performance on six different MAS applications which were developed on two widely This work is licensed under a Creative Commons Attribution International 4. 0 License. Proc. of the 25th International Conference on Autonomous Agents and Multiagent Systems (AAMAS 2026), C. Amato, L. Dennis, V. Mascardi, J. Thangarajah (eds.), May 25 – 29, 2026, Paphos, Cyprus. © 2026 International Foundation for Autonomous Agents and Multiagent Systems (www. ifaamas. org). https: //doi. org/10. 65109/BMJZ4532 used MAS platforms. The evaluation results demonstrate MAStitch’s ability to detect a variety of threats, with an average F1 score of 0. 9 and a minimal false positive rate of 0. 078.

PDF

AAMAS Conference 2026 Conference Paper

Team of Rivals: Hierarchical Deep Reinforcement Learning and Behavior Cloning for Multiplayer Poker

Avishag Shapira
Ido Rom
Asaf Shabtai
Gilad Katz

Multiplayer no-limit Texas Hold’em is considered a challenging benchmark for AI algorithms, due to the need for decision making under partial information, strategic deception, and non-stationary opponents. Classical equilibrium-based techniques do not extend cleanly to the multiplayer setting, and prevailing multiplayer solutions, such as LLMs, tend to be computationally intensive. This study introduces Havoc, a hierarchical deep RL approach that combines behavior cloning of individual human experts with a value-basedmasterpolicythatselects, ateachdecisionpoint, which specialist to deploy. By preserving distinct human play styles in the specialist policies and learning when to deploy them, Havoc adapts itsstrategyrapidlyastableconditionsshift. Despitelimitedtraining data, Havoc attains strong multiplayer performance, outperforming current state-of-the-art methods while also requiring substantially less computational resources.

PDF

ECAI Conference 2025 Conference Paper

CodeCloak: A Method for Mitigating Code Leakage by LLM Code Assistants

Amit Finkman Noah
Avishag Shapira
Eden Bar-Kochva
Inbar Maimon
Dudu Mimran
Yuval Elovici
Asaf Shabtai

Large language model (LLM)-based code assistants are increasingly popular among developers. These tools help improve developers’ coding efficiency and reduce errors by providing real-time suggestions based on the developer’s codebase. While beneficial, the use of these tools can inadvertently expose the developer’s proprietary code to the code assistant service provider during the development process. In this work, we propose a method aimed at mitigating the risk of code leakage when using LLM-based code assistants. CodeCloak is a novel, real-time, deep reinforcement learning agent that manipulates the prompts before sending them to the code assistant model. CodeCloak aims to achieve the following two contradictory objectives: (i) minimizing code leakage, while (ii) preserving relevant and useful suggestions for the developer. Our evaluation performed on multiple code assistant models, demonstrates CodeCloak’s effectiveness on a diverse set of code repositories of varying sizes, as well as its transferability across different models. We validate our approach through human judgment of suggestion quality and testing on complete repositories simulating real development scenarios. The source code is available at: https: //github. com/AmitFinkman/CodeCloak

Details

AAAI Conference 2025 Conference Paper

DOMBA: Double Model Balancing for Access-Controlled Language Models via Minimum-Bounded Aggregation

Tom Segal
Asaf Shabtai
Yuval Elovici

The utility of large language models (LLMs) depends heavily on the quality and quantity of their training data. Many organizations possess large data corpora that could be leveraged to train or fine-tune LLMs tailored to their specific needs. However, these datasets often come with access restrictions that are based on user privileges and enforced by access control mechanisms. Training LLMs on such datasets could result in exposure of sensitive information to unauthorized users. A straightforward approach for preventing such exposure is to train a separate model for each access level. This, however, may result in low utility models due to the limited amount of training data per model compared to the amount in the entire organizational corpus. Another approach is to train a single LLM on all the data while limiting the exposure of unauthorized information. However, current exposure-limiting methods for LLMs are ineffective for access-controlled data, where sensitive information appears frequently across many training examples. We propose DOMBA - double model balancing - a simple approach for training and deploying LLMs that provides high utility and access-control functionality with security guarantees. DOMBA aggregates the probability distributions of two models, each trained on documents with (potentially many) different access levels, using a "min-bounded" average function (a function that is bounded by the smaller value, e.g., harmonic mean). A detailed mathematical analysis and extensive evaluation show that DOMBA safeguards restricted information while offering utility comparable to non-secure models.

PDF Details DOI

ICML Conference 2025 Conference Paper

Gradient Inversion of Multimodal Models

Omri Ben Hemo
Alon Zolfi
Oryan Yehezkel
Omer Hofman
Roman Vainshtein
Hisashi Kojima
Yuval Elovici
Asaf Shabtai

Federated learning (FL) enables privacy-preserving distributed machine learning by sharing gradients instead of raw data. However, FL remains vulnerable to gradient inversion attacks, in which shared gradients can reveal sensitive training data. Prior research has mainly concentrated on unimodal tasks, particularly image classification, examining the reconstruction of single-modality data, and analyzing privacy vulnerabilities in these relatively simple scenarios. As multimodal models are increasingly used to address complex vision-language tasks, it becomes essential to assess the privacy risks inherent in these architectures. In this paper, we explore gradient inversion attacks targeting multimodal vision-language Document Visual Question Answering (DQA) models and propose GI-DQA, a novel method that reconstructs private document content from gradients. Through extensive evaluation on state-of-the-art DQA models, our approach exposes critical privacy vulnerabilities and highlights the urgent need for robust defenses to secure multimodal FL systems.

Details

AAAI Conference 2025 Conference Paper

KDAT: Inherent Adversarial Robustness via Knowledge Distillation with Adversarial Tuning for Object Detection Models

Yarin Yerushalmi Levi
Edita Grolman
Idan Yankelev
Amit Giloni
Omer Hofman
Toshiya Shimizu
Asaf Shabtai
Yuval Elovici

Adversarial patches pose a significant threat to computer vision models' integrity, decreasing the accuracy of various tasks, including object detection (OD). Most existing OD defenses exhibit a trade-off between enhancing the model's adversarial robustness and maintaining its performance on benign images. We propose KDAT (knowledge distillation with adversarial tuning), a novel mechanism that enhances the robustness of an OD model without compromising its performance on benign images or its inference time. Our method combines the knowledge distillation (KD) technique with the adversarial tuning concept to teach the model to match the predictions of adversarial images with those of their corresponding benign ones. To match these predictions, we designed four unique loss components, allowing the student model to effectively distill the knowledge of different features from various parts of the teacher model. Our extensive evaluation on the COCO and INRIA datasets demonstrates KDAT's ability to improve the performance of Faster R-CNN and DETR on benign images by 2-4 mAP% and adversarial examples by 10-15 mAP%, outperforming other state-of-the-art (SOTA) defenses. Furthermore, our additional physical evaluation on the Superstore dataset demonstrates KDAT's SOTA adversarial robustness against printed patches (improvement of 22 mAP% compared to the undefended model).

PDF Details DOI

ECAI Conference 2025 Conference Paper

Multi-Feature Membership Analysis for Tabular Regression Models: Towards Data Sovereignty

Yitschak Cahana
Ido Hersko
Noa Wegerhoff
Yuval Elovici
Asaf Shabtai

The intersection of machine learning (ML) and data privacy has become increasingly critical in safeguarding sensitive information. While membership inference attacks (MIAs) are often viewed as privacy threats, this work utilizes them as a tool for enforcing data sovereignty by detecting unauthorized data usage in ML models. While MIAs are well-studied for classification tasks, their application to regression models, particularly those handling tabular data, remains underexplored. This domain poses unique challenges due to its continuous outputs, high dimensionality, and diverse feature distributions. We present Multi-Feature Membership Analysis (MFMA), a framework that enhances membership inference in regression models through multiple complementary attack features. Our framework includes augmentation statistics, ensemble variation analysis, and targeted perturbation techniques, each capturing different behavioral signals of the model under black-box or semi-black-box access. Our comprehensive evaluation spans multiple datasets, model types, and attack scenarios. MFMA consistently outperforms baseline error-based attacks, with particularly notable improvements in the TPR at low FPR regime — a critical metric for real-world auditing and data ownership claims. These results demonstrate the feasibility and practical relevance of MIAs in tabular regression, and position MFMA as a step toward reliable data-use auditing in deployed ML systems, enabling organizations to enforce data sovereignty and enhance data privacy protection.

Details

ECAI Conference 2024 Conference Paper

DataDetective: Dataset Watermarking for Leaker Identification in ML Training

Noa Wegerhoff
Avishag Shapira
Yuval Elovici
Asaf Shabtai

Data owners (distributors) often share machine learning (ML) datasets with third-party collaborators (agents) for various purposes. While such collaborations can be mutually beneficial, they also introduce the risk of data leakage, i. e. , the deliberate or accidental disclosure of sensitive ML datasets to unauthorized parties. Consequently, distributors may lose their intellectual property, experience reduced revenue, or violate data privacy regulations. In this paper, we propose a novel black-box dataset watermarking approach called DataDetective, which not only detects the unauthorized use of protected datasets but also identifies the agent responsible for the leakage. DataDetective, which leverages a backdoor technique, is composed of two processes: In the dataset watermarking process a unique watermark signature is embedded into each agent’s version of the dataset, which embeds detectable, agent-specific behaviors in any model trained on the data. In the leaker identification process the watermark signature embedded in a suspected model is identified and compared to the signatures of all agents, to identify the leaking agent. Extensive evaluations on benchmark datasets in the computer vision domain demonstrate our method’s effectiveness; DataDetective achieved a perfect leaker identification rate with just 1% of the data watermarked. Moreover, DataDetective maintains the model’s performance with a negligible impact on model accuracy. By providing a verifiable and robust solution for leaker attribution, DataDetective enhances accountability in collaborative ML environments. For more details, the code is available at https: //github. com/NoaWegerhoff/data-detective.

Details

NeurIPS Conference 2024 Conference Paper

DeSparsify: Adversarial Attack Against Token Sparsification Mechanisms

Oryan Yehezkel
Alon Zolfi
Amit Baras
Yuval Elovici
Asaf Shabtai

Vision transformers have shown remarkable advancements in the computer vision domain, demonstrating state-of-the-art performance in diverse tasks (e. g. , image classification, object detection). However, their high computational requirements grow quadratically with the number of tokens used. Token sparsification mechanisms have been proposed to address this issue. These mechanisms employ an input-dependent strategy, in which uninformative tokens are discarded from the computation pipeline, improving the model’s efficiency. However, their dynamism and average-case assumption makes them vulnerable to a new threat vector – carefully crafted adversarial examples capable of fooling the sparsification mechanism, resulting in worst-case performance. In this paper, we present DeSparsify, an attack targeting the availability of vision transformers that use token sparsification mechanisms. The attack aims to exhaust the operating system’s resources, while maintaining its stealthiness. Our evaluation demonstrates the attack’s effectiveness on three token sparsification mechanisms and examines the attack’s transferability between them and its effect on the GPU resources. To mitigate the impact of the attack, we propose various countermeasures.

PDF Details DOI

IS Journal 2018 Journal Article

Transfer Learning for User Action Identication in Mobile Apps via Encrypted Trafc Analysis

Edita Grolman
Andrey Finkelshtein
Rami Puzis
Asaf Shabtai
Gershon Celniker
Ziv Katzir
Liron Rosenfeld

Recent academic studies have demonstrated the possibility of inferring user actions performed in mobile apps by analyzing the resulting encrypted network traffic. Due to the multitude of app versions, mobile operating systems, and device models (collectively referred to in this paper as configurations) previous approaches are not applicable to real life settings. In this work, we ex-tend the ability of these approaches to generalize across different configurations. We treat the different configurations as a case for transfer learning, and adapt the co-training method to sup-port the transfer learning process. Our approach leverages a small number of labeled instances of encrypted traffic from a source configuration, in order to construct a classifier capable of identi-fying a users actions in a different (target) configuration which is completely unlabeled. Experi-ments on real datasets collected from different applications on Android devices show that the proposed method achieves F1 measures over 0. 8 for most of the considered user actions.

Details DOI

TIST Journal 2017 Journal Article

Vertical Ensemble Co-Training for Text Classification

Gilad Katz
Cornelia Caragea
Asaf Shabtai

High-quality, labeled data is essential for successfully applying machine learning methods to real-world text classification problems. However, in many cases, the amount of labeled data is very small compared to that of the unlabeled, and labeling additional samples could be expensive and time consuming. Co-training algorithms, which make use of unlabeled data to improve classification, have proven to be very effective in such cases. Generally, co-training algorithms work by using two classifiers, trained on two different views of the data, to label large amounts of unlabeled data. Doing so can help minimize the human effort required for labeling new data, as well as improve classification performance. In this article, we propose an ensemble-based co-training approach that uses an ensemble of classifiers from different training iterations to improve labeling accuracy. This approach, which we call vertical ensemble, incurs almost no additional computational cost. Experiments conducted on six textual datasets show a significant improvement of over 45% in AUC compared with the original co-training algorithm.

Details DOI