Author name cluster

Fabio Roli

Possible papers associated with this exact author name in Arrow. This page groups case-insensitive exact name matches and is not a full identity disambiguation profile.

12 papers

2 author rows

AAAI Conference 2026 Conference Paper

SOM Directions Are Better than One: Multi-Directional Refusal Suppression in Language Models

Giorgio Piras
Raffaele Mura
Fabio Brau
Luca Oneto
Fabio Roli
Battista Biggio

Refusal refers to the functional behavior enabling safety-aligned language models to reject harmful or unethical prompts. Following the growing scientific interest in mechanistic interpretability, recent work encoded refusal behavior as a single direction in the model’s latent space; e.g., computed as the difference between the centroids of harmful and harmless prompt representations. However, emerging evidence suggests that concepts in LLMs often appear to be encoded as a low-dimensional manifold embedded in the high-dimensional latent space. Motivated by these findings, we propose a novel method leveraging Self-Organizing Maps (SOMs) to extract multiple refusal directions. To this end, we first prove that SOMs generalize the prior work's difference-in-means technique. We then train SOMs on harmful prompt representations to identify multiple neurons. By subtracting the centroid of harmless representations from each neuron, we derive a set of multiple directions expressing the refusal concept. We validate our method on an extensive experimental setup, demonstrating that ablating multiple directions from models' internals outperforms not only the single-direction baseline but also specialized jailbreak algorithms, leading to an effective suppression of refusal. Finally, we conclude by analyzing the mechanistic implications of our approach.

PDF Details DOI

AAAI Conference 2025 Conference Paper

AttackBench: Evaluating Gradient-based Attacks for Adversarial Examples

Antonio Emanuele Cinà
Jérôme Rony
Maura Pintor
Luca Demetrio
Ambra Demontis
Battista Biggio
Ismail Ben Ayed
Fabio Roli

While novel gradient-based attacks are continuously proposed to improve the optimization of adversarial examples, each is shown to outperform its predecessors using different experimental setups, implementations, and computational budgets, leading to biased and unfair comparisons. In this work, we overcome this issue by proposing AttackBench, i.e., an attack evaluation framework that evaluates the effectiveness of each attack (along with its different library implementations) under the same maximum available computational budget. To this end, we (i) define a novel optimality metric that quantifies how close each attack is to the optimal solution (empirically estimated by ensembling all attacks), and (ii) limit the maximum number of forward and backward queries that each attack can execute on the target model. Our extensive experimental analysis compares more than 100 attack implementations over 800 different configurations, considering both CIFAR-10 and ImageNet models, and shows that only a few attack implementations outperform all the remaining approaches. These findings suggest that novel defenses should be evaluated against different attacks than those normally used in the literature to avoid overly-optimistic robustness evaluations. We release AttackBench as a publicly-available benchmark that will be continuously updated with new attack implementations to maintain an up-to-date ranking of the best gradient-based attacks. We release AttackBench as a publicly available benchmark, including a continuously updated leaderboard and source code to maintain an up-to-date ranking of the best gradient-based attacks.

PDF Details DOI

NeurIPS Conference 2025 Conference Paper

TransferBench: Benchmarking Ensemble-based Black-box Transfer Attacks

Fabio Brau
Maura Pintor
Antonio Cinà
Raffaele Mura
Luca Scionis
Luca Oneto
Fabio Roli
Battista Biggio

Ensemble-based black-box transfer attacks optimize adversarial examples on a set of surrogate models, claiming to reach high success rates by querying the (unknown) target model only a few times. In this work, we show that prior evaluations are systematically biased, as such methods are tested only under overly optimistic scenarios, without considering (i) how the choice of surrogate models influences transferability, (ii) how they perform against robust target models, and (iii) whether querying the target to refine the attack is really required. To address these gaps, we introduce TransferBench, a framework for evaluating ensemble-based black-box transfer attacks under more realistic and challenging scenarios than prior work. Our framework considers 17 distinct settings on CIFAR-10 and ImageNet, including diverse surrogate-target combinations, robust targets, and comparisons to baseline methods that do not use any query-based refinement mechanism. Our findings reveal that existing methods fail to generalize to more challenging scenarios, and that query-based refinement offers little to no benefit, contradicting prior claims. These results highlight that building reliable and query-efficient black-box transfer attacks remains an open challenge. We release our benchmark and evaluation code at: https: //github. com/pralab/transfer-bench.

PDF Details

EAAI Journal 2024 Journal Article

Texture and artifact decomposition for improving generalization in deep-learning-based deepfake detection

Jie Gao
Marco Micheletto
Giulia Orrù
Sara Concas
Xiaoyi Feng
Gian Luca Marcialis
Fabio Roli

The harmful utilization of DeepFake technology poses a significant threat to public welfare, precipitating a crisis in public opinion. Existing detection methodologies, predominantly relying on convolutional neural networks and deep learning paradigms, focus on achieving high in-domain recognition accuracy amidst many forgery techniques. However, overseeing the intricate interplay between textures and artifacts results in compromised performance across diverse forgery scenarios. This paper introduces a groundbreaking framework, denoted as Texture and Artifact Detector (TAD), to mitigate the challenge posed by the limited generalization ability stemming from the mutual neglect of textures and artifacts. Specifically, our approach delves into the similarities among disparate forged datasets, discerning synthetic content based on the consistency of textures and the presence of artifacts. Furthermore, we use a model ensemble learning strategy to judiciously aggregate texture disparities and artifact patterns inherent in various forgery types, thereby enabling the model’s generalization ability. Our comprehensive experimental analysis, encompassing extensive intra-dataset and cross-dataset validations along with evaluations on both video sequences and individual frames, confirms the effectiveness of TAD. The results from four benchmark datasets highlight the significant impact of the synergistic consideration of texture and artifact information, leading to a marked improvement in detection capabilities.

Details DOI

EAAI Journal 2023 Journal Article

Wooden spoon crack detection by prior knowledge-enriched deep convolutional network

Lei Li
Zongwei Li
Huijian Han
Lei Yang
Xiaoyi Feng
Fabio Roli
Zhaoqiang Xia

Since the outbreak of COVID-19, in order to reduce people’s contact, the takeaway business has been developed rapidly, bringing a large demand for disposable and degradable tableware (e. g. , wooden spoon). However, in the production process of wooden spoon, the selection of crack spoons still relies on manual labour. Therefore, in order to detect cracked wooden spoons more effectively and reduce production costs, we propose a wooden spoon crack detection method by using machine vision techniques and apply it in real-world industrial factory. In the production system, the captured color of crack regions is black while the good region shows normal log color. The positions of crack regions are located frequently in the central or marginal areas of spoons and their directions of cracks are often same due to the extrusion of the mold in the production process. Based on these two types of prior knowledge (i. e. , color and spatial prior information), three modules are designed to explore these priors by jointly integrating with the current mainstream detection network of YOLO-v5, which satisfies the speed and accuracy for detecting cracks. The color fusion module is designed to explore the color difference between good regions and crack regions. The attention and orientation modules are then combined and embedded into the backbone of deep architecture. Reported experiments on our collected database show that our proposed detection method can locate the spoon cracks very well and significantly outperforms the model of YOLO-v5 with the protocols of R e c a l l, P r e c i s i o n and m e a n A v e r a g e P r e c i s i o n ( m A P ).

Details DOI

NeurIPS Conference 2022 Conference Paper

Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples

Maura Pintor
Luca Demetrio
Angelo Sotgiu
Ambra Demontis
Nicholas Carlini
Battista Biggio
Fabio Roli

Evaluating robustness of machine-learning models to adversarial examples is a challenging problem. Many defenses have been shown to provide a false sense of robustness by causing gradient-based attacks to fail, and they have been broken under more rigorous evaluations. Although guidelines and best practices have been suggested to improve current adversarial robustness evaluations, the lack of automatic testing and debugging tools makes it difficult to apply these recommendations in a systematic manner. In this work, we overcome these limitations by: (i) categorizing attack failures based on how they affect the optimization of gradient-based attacks, while also unveiling two novel failures affecting many popular attack implementations and past evaluations; (ii) proposing six novel \emph{indicators of failure}, to automatically detect the presence of such failures in the attack optimization process; and (iii) suggesting a systematic protocol to apply the corresponding fixes. Our extensive experimental analysis, involving more than 15 models in 3 distinct application domains, shows that our indicators of failure can be used to debug and improve current adversarial robustness evaluations, thereby providing a first concrete step towards automatizing and systematizing them. Our open-source code is available at: https: //github. com/pralab/IndicatorsOfAttackFailure.

PDF Details

NeurIPS Conference 2021 Conference Paper

Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraints

Maura Pintor
Fabio Roli
Wieland Brendel
Battista Biggio

Evaluating adversarial robustness amounts to finding the minimum perturbation needed to have an input sample misclassified. The inherent complexity of the underlying optimization requires current gradient-based attacks to be carefully tuned, initialized, and possibly executed for many computationally-demanding iterations, even if specialized to a given perturbation model. In this work, we overcome these limitations by proposing a fast minimum-norm (FMN) attack that works with different $\ell_p$-norm perturbation models ($p=0, 1, 2, \infty$), is robust to hyperparameter choices, does not require adversarial starting points, and converges within few lightweight steps. It works by iteratively finding the sample misclassified with maximum confidence within an $\ell_p$-norm constraint of size $\epsilon$, while adapting $\epsilon$ to minimize the distance of the current sample to the decision boundary. Extensive experiments show that FMN significantly outperforms existing $\ell_0$, $\ell_1$, and $\ell_\infty$-norm attacks in terms of perturbation size, convergence speed and computation time, while reporting comparable performances with state-of-the-art $\ell_2$-norm attacks. Our open-source code is available at: https: //github. com/pralab/Fast-Minimum-Norm-FMN-Attack.

PDF Details

ICML Conference 2015 Conference Paper

Is Feature Selection Secure against Training Data Poisoning?

Huang Xiao
Battista Biggio
Gavin Brown 0001
Giorgio Fumera
Claudia Eckert 0001
Fabio Roli

Learning in adversarial settings is becoming an important task for application domains where attackers may inject malicious data into the training set to subvert normal operation of data-driven technologies. Feature selection has been widely used in machine learning for security applications to improve generalization and computational efficiency, although it is not clear whether its use may be beneficial or even counterproductive when training data are poisoned by intelligent attackers. In this work, we shed light on this issue by providing a framework to investigate the robustness of popular feature selection methods, including LASSO, ridge regression and the elastic net. Our results on malware detection show that feature selection methods can be significantly compromised under attack (we can reduce LASSO to almost random choices of feature sets by careful insertion of less than 5% poisoned training samples), highlighting the need for specific countermeasures.

Details

EAAI Journal 2009 Journal Article

Designing multiple biometric systems: Measures of ensemble effectiveness

Roberto Tronci
Giorgio Giacinto
Fabio Roli

An “expert” for biometric authentication systems is made up of three components: a biometric sensor, a feature extraction module, and a matching algorithm. As in many application the performance attained by individual experts does not provide the required reliability, improvements can be provided by the combination of different experts. However, there is no guarantee that the combination of any ensemble of experts provides superior performance than those of individual experts. Thus, it would be useful to have some measures to select the experts to be combined. In this paper, we present an experimental evaluation of the correlation between the measures of ensemble effectiveness of the experts to be combined, and the final performance achieved by the combined system. These measures of ensemble effectiveness are based on four performance measures of the individual experts, namely the AUC, the EER, the d ′, and a score dissimilarity measure. Then, we considered four combination methods, i. e. the mean rule, the product rule, the dynamic score selection technique, and a linear combination based on the linear discriminant analysis. Reported results show that the measure of ensemble effectiveness based on the d ′ is the most effective to select the members of an ensemble of experts.

Details DOI

EAAI Journal 2006 Journal Article

Alarm clustering for intrusion detection systems in computer networks

Roberto Perdisci
Giorgio Giacinto
Fabio Roli

Until recently, network administrators manually arranged alarms produced by intrusion detection systems (IDS) to attain a high-level description of cyberattacks. As the number of alarms is increasingly growing, automatic tools for alarm clustering have been proposed to provide such a high-level description of the attack scenarios. In addition, it has been shown that effective threat analysis requires the fusion of different sources of information, such as different IDS. This paper proposes a new strategy to perform alarm clustering which produces unified descriptions of attacks from alarms produced by multiple IDS. In order to be effective, the proposed alarm clustering system takes into account two characteristics of IDS: (i) for a given attack, different sensors may produce a number of alarms reporting different attack descriptions; and (ii) a certain attack description may be produced by the IDS in response to different types of attack. Experimental results show that the high-level alarms produced by the alarm clustering module effectively summarize the attacks, drastically reducing the volume of alarms presented to the administrator. In addition, these high-level alarms can be used as the base to perform further higher-level threat analysis.

Details DOI

JMLR Journal 2006 Journal Article

Spam Filtering Based On The Analysis Of Text Information Embedded Into Images

Giorgio Fumera
Ignazio Pillai
Fabio Roli

In recent years anti-spam filters have become necessary tools for Internet service providers to face up to the continuously growing spam phenomenon. Current server-side anti-spam filters are made up of several modules aimed at detecting different features of spam e-mails. In particular, text categorisation techniques have been investigated by researchers for the design of modules for the analysis of the semantic content of e-mails, due to their potentially higher generalisation capability with respect to manually derived classification rules used in current server-side filters. However, very recently spammers introduced a new trick consisting of embedding the spam message into attached images, which can make all current techniques based on the analysis of digital text in the subject and body fields of e-mails ineffective. In this paper we propose an approach to anti-spam filtering which exploits the text information embedded into images sent as attachments. Our approach is based on the application of state-of-the-art text categorisation techniques to the analysis of text extracted by OCR tools from images attached to e-mails. The effectiveness of the proposed approach is experimentally evaluated on two large corpora of spam e-mails. [abs] [ pdf ][ bib ] &copy JMLR 2006. ( edit, beta )

PDF Details

NeurIPS Conference 2004 Conference Paper

Instance-Based Relevance Feedback for Image Retrieval

Giorgio Gia\-cin\-to
Fabio Roli

High retrieval precision in content-based image retrieval can be attained by adopting relevance feedback mechanisms. These mechanisms require that the user judges the quality of the results of the query by marking all the retrieved images as being either relevant or not. Then, the search engine exploits this information to adapt the search to better meet user's needs. At present, the vast majority of proposed relevance feedback mechanisms are formulated in terms of search model that has to be optimized. Such an optimization involves the modification of some search parameters so that the nearest neighbor of the query vector contains the largest number of relevant images. In this paper, a different approach to relevance feedback is proposed. After the user provides the first feedback, following retrievals are not based on k- nn search, but on the computation of a relevance score for each image of the database. This score is computed as a function of two distances, namely the distance from the nearest non-relevant image and the distance from the nearest relevant one. Images are then ranked according to this score and the top k images are displayed. Reported results on three image data sets show that the proposed mechanism outperforms other state-of-the-art relevance feedback mechanisms.

PDF Details