@inproceedings{22294,
  abstract     = {Modern computer systems store vast amounts of personal data, enabling advances in AI and ML but risking user privacy and trust. For privacy reasons, it is sometimes desired for an ML model to forget part of the data it was trained on. In this paper, we introduce a novel unlearning approach based on Forgetting Neural Networks (FNNs), a neuroscience-inspired architecture that explicitly encodes forgetting through multiplicative decay factors. While FNNs had previously been studied as a theoretical construct, we provide the first concrete implementation and demonstrate their effectiveness for targeted unlearning. We propose several variants with per-neuron forgetting factors, including rank-based assignments guided by activation levels, and evaluate them on MNIST and Fashion-MNIST benchmarks. Our method systematically removes information associated with forget sets while preserving performance on retained data. Membership inference attacks confirm the effectiveness of FNN-based unlearning in erasing information about the training data from the neural network. These results establish FNNs as a promising foundation for efficient and interpretable unlearning. },
  author       = {Hatua, Amartya and Nguyen, Trung and Cano Cordoba, Filip and Sung, Andrew},
  booktitle    = {Proceedings of the 18th International Conference on Agents and Artificial Intelligence},
  isbn         = {9789897587962},
  issn         = {2184-433X},
  keywords     = {Machine Unlearning, Neuroscience-Inspired Machine Learning, Membership Inference Attacks},
  location     = {Marbella, Spain},
  pages        = {1536--1546},
  publisher    = {SciTePress},
  title        = {{Machine unlearning using forgetting neural networks}},
  doi          = {10.5220/0014326500004052},
  volume       = {2},
  year         = {2026},
}

@inproceedings{22146,
  abstract     = {We study differentially private model training with stochastic gradient descent under learning rate scheduling and correlated noise. Although correlated noise, in particular via matrix factorizations, has been shown to improve accuracy, prior theoretical work focused primarily on the prefix-sum workload. That workload assumes a constant learning rate, whereas in practice learning rate schedules are widely used to accelerate training and improve convergence. We close this gap by deriving general upper and lower bounds for a broad class of learning rate schedules in both single- and multi-epoch settings. Building on these results, we propose a learning-rate-aware factorization that achieves improvements over prefix-sum factorizations under both MaxSE and MeanSE error metrics. Our theoretical analysis yields memory-efficient constructions suitable for practical deployment, and experiments on CIFAR-10 and IMDB datasets confirm that schedule-aware factorizations improve accuracy in private training.},
  author       = {Kalinin, Nikita and Andersson, Joel D},
  booktitle    = {7th Symposium on Foundations of Responsible Computing},
  isbn         = {9783959774192},
  issn         = {1868-8969},
  keywords     = {differential privacy, machine learning, matrix factorization},
  location     = {Cambridge, MA; United States},
  publisher    = {Schloss Dagstuhl - Leibniz-Zentrum für Informatik},
  title        = {{Learning rate scheduling with matrix factorization for private training}},
  doi          = {10.4230/LIPIcs.FORC.2026.2},
  volume       = {368},
  year         = {2026},
}

@phdthesis{22873,
  author       = {Ehrmann, Andreas},
  isbn         = {978-3-99078-092-3},
  issn         = {2663-337X},
  keywords     = {PhD Thesis, functional nanomachines, biological functionality, nanotechnology, energy delivery, target behavior, dynamics, design principles, optimization, differentiable statistical physics, machine learning},
  pages        = {168},
  publisher    = {Institute of Science and Technology Austria},
  title        = {{Biological functionality without biochemistry: Designing nanomachines for target behavior}},
  doi          = {10.15479/AT-ISTA-22873},
  year         = {2026},
}

@phdthesis{22857,
  abstract     = {Artificial intelligence and machine learning have undergone an unprecedented evolution in the past decade, motivating a research effort toward a theory able to capture the qualitative behavior of large-scale neural systems. A central puzzle has been the clear benefit of scaling architecture size and overfitting the training set in supervised learning tasks. This evidence, in apparent contradiction with classical statistical learning theory, pushed researchers to develop a new theory capturing the interplay between the algorithmic and architectural bias of training and the specific target function, differently from previous methods rooted in uniform stability.
This approach has enabled a grounded understanding of novel learning regimes, typically through formal limits where the number of training samples $n$, data dimensions $d$, and model parameters $p$ grow to infinity at different rates. \\
In this thesis, we follow this approach, focusing on the trustworthiness of high-dimensional models: properties that are difficult to control during training or deployment and often emerge under unpredictable or adversarial conditions. In such settings, it is crucial to formally ensure a priori the reliability of machine learning systems.
First, we study data memorization, both as label fitting and as the storage of private information about training samples in trained parameters. We prove that $p = \Omega(n)$ parameters are sufficient for a deep neural network to memorize a generic set of labels, and for a model to memorize spurious features across training data. We then give evidence that $p = \Omega(dn)$ parameters are instead necessary for an adversary to reconstruct the full training set from the trained parameters.
Second, we study robustness, both to adversarial perturbations and to distribution shift. We first prove that $p = \Omega(dn)$ parameters can be sufficient for a class of neural networks to overfit the training data while guaranteeing robustness to adversarial perturbations. Then, we focus on spurious correlations learning in high-dimensional regression, studying the effect of the ridge regularization parameter in the proportional regime $n = \Theta(d)$, and connecting it via an equivalence argument to the role of over-parameterization $p = \Omega(n)$ in neural networks. We also investigate the architectural bias of attention-based networks, showing that they are sensitive to the replacement of individual words in an embedded sentence, allowing them to generalize on sentences where the contextual meaning depends on one or few words.
Finally, we study differentially private optimization in high-dimensional regimes. We prove that standard private gradient methods do not suffer in the over-parameterized regime $p = \Omega(n)$, challenging the current wisdom based on stability-derived generalization bounds. We then consider linear regression in the proportional regime $n = \Theta(d)$, showing that standard private gradient descent can achieve optimal rates under appropriate hyper-parameter scaling, such as sufficiently small gradient clipping constants, whose role is still debated in practice.},
  author       = {Bombari, Simone},
  isbn         = {978-3-99078-091-6},
  issn         = {2663-337X},
  keywords     = {machine learning, high-dimensional statistics, deep learning theory, privacy, memorization, robustness},
  pages        = {446},
  publisher    = {Institute of Science and Technology Austria},
  title        = {{Trustworthy machine learning in high dimensions}},
  doi          = {10.15479/AT-ISTA-22857},
  year         = {2026},
}

@phdthesis{10799,
  abstract     = {Because of the increasing popularity of machine learning methods, it is becoming important to understand the impact of learned components on automated decision-making systems and to guarantee that their consequences are beneficial to society. In other words, it is necessary to ensure that machine learning is sufficiently trustworthy to be used in real-world applications. This thesis studies two properties of machine learning models that are highly desirable for the
sake of reliability: robustness and fairness. In the first part of the thesis we study the robustness of learning algorithms to training data corruption. Previous work has shown that machine learning models are vulnerable to a range
of training set issues, varying from label noise through systematic biases to worst-case data manipulations. This is an especially relevant problem from a present perspective, since modern machine learning methods are particularly data hungry and therefore practitioners often have to rely on data collected from various external sources, e.g. from the Internet, from app users or via crowdsourcing. Naturally, such sources vary greatly in the quality and reliability of the
data they provide. With these considerations in mind, we study the problem of designing machine learning algorithms that are robust to corruptions in data coming from multiple sources. We show that, in contrast to the case of a single dataset with outliers, successful learning within this model is possible both theoretically and practically, even under worst-case data corruptions. The second part of this thesis deals with fairness-aware machine learning. There are multiple areas where machine learning models have shown promising results, but where careful considerations are required, in order to avoid discrimanative decisions taken by such learned components. Ensuring fairness can be particularly challenging, because real-world training datasets are expected to contain various forms of historical bias that may affect the learning process. In this thesis we show that data corruption can indeed render the problem of achieving fairness impossible, by tightly characterizing the theoretical limits of fair learning under worst-case data manipulations. However, assuming access to clean data, we also show how fairness-aware learning can be made practical in contexts beyond binary classification, in particular in the challenging learning to rank setting.},
  author       = {Konstantinov, Nikola H},
  isbn         = {978-3-99078-015-2},
  issn         = {2663-337X},
  keywords     = {robustness, fairness, machine learning, PAC learning, adversarial learning},
  pages        = {176},
  publisher    = {Institute of Science and Technology Austria},
  title        = {{Robustness and fairness in machine learning}},
  doi          = {10.15479/at:ista:10799},
  year         = {2022},
}

@article{10802,
  abstract     = {Addressing fairness concerns about machine learning models is a crucial step towards their long-term adoption in real-world automated systems. While many approaches have been developed for training fair models from data, little is known about the robustness of these methods to data corruption. In this work we consider fairness-aware learning under worst-case data manipulations. We show that an adversary can in some situations force any learner to return an overly biased classifier, regardless of the sample size and with or without degrading
accuracy, and that the strength of the excess bias increases for learning problems with underrepresented protected groups in the data. We also prove that our hardness results are tight up to constant factors. To this end, we study two natural learning algorithms that optimize for both accuracy and fairness and show that these algorithms enjoy guarantees that are order-optimal in terms of the corruption ratio and the protected groups frequencies in the large data
limit.},
  author       = {Konstantinov, Nikola H and Lampert, Christoph},
  issn         = {1533-7928},
  journal      = {Journal of Machine Learning Research},
  keywords     = {Fairness, robustness, data poisoning, trustworthy machine learning, PAC learning},
  pages        = {1--60},
  publisher    = {ML Research Press},
  title        = {{Fairness-aware PAC learning from corrupted data}},
  volume       = {23},
  year         = {2022},
}

@phdthesis{11362,
  abstract     = {Deep learning has enabled breakthroughs in challenging computing problems and has emerged as the standard problem-solving tool for computer vision and natural language processing tasks.
One exception to this trend is safety-critical tasks where robustness and resilience requirements contradict the black-box nature of neural networks. 
To deploy deep learning methods for these tasks, it is vital to provide guarantees on neural network agents' safety and robustness criteria. 
This can be achieved by developing formal verification methods to verify the safety and robustness properties of neural networks.

Our goal is to design, develop and assess safety verification methods for neural networks to improve their reliability and trustworthiness in real-world applications.
This thesis establishes techniques for the verification of compressed and adversarially trained models as well as the design of novel neural networks for verifiably safe decision-making.

First, we establish the problem of verifying quantized neural networks. Quantization is a technique that trades numerical precision for the computational efficiency of running a neural network and is widely adopted in industry.
We show that neglecting the reduced precision when verifying a neural network can lead to wrong conclusions about the robustness and safety of the network, highlighting that novel techniques for quantized network verification are necessary. We introduce several bit-exact verification methods explicitly designed for quantized neural networks and experimentally confirm on realistic networks that the network's robustness and other formal properties are affected by the quantization.

Furthermore, we perform a case study providing evidence that adversarial training, a standard technique for making neural networks more robust, has detrimental effects on the network's performance. This robustness-accuracy tradeoff has been studied before regarding the accuracy obtained on classification datasets where each data point is independent of all other data points. On the other hand, we investigate the tradeoff empirically in robot learning settings where a both, a high accuracy and a high robustness, are desirable.
Our results suggest that the negative side-effects of adversarial training outweigh its robustness benefits in practice.

Finally, we consider the problem of verifying safety when running a Bayesian neural network policy in a feedback loop with systems over the infinite time horizon. Bayesian neural networks are probabilistic models for learning uncertainties in the data and are therefore often used on robotic and healthcare applications where data is inherently stochastic.
We introduce a method for recalibrating Bayesian neural networks so that they yield probability distributions over safe decisions only.
Our method learns a safety certificate that guarantees safety over the infinite time horizon to determine which decisions are safe in every possible state of the system.
We demonstrate the effectiveness of our approach on a series of reinforcement learning benchmarks.},
  author       = {Lechner, Mathias},
  isbn         = {978-3-99078-017-6},
  keywords     = {neural networks, verification, machine learning},
  pages        = {124},
  publisher    = {Institute of Science and Technology Austria},
  title        = {{Learning verifiable representations}},
  doi          = {10.15479/at:ista:11362},
  year         = {2022},
}

@unpublished{11627,
  abstract     = {For a solar-like star, the surface rotation evolves with time, allowing in principle to estimate the age of a star from its surface rotation period. Here we are interested in measuring surface rotation periods of solar-like stars observed by the NASA mission Kepler. Different methods have been developed to track rotation signals in Kepler photometric light curves: time-frequency analysis based on wavelet techniques, autocorrelation and composite spectrum. We use the learning abilities of random forest classifiers to take decisions during two crucial steps of the analysis. First, given some input parameters, we discriminate the considered Kepler targets between rotating MS stars, non-rotating MS stars, red giants, binaries and pulsators. We then use a second classifier only on the MS rotating targets to decide the best data analysis treatment.},
  author       = {Breton, S. N. and Bugnet, Lisa Annabelle and Santos, A. R. G. and Saux, A. Le and Mathur, S. and Palle, P. L. and Garcia, R. A.},
  booktitle    = {arXiv},
  keywords     = {asteroseismology, rotation, solar-like stars, kepler, machine learning, random forest},
  title        = {{Determining surface rotation periods of solar-like stars observed by the Kepler mission using machine learning techniques}},
  doi          = {10.48550/arXiv.1906.09609},
  year         = {2019},
}

@unpublished{11630,
  abstract     = {The second mission of NASA’s Kepler satellite, K2, has collected hundreds of thousands of lightcurves for stars close to the ecliptic plane. This new sample could increase the number of known pulsating stars and then improve our understanding of those stars. For the moment only a few stars have been properly classified and published. In this work, we present a method to automaticly classify K2 pulsating stars using a Machine Learning technique called Random Forest. The objective is to sort out the stars in four classes: red giant (RG), main-sequence Solar-like stars (SL), classical pulsators (PULS) and Other. To do this we use the effective temperatures and the luminosities of the stars as well as the FliPer features, that measures the amount of power contained in the power spectral density. The classifier now retrieves the right classification for more than 80% of the stars.},
  author       = {Saux, A. Le and Bugnet, Lisa Annabelle and Mathur, S. and Breton, S. N. and Garcia, R. A.},
  booktitle    = {arXiv},
  keywords     = {asteroseismology - methods, data analysis - thecniques, machine learning - stars, oscillations},
  title        = {{Automatic classification of K2 pulsating stars using machine learning techniques}},
  doi          = {10.48550/arXiv.1906.09611},
  year         = {2019},
}