Publications

@unpublished{dost2025freshwater,

title = {Freshwater Quality Modeling in Aotearoa New Zealand: Current Practice and Future Directions},

author = {Katharina Dost and Kohji Muraoka and Anne-Gaelle Ausseil and Rubianca Benavidez and Brendan Blue and Nic Coland and Chris Daughney and Annette Semadeni-Davies and Linh Hoang and Anna Hooper and Theodore Alfred Kpodonu and Tapuwa Marapara and Richard W. McDowell and Trung Nguyen and Dang Anh Nguyet and Ned Norton and Deniz \"{O}zkundakci and Lisa Pearson and James Rolinson and Ra Smith and Tom Stephens and Reina Tamepo and Ken Taylor and Vincent van Uitregt and Bethanna Jackson and Theo Sarris and Alexander Elliott and J\"{o}rg Wicker },

doi = {10.2139/ssrn.5105393},

year  = {2025},

date = {2025-01-21},

urldate = {2025-01-21},

journal = {SSRN},

howpublished = {SSRN},

keywords = {best practice, Catchment modeling process, machine learning, model trustworthiness, Modelling platform design, reliable machine learning, root-cause analysis, water quality},

pubstate = {forthcoming},

tppubtype = {unpublished}

}

@unpublished{dost2023defining,

title = {Defining Applicability Domain in Biodegradation Pathway Prediction},

author = {Katharina Dost and Jason Tam and Tim Lorsbach and Sebastian Schmidt and J\"{o}rg Wicker},

doi = {https://doi.org/10.21203/rs.3.rs-3587632/v1},

year  = {2023},

date = {2023-11-10},

urldate = {2023-11-10},

abstract = {When developing a new chemical, investigating its long-term influences on the environment is crucial to prevent harm. Unfortunately, these experiments are time-consuming. In silico methods can learn from already obtained data to predict biotransformation pathways, and thereby help focus all development efforts on only the most promising chemicals. As all data-based models, these predictors will output pathway predictions for all input compounds in a suitable format, however, these predictions will be faulty unless the model has seen similar compounds during the training process. A common approach to prevent this for other types of models is to define an Applicability Domain for the model that makes predictions only for in-domain compounds and rejects out-of-domain ones. Nonetheless, although exploration of the compound space is particularly interesting in the development of new chemicals, no Applicability Domain method has been tailored to the specific data structure of pathway predictions yet. In this paper, we are the first to define Applicability Domain specialized in biodegradation pathway prediction. Assessing a model’s reliability from different angles, we suggest a three-stage approach that checks for applicability, reliability, and decidability of the model for a queried compound and only allows it to output a prediction if all three stages are passed. Experiments confirm that our proposed technique reliably rejects unsuitable compounds and therefore improves the safety of the biotransformation pathway predictor. },

keywords = {applicability domain, biodegradation, cheminformatics, computational sustainability, enviPath, machine learning, metabolic pathways, reliable machine learning},

pubstate = {forthcoming},

tppubtype = {unpublished}

}

@unpublished{Chang2023poison,

title = {Poison is Not Traceless: Fully-Agnostic Detection of Poisoning Attacks },

author = {Xinglong Chang and Katharina Dost and Gillian Dobbie and J\"{o}rg Wicker},

url = {http://arxiv.org/abs/2310.16224},

doi = {10.48550/arXiv.2310.16224},

year  = {2023},

date = {2023-10-23},

urldate = {2023-10-23},

abstract = {The performance of machine learning models depends on the quality of the underlying data. Malicious actors can attack the model by poisoning the training data. Current detectors are tied to either specific data types, models, or attacks, and therefore have limited applicability in real-world scenarios. This paper presents a novel fully-agnostic framework, Diva (Detecting InVisible Attacks), that detects attacks solely relying on analyzing the potentially poisoned data set. Diva is based on the idea that poisoning attacks can be detected by comparing the classifier’s accuracy on poisoned and clean data and pre-trains a meta-learner using Complexity Measures to estimate the otherwise unknown accuracy on a hypothetical clean dataset. The framework applies to generic poisoning attacks. For evaluation purposes, in this paper, we test Diva on label-flipping attacks.},

keywords = {adversarial defence, adversarial learning, machine learning, reliable machine learning},

pubstate = {forthcoming},

tppubtype = {unpublished}

}

@unpublished{Chang2023fast,

title = {Fast Adversarial Label-Flipping Attack on Tabular Data},

author = {Xinglong Chang and Gillian Dobbie and J\"{o}rg Wicker},

url = {https://arxiv.org/abs/2310.10744},

doi = {10.48550/arXiv.2310.10744},

year  = {2023},

date = {2023-10-16},

urldate = {2023-10-16},

abstract = {Machine learning models are increasingly used in fields that require high reliability such as cybersecurity. However, these models remain vulnerable to various attacks, among which the adversarial label-flipping attack poses significant threats. In label-flipping attacks, the adversary maliciously flips a portion of training labels to compromise the machine learning model. This paper raises significant concerns as these attacks can camouflage a highly skewed dataset as an easily solvable classification problem, often misleading machine learning practitioners into lower defenses and miscalculations of potential risks. This concern amplifies in tabular data settings, where identifying true labels requires expertise, allowing malicious label-flipping attacks to easily slip under the radar. To demonstrate this risk is inherited in the adversary\'s objective, we propose FALFA (Fast Adversarial Label-Flipping Attack), a novel efficient attack for crafting adversarial labels. FALFA is based on transforming the adversary\'s objective and employs linear programming to reduce computational complexity. Using ten real-world tabular datasets, we demonstrate FALFA\'s superior attack potential, highlighting the need for robust defenses against such threats. },

keywords = {adversarial learning, machine learning, reliable machine learning},

pubstate = {forthcoming},

tppubtype = {unpublished}

}