- nexa - server-nexa.polito.it

Supply Chain Attacks On AI
by Alberto Cammozzo April 12, 2022

April 12, 2022

<https://www.forbes.com/sites/forbestechcouncil/2022/04/11/supply-chain-atta…> I recently listened to a great podcast by Google's cybersecurity experts on the topic of secure artificial intelligence (AI). The range of issues raised seemed, to me, very interesting and relevant. But because the podcast was limited in time, some of the extremely important topics were covered only too briefly. That's why I decided to take a closer look at some of the topics raised in the podcast—and this has become the article you're reading right now. AI Risks The topic of AI risks, especially when related to security, is currently gaining more popularity. For example, back in 2020, when my company collected information on the most critical security-related AI incidents of the past decade, we were only able to mention six. However, more recently, it was difficult for us to determine the most significant ones for the list of the 10 most notorious AI incidents in 2021. I won't go into detail on each incident now, but I will mention the facial recognition bypass incident in which a man attempted to steal over $2.5 million in state funds, and the Zillow case, which resulted in a $6 billion drop in the company's valuation. As a result, Zillow had to lay off 25% of its workforce and sell 7,000 homes with a total asset value in excess of the $2.8 billion previously acquired. The reason for this is that routine machine learning models can lead to extremely serious consequences if mismanaged. Although the last case is not directly related to security and was caused more by an algorithm error, it nonetheless demonstrates one very important idea: The losses associated with incidents in AI can be very large-scale. The point is that AI applications, by their very nature, will be responsible for making smarter decisions than traditional software. As a rule, the "smarter" the system is, the more important and critical decisions are entrusted to this system—more important decisions involve greater responsibility, and, as a result, greater consequences can occur if the decisions are wrong. Just imagine the consequences of attacks in cyber-physical worlds with autonomous cars, smart cities and a variety of systems based on computer vision automation. If you think such attacks are implausible, I hasten to disappoint you, as all the systems mentioned above have already been attacked as part of many research projects. Such situations occurring in reality is only a matter of time. In fact, cybercriminals just have to find an attractive victim and use case with a good "attack-market fit." And it seems that one of the attack-market fit examples can happen quite soon. Supply Chain Attacks On AI One of the interesting topics mentioned in the podcast was supply chain attacks, which are an incredibly big threat right now. We mainly see examples of them related to traditional software, where an open-source library that is implemented in several or even millions of places is vulnerable—which can potentially lead to the collapse of almost any enterprise around the world, as happened recently with Log4j. But very little information about similar cases related to AI is known to a wide audience. The podcast, however, mentioned one example of a supply chain attack on AI called poisoning. And this, alas, is a completely realistic situation. Someone can poison a dataset in such a way that when it is used to train a system, the system will be poisoned and make wrong decisions. Such a situation could put at risk every company that deals with users' data, such as internet platforms and social networks. AI algorithms can be retrained to make the wrong decisions, and this presents a great opportunity for third parties: Scammers can use this to make AI more biased and then blame the AI companies for it. However, there are other variants of supply chain attacks that were not mentioned in the podcast, such as AI trojans and AI backdoors. AI trojans are methods of modifying a trained AI model so that it will only perform certain actions when given certain inputs. Let's say you have affected the image classification model in such a way that a certain type of weapon is not detected by the AI model that manages their transfer and storage. In terms of carrying out such an attack, someone can hack into the model hosting server and upload Trojan models. This is a very realistic scenario because most AI solutions use pre-trained models, and there is a good chance that this model will be ubiquitous. AI backdoors are almost the same, but the difference is that they are implemented at the model training stage by the authors of the model. For example, some facial recognition vendors may train a model to recognize a particular face as a "universal" key, then this system will be sent out and implemented at hundreds of facilities. These backdoors are very difficult to identify because AI is usually based on deep neural networks, and we still struggle to understand how they work in normal situations, let alone adversarial ones. There needs to be completely new ways of identifying the presence of such backdoors and better methods of dealing with them. While nothing is being done, know that in the hands of attackers, these exploits present huge opportunities that can fatally harm your company. Solutions What can you do right now? Of course, if your core business functions are dependent on AI decisions or you develop AI, then it's critical to enforce security measures in each step of your AI development—from the design and development process itself to testing and operations. For companies that consume AI solutions, it's essential to start with asset inventory and understand where you use AI, who is responsible for it, whether deployed AI systems are based on open-source models with vulnerabilities and whether the vendors are taking care of AI security.

1 0

Lo sguardo della videosorveglianza nelle imprese. Scenari di Intelligenza Artificiale e Digital Forensics”
by Mauro Alovisio April 11, 2022

April 11, 2022

Gent.mi segnalo webseminar gratuito dalle ore 15 grazie a Università di Bologna Lo sguardo della videosorveglianza nelle imprese. Scenari di Intelligenza Artificiale e Digital Forensics” Redazione <http://www.csigivreatorino.it/author/redazione/>7 Aprile 2022 <http://www.csigivreatorino.it/lo-sguardo-della-videosorveglianza-nelle-impr…> 0 Commenti <http://www.csigivreatorino.it/lo-sguardo-della-videosorveglianza-nelle-impr…> <http://www.csigivreatorino.it/wp-content/uploads/2022/04/istockphoto-182214…> All’interno dei seminari di Informatica Giuridica dell’Università di Bologna, organizzati dalla *prof.ssa Raffaella Brighi*, segnaliamo il seminario *“Lo sguardo della videosorveglianza nelle imprese. Scenari di Intelligenza Artificiale e Digital Forensics”* Il seminario si terrà il giorno *11 aprile 2022 dalle ore 15 alle ore 18* Fra i relatori: - *Mauro Alovisio* (Università degli Studi di Torino, Presidente CSIG-Ivrea) - *Alessandro Del Ninno *(Università degli Studi LUISS -Guido Carli e comitato scientifico Csig) - *Michele Ferrazzano* (Università di Bologna, CRID-Unimore) A partire dal volume ” Videosorveglianza e GDPR” a cura di M. Alovisio (Giuffrè, 2021) con contributi di Alberto Culatina, Alessandro Del Ninno, Nicola Di Mare, Stefano Manzelli, Stefano Tresoldi L’evento è organizzato in collaborazione con i centro Studi di Informatica Giuridica di Bologna v. locandina Locandina 11 aprile <http://www.csigivreatorino.it/wp-content/uploads/2022/04/Locandina-11-april…> Programma 2022_Locandina_COMPLETA <http://www.csigivreatorino.it/wp-content/uploads/2022/04/2022_Locandina_COM…> Per partecipare all’incontro online clicca qui: https://tinyurl.com/43rast7z

1 0

Memento | 150° Mercoledì di Nexa | 13 Aprile 2022
by Nexa Media April 11, 2022

April 11, 2022

Gentilissimi, vi ricordiamo che *mercoledì 13 aprile**,**dalle ore 18.00 alle ore 20.00*, si svolgerà il 150° Mercoledì di Nexa, con un incontro dal titolo: /*"Il concetto di mente estesa"*/. Ospite: *Alfredo Paternoster* (Università degli Studi di Bergamo). Il Prof. Paternoster presenterà il modello della mente estesa (MME), introducendo il concetto all'interno del contesto in cui è stato proposto, per discutere quindi alcuni degli argomenti a favore e contro. Concluderà, infine, esponendo un moderato scetticismo sulla cogenza di tale nozione, pur riconoscendone la rilevanza epistemologica. Sarà possibile partecipare al seminario connettendosi al seguente indirizzo: https://didattica.polito.it/VClass/NexaEvent Sarà possibile guardare la diretta streaming dell'incontro al seguente link: https://youtu.be/BFnykAFsY-Q Maggiori informazioni sull'evento sono disponibili alla pagina: https://nexa.polito.it/mercoledi-150 Cordiali saluti,   -- Anita Botta Communication Manager Nexa Center for Internet & Society Politecnico di Torino – DAUIN Corso Duca degli Abruzzi, 24 - 10129 Torino web: https://nexa.polito.it/ mail: anita.botta(a)polito.it tel: 011 090 7219

1 0

Logic4Peace: fundraising online Logic event for Peace
by Diego.Latella April 7, 2022

April 7, 2022

Logic4Peace: fundraising online Logic event for Peace https://events.illc.uva.nl/Logic4Peace/About/ Mi scuso per l'uso forse un po' improprio della lista Diego -- Dott. Diego Latella - Senior Researcher CNR/ISTI, Via Moruzzi 1, 56124 Pisa, Italy (http:www.isti.cnr.it [1]) FM&&T Lab. (http://fmt.isti.cnr.it) CNR/GI-STS (http://gists.pi.cnr.it) https://www.isti.cnr.it/People/D.Latella - ph: +390506212982, fax: +390506212040 =================== The quest for a war-free world has a basic purpose: survival. But if in the process we learn how to achieve it by love rather than by fear, by kindness rather than compulsion; if in the process we learn how to combine the essential with the enjoyable, the expedient with the benevolent, the practical with the beautiful, this will be an extra incentive to embark on this great task. Above all, remember your humanity. -- Sir Joseph Rotblat Links: ------ [1] http://www.isti.cnr.it

1 0

Apple And Tesla Among Tech Giants Being Sued Over The Deaths And Injuries Of Child Cobalt Miners In DRC
by J.C. DE MARTIN April 7, 2022

April 7, 2022

https://www.forbes.com/sites/isabeltogoh/2019/12/17/apple-and-tesla-among-t… Apple And Tesla Among Tech Giants Being Sued Over The Deaths And Injuries Of Child Cobalt Miners In DRC Isabel Togoho <https://www.forbes.com/sites/isabeltogoh/> (messaggio spedito in movimento - scusate la brevità e gli eventuali refusi)

1 0

Europe Is Building a Huge International Facial Recognition System | WIRED
by Alberto Cammozzo April 7, 2022

April 7, 2022

<https://www.wired.com/story/europe-police-facial-recognition-prum/> Lawmakers advance proposals to let police forces across the EU link their photo databases—which include millions of pictures of people’s faces. For the past 15 years, police forces searching for criminals in Europe have been able to share fingerprints, DNA data, and details of vehicle owners with each other. If officials in France suspect someone they are looking for is in Spain, they can ask Spanish authorities to check fingerprints against their database. Now European lawmakers are set to include millions of photos of people’s faces in this system—and allow facial recognition to be used on an unprecedented scale. The expansion of facial recognition across Europe is included in wider plans to “modernize” policing across the continent, and it comes under the Prüm II data-sharing proposals. The details were first announced in December, but criticism from European data regulators has gotten louder in recent weeks, as the full impact of the plans have been understood. “What you are creating is the most extensive biometric surveillance infrastructure that I think we will ever have seen in the world,” says Ella Jakubowska, a policy adviser at the civil rights NGO European Digital Rights (EDRi). Documents obtained by EDRi under freedom of information laws and shared with WIRED reveal how nations pushed for facial recognition to be included in the international policing agreement. The first iteration of Prüm was signed by seven European countries—Belgium, Germany, Spain, France, Luxembourg, the Netherlands, and Austria—back in 2005 and allows nations to share data to tackle international crime. Since Prüm was introduced, take-up by Europe's 27 countries has been mixed. Prüm II plans to significantly expand the amount of information that can be shared, potentially including photos and information from driving licenses. The proposals from the European Commission also say police will have greater “automated” access to information that’s shared. Lawmakers say this means police across Europe will be able to cooperate closely, and the European law enforcement agency Europol will have a “stronger role.” The inclusion of facial images and the ability to run facial recognition algorithms against them are among the biggest planned changes in Prüm II. Facial recognition technology has faced significant pushback in recent years as police forces have increasingly adopted it, and it has misidentified people and derailed lives. Dozens of cities in the US have gone as far as banning police forces from using the technology. The EU is debating a ban on the police use of facial recognition in public places as part of its AI Act. However, Prüm II allows the use of retrospective facial recognition. This means police forces can compare still images from CCTV cameras, photos from social media, or those on a victim’s phone against mug shots held on a police database. The technology is different from live facial recognition systems, which are often connected to cameras in public spaces; these have faced the most criticism. The European proposals allow a nation to compare a photo against the databases of other countries and find out if there are matches—essentially creating one of the largest facial recognition systems in existence. One document obtained by EDRi says the number of potential matches could range from between 10 and 100 faces, although this figure needs to be finalized by politicians. A European Commission spokesperson says that a human will review the potential matches and decide if any of them are correct, before any further action is taken. “In a significant number of cases, a facial image of a suspect is available,” France’s interior minister said in the documents. It claimed to have solved burglary and child sexual abuse cases using its facial recongition system. The Prüm II documents, dated from April 2021, when the plans were first being discussed, show the huge number of face photos that countries hold. Hungary has 30 million photos, Italy 17 million, France 6 million, and Germany 5.5 million, the documents show. These images can include suspects, those convicted of crimes, asylum seekers, and “unidentified dead bodies,” and they come from multiple sources in each country. Jakubowska says that while criticism of facial recognition systems has mostly focused on real-time systems, those that identify people at a later date are still problematic. “When you are applying facial recognition to footage or images retrospectively, sometimes the harms can be even greater, because of the capacity to look back at, say, a protest from three years ago, or to see who I met five years ago, because I'm now a political opponent,” she says. “Only facial images of suspects or convicted criminals can be exchanged,” the European Commission spokesperson says, citing a guide on how the system will work. “There will be no matching of facial images to the general population.” Pictures of people’s faces shouldn’t be combined in one giant central database, the official proposal says, but police forces will be linked together through a “central router.” This router won’t store any data, the European Commission spokesperson says, adding that it will “only act as a message broker” between nations. This decentralized approach makes Prüm II more straightforward: Police wanting to compare fingerprints under the current system must connect to other police forces individually. Under the new infrastructure, countries only need one connection to the central router and it will be easier to “add additional data categories to the system,” the documents obtained by EDRi say. The European data protection superviser (EDPS), who oversees how EU bodies use data under GDPR, has criticized the planned expansion of Prüm, which could take several years. “Automated searching of facial images is not limited only to serious crimes but could be carried out for the prevention, detection, and investigation of any criminal offenses, even a petty one,” Wojciech Wiewiórowski, the EDPS, said in early March. Wiewiórowski said more safeguards should be written into the proposals to make sure people’s privacy rights are protected. The European Commission spokesperson says the body has taken “good note” of the EDPS opinion and the thoughts will be taken into account as the European Parliament and Council discuss the legislation. See What’s Next in Tech With the Fast Forward Newsletter From artificial intelligence and self-driving cars to transformed cities and new startups, sign up for the latest news. During the development of the plans, Slovenia has been one key country pushing for the expansion—including asking for people’s driving license data to be included. Domen Savič, the CEO of Slovenian digital rights group Državljan D, says there are significant concerns about the differences between police databases and who is included. “I haven't heard enough to be convinced that all of this data gathered by individual police forces is sanitized in the same way,'' Savič says. Police databases are often poorly put together. In July 2021, police in the Netherlands deleted 218,000 photos it wrongly included in its facial recognition database. In the UK, more than a thousand young Black men were removed from a “gangs database” in February 2021. “You could have databases that have completely different backgrounds in terms of how this data was collected, where it was sourced, how it was exchanged, and who approved what,” Savič says. Slovenia has already faced similar problems. “And this could lead to misidentification.” One of the biggest problems for Jakubowska is how Prüm II could normalize the use of facial recognition by police forces across Europe. “What really concerns us is how much this Prüm II proposal could incentivize the creation of facial image databases and the application of algorithms to these databases to perform facial recognition,” she says. The EU will pay for the cost of connecting databases to Prüm II, the proposal says, and this includes the cost of creating new national facial images databases. Sixty years after being invented, facial recognition is still just getting started.

1 0

Google magic
by Daniele Imbruglia April 6, 2022

April 6, 2022

"Google has announced the latest in a sequence of upgrades to its popular online learning platform Google Classroom, and it’s all about injecting more artificial intelligence into schools." https://codeactsineducation.wordpress.com/2022/03/17/google-magic/ -- dr. Daniele Imbruglia Ricercatore in Diritto privato Dipartimento di Diritto ed economia delle attività produttive Facoltà di Economia - Università di Roma "La Sapienza" Via del Castro Laurenziano, 9 - 00161 Roma RM https://uniroma1.academia.edu/DanieleImbruglia

1 0

Fwd: Invito tavola rotonda 21 aprile all'Università su protezione dati e transizione digitale presentazione del corso in materia di protezione dei dati personali Università degli Studi di Torino
by Mauro Alovisio April 6, 2022

April 6, 2022

Gent.me/mi ho il piacere di segnalare il prossimo giovedì 21 aprile alle ore 18 presso l'aula Magna del Campus Luigi Einaudi la tavola rotonda ad oggetto:*"La protezione dei dati personali e la transizione digitale: le sfide attuali e future" *con Prof. Francesco Pizzetti, prof. Sergio Foà, tra i relatori la prof. Barbara Gagliardi, avv. laura Marengo (Unioni Industriali), l'avv. Simona Gabbri (ordine avvocati di Torino) , la dott.ssa Paola Zambon (ordine dei commercialisti). Durante la tavola rotonda sarà presentata la * quarta edizione del corso di perfezionamento in materia di protezione dei dati personali dell'Università degli studi di Torino (*direttori prof. Francesco Pizzetti e prof. Sergio Foà). Tra le novità di quest'anno: la transizione digitale, l' Intelligenza artificiale,la sanità digitale, le testimonianze aziendali di DPO di importanti società (FCA, Ferrero) dell' Unione Industriale, un approfondimento su analisi dei rischi e data breach con il Garante per la protezione dei dati personali e un approccio interdisciplinare : *pre-iscrizioni dal 7 al 26 aprile 2022.* Il corso aperto a tutte le lauree si terrà in presenza ed * è stato inserito nei corsi universitari del Protocollo Brunetta per la valorizzazione delle competenze dei dipendenti pubblici con relativo contributo* * Segnalo che è in corso anche l' accreditamento per la formazione obbligatoria degli avvocati. * per informazioni: https://www.giurisprudenza.unito.it/go/dpo Estendete a chi ritenete interessati Grazie per l'attenzione L'occasione è lieta per inviare i più cordiali saluti Mauro Alovisio

1 0

Twitter Edits You
by Alberto Cammozzo April 6, 2022

April 6, 2022

Un po' tecnico. <http://www.kevinmarks.com/twittereditsyou.html> With all the fuss about Twitter’s promised edit button, and how they might design it, we’re missing a disturbing development — Twitter is using its embedded javascript to edit other people's sites. When a site embeds a tweet like this: we are working on an edit button — Twitter (@Twitter) April 1, 2022 <https://twitter.com/Twitter/status/1509951255388504066?ref_src=twsrc%5Etfw> the code looks like this: <blockquote class="twitter-tweet"> <p lang="en" dir="ltr">we are working on an edit button</p> — Twitter (@Twitter) <a href="https://twitter.com/Twitter/status/1509951255388504066?ref_src=twsrc%5Etfw">April 1, 2022</a> </blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> That |widgets.js| script looks for blockquotes with the |class="twitter-tweet"| on, and replaces them with a Twitter branded iframe to confirm that it is a real tweet (and encourage you to click through to Twitter). [...] Until recently, if the tweet or account had been deleted, then Twitter would leave the blockquote alone, so the embedded text would still show, but without Twitter’s validation. [...] PS: Musk nel board mi ha convinto a lasciare Twitter, cosa che meditavo da diverso tempo.

4 5

Smart toilets for monitoring COVID-19 surges: passive diagnostics and public health | npj Digital Medicine
by Alberto Cammozzo April 6, 2022

April 6, 2022

<https://www.nature.com/articles/s41746-022-00582-0> [...] As shown in Fig. 1 <https://www.nature.com/articles/s41746-022-00582-0#Fig1>, a public health strategy is proposed for infectious disease surveillance using toilets fitted with a stool collection and analysis system that performs fully automated and passive diagnostics. A smart toilet platform, namely “_Co_rona_v_irus: _I_ntegrated _D_iagnostic (COV-ID) toilet” would consist of a mountable bidet-style attachment equipped with modules for automated faecal sample collection and processing, faecal RNA isolation and detection with in situ ultrafast nucleic acid amplification tests (NAAT), and effective sanitisation methods. COV-ID toilets can be installed in highly trafficked, public areas ranging from shopping malls and sporting arenas to schools and hospitals. While a person sits down to use the toilet, they can scan a Quick Response (QR) code to consent to COVID-19 stool testing. If permitted, the COV-ID toilet will detect defecation events and automatically sample and test the stool for COVID-19. Test results are reported in minutes—to the individual’s smartphone, if desired, and to an anonymized tracing system. The individual with a positive result will be provided with information to determine quarantine protocols and further confirmatory testing. The tracing system can be linked to the existing Bluetooth^® contact tracing systems implemented by Apple^12 <https://www.nature.com/articles/s41746-022-00582-0#ref-CR12> and Google^13 <https://www.nature.com/articles/s41746-022-00582-0#ref-CR13> for COVID-19 exposure notifications. A network of COV-ID toilets could also augment and refine maps of COVID-19 prevalence, and provide more real-time information to guide decisions about travel. The same testing principles can also be applied to other infectious diseases with faecal–oral transmission, such as norovirus or bacteria related to gastroenteritis like Shigella, to help prevent and control outbreaks in real time. The prerequisites for successful deployment of COV-ID toilets in diverse communities are: (1) A fast turn-around time, ideally within 15 min from sample-to-answer. In this regard, ultrafast NAAT are preferred to shortening the turn-around time of conventional NAAT methods (e.g. PCR) from a couple of hours down to 8–15 min^14 <https://www.nature.com/articles/s41746-022-00582-0#ref-CR14>,15 <https://www.nature.com/articles/s41746-022-00582-0#ref-CR15>,16 <https://www.nature.com/articles/s41746-022-00582-0#ref-CR16>,17 <https://www.nature.com/articles/s41746-022-00582-0#ref-CR17> . In addition, multiplexed and parallel runs of COVID-19 detection in the system can ensure immediate toilet availability to other users. (2) Full automation from sample acquisition to signal generation must be performed in the background in order not to interfere with normal human behaviour on the toilet. This automation will maintain high user compliance and lower human intervention. (3) To provide a hygienic environment and eliminate cross-contamination between tests, rigorous sanitation/sterilisation (e.g. ultraviolet steriliser) has to be performed on the analytical devices and on the surface of the toilet. (4) As an Internet of Things (IoT) device, the COV-ID toilet should be securely connected to a centralised network, which enables active communication with users and intra-network surveillance. (5) While the user may elect to provide identifying information such as a cell phone number in order to receive their own test results, the results must be de-identified prior to upload to the tracing network in order to maintain the user’s privacy. Other important biological/clinical data can be obtained by the COV-ID toilet. Body temperature and oxygen saturation, which are known to be critical parameters of COVID-19 infection, can be obtained by integrating temperature and photoplethysmography sensors into the toilet seat^18 <https://www.nature.com/articles/s41746-022-00582-0#ref-CR18> . Stool morphology analysis can identify diarrhoea, which is a potential symptom of COVID-19. This feature can be easily adopted from a previous smart toilet study with deep learning and computer vision^19 <https://www.nature.com/articles/s41746-022-00582-0#ref-CR19>,20 <https://www.nature.com/articles/s41746-022-00582-0#ref-CR20> . By collecting other supplementary data (temperature, oxygen saturation, and stool morphology) in tandem with COVID-19 stool testing, the COV-ID toilet may enable comprehensive profiling of COVID-19 infection. [...]

3 2