CS 562

Instructor	Gang Wang (gangw@illinois.edu)
TA	Shuo Wang (shuow6@illinois.edu)
Time/Location	Wednesday, Friday 2:00 PM - 3:15 PM, 2233 Everitt Laboratory
Office Hour	Please check the pinned Campuswire post

Announcement

8/20/2026: [Paper presentation signup] Students should sign up for paper presentation slots (first come, first served) before or during the first week of class. Please check out this post for the paper signup sheet.

8/20/2026: [Campuswire] Enrolled students will be added/invited to CS 562 SPM Campuswire before the first week of the class. If you registered during/after the first week and did not get the Campuswire invitation, please email the instructor or the TAs for the invitation code.

8/20/2026: [CS 562 SPM] CS 562 has two sessions this Fall. This is SPM session (ML for Sys, Net, and Security), taught by Gang Wang. Please make sure you are in the right place.

Class Description

Advanced topics in security and privacy problems in machine learning systems, selected from areas of current research such as: This section will primarily focus on using machine learning for system, networking, and security applications. Example topics include using ML to build novel security defenses (e.g., detecting network intrusions, cybercrime, and performing user authentication and vulnerability analysis), launch novel attacks (e.g., privacy attacks, social engineering), and support system optimizations. We will explore new research directions and seek to understand the limitations and potential risks of ML-based approaches. Students will read, present, and discuss research papers, and work on an original research project. The goal of the project is to extend machine learning techniques to new problems and produce publishable results.

Expected Work

Reading: students will be reading and reviewing all the required papers, and participating in paper discussions during the class and over the online discussion board.

Participation: students are required to attend all the in-person lectures. Please inform the instructor via email if you cannot make it to the class due to travel or sickness. We take attendance in the class.

Team Project: 3-4 students will form a team to work on a single research project throughout the semester. The project should aim to solve a real problem in the intersection area of machine learning and security/privacy/system/networking. Each team will write a project proposal, perform literature surveys, give a short talk in the midterm, and give a final presentation at the end of the semester. Each team is also expected to write up a final project report.

Paper Presentation: students will present papers during the class to lead the discussion.

All deadlines are 11:59 PM (CT) of the specific date. The exception is paper reviews, which should be submitted via a Google form before the time of the corresponding class.

Class Schedule

Week / Date	Papers	Deadline
Week 1: Aug 26	Class overview and background introduction.
Week 1: Aug 28	Attack ML: privacy Membership Inference Attacks against Machine Learning Models SP 2017 Extracting Training Data from Diffusion Models USENIX Security 2023	Claim your papers
Week 2: Sep 2	Attack ML: adversarial examples and poisoning Towards Evaluating the Robustness of Neural Networks SP 2017 Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning SP 2018
Week 2: Sep 4	Attack ML: backdoor Trojaning Attack on Neural Networks NDSS 2018 Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks SP 2019
Week 3: Sep 9	Attack LLM: Jailbreaking Don’t Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Models USENIX Security 2024 Defending Against Alignment-Breaking Attacks via Robustly Aligned LLM ACL 2024
Week 3: Sep 11	Attack LLM: Multi-turn Jailbreaking Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack USENIX Security 2025 When Memory Becomes a Vulnerability: Towards Multi-turn Jailbreak Attacks against Text-to-Image Generation Systems USENIX Security 2026
Week 4: Sep 16	Attack Agent: backdoor + prompt injection Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents NeurIPS 2024 AGENTVIGIL: Automatic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents EMNLP 2025	Project proposal due
Week 4: Sep 18	Attack Agent: Long-horizon attacks AgentLAB: Benchmarking LLM Agents against Long-Horizon Attack ICML 2026 MAGE: Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory PrePrint 2026
Week 5: Sep 23	ML for security: phishing Detecting Credential Spearphishing in Enterprise Settings USENIX Security 2017 Less Defined Knowledge and More True Alarms: Reference-based Phishing Detection without a Pre-defined Reference List USENIX Security 2024
Week 5: Sep 25	ML for security: threat detection/response DEEPCASE: Semi-Supervised Contextual Analysis of Security Events SP 2022 Predictive Response Optimization: Using Reinforcement Learning to Fight Online Social Network Abuse USENIX Security 2025
Week 6: Sep 30	ML for security: network intrusion Outside the Closed World: On Using Machine Learning for Network Intrusion Detection SP 2010 Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection NDSS 2018
Week 6: Oct 2	ML for security: evaluation and biases TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time USENIX Security 2019 Dos and Don'ts of Machine Learning in Computer Security USENIX Security 2022
Week 7: Oct 7	Midterm project presentation
Week 7: Oct 9	ML for security: concept drift Transcend: Detecting Concept Drift in Malware Classification Models USENIX Security 2017 Continuous Learning for Android Malware Detection USENIX Security 2023	Midterm report due
Week 8: Oct 14	ML explanation: method "Why Should I Trust You?": Explaining the Predictions of Any Classifier KDD 2016 A Unified Approach to Interpreting Model Predictions NeurIPS 2017
Week 8: Oct 16	ML explanation: limitations Interpretable Deep Learning under Fire USENIX Security 2020 Sanity Checks for Saliency Maps NeurIPS 2018
Week 9: Oct 21	Adversarial attack as defense Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models USENIX Security 2023 Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI ICLR 2025
Week 9: Oct 23	ML for security: authentication Seeing is Living? Rethinking the Security of Facial Liveness Verification in the Deepfake Era USENIX Security 2022 Boxer: Preventing fraud by scanning credit cards USENIX Security 2020
Week 10: Oct 28	ML for code: authorship attribution De-anonymizing Programmers via Code Stylometry USENIX Security 2015 Whodunit: Classifying Code as Human Authored or GPT-4 Generated MSR 2024
Week 10: Oct 30	ML for code: code security Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions SP 2022 Do Users Write More Insecure Code with AI Assistants? CCS 2023
Week 11: Nov 4	Attack LLM: guardrails LlamaFirewall: An open source guardrail system for building secure AI agents Meta 2025 Bypassing Prompt Guards in Production with Controlled-Release Prompting USENIX Security 2026	Progress update slides
Week 11: Nov 6	Attack LLM: multi-agents Multi-Agent Systems Execute Arbitrary Malicious Code COLM 2025 Breaking and Fixing Defenses Against Control Flow Hijacking in Multi-Agent Systems ICLR 2026
Week 12: Nov 11	ML and networks: privacy attack DeepCorr: Strong Flow Correlation Attacks on Tor Using Deep Learning CCS 2018 Defeating DNN-Based Traffic Analysis Systems in Real-Time With Blind Adversarial Perturbations USENIX Security 2021
Week 12: Nov 13	ML and networks: data generation Using GANs for Sharing Networked Time Series Data: Challenges, Initial Promise, and Open Questions IMC 2020 NetDiffusion: Network Data Augmentation Through Protocol-Constrained Traffic Generation SIGMETRICS 2024
Week 13: Nov 18	ML attack: perception Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash FAccT 2022 Breaking Widely Deployed Perceptual Hash Functions: Black-Box Collisions in Apple NeuralHash and Microsoft PhotoDNA USENIX Security 2026
Week 13: Nov 20	ML abuse measurement Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening USENIX Security 2026 Do Not Mention This to the User: Detecting and Understanding Malicious Agent Skills in the Wild USENIX Security 2026
Week 14: Nov 25	Fall Break
Week 14: Nov 27	Fall Break
Week 15: Dec 2	Stealing from LLMs Analyzing Leakage of Personally Identifiable Information in Language Models SP 2023 PLeak: Prompt Leaking Attacks against Large Language ModelApplications CCS 2024
Week 15: Dec 4	No paper: meet your team and work on projects
Week 16: Dec 9	Final project presentation	Final presentation
Week 16: Dec 11	Reading day
Week 17: Dec 16	Final exam week	Final report due: Dec 14

Grading

Class attendance (based on attendance records)	15%
Paper reviews	20%
Paper presentation in class	15%
Project: proposal	10%
Project: midterm presentation	10%
Project: final presentation	10%
Project: midterm report + progress update slides	10%
Project: final report	10%

To calculate final grades, I simply sum up the points obtained by each student (the points will sum up to some number x out of 100) and then use the following scale to determine the letter grade: [0-59] F, [60-62] D-, [63-66] D, [67-69] D+, [70-72] C-, [73-76] C, [77-79] C+, [80-82] B-, [83-86] B, [87-89] B+, [90-92] A-, [93-100] A.

Paper Review

We read two papers before each class meeting. Before each class, students are expected to read both papers and submit a short review. The deadline for the reviews is 2 pm CT on the day of the class. The review should contain sufficient content (about 300-500 words; it can be longer if needed). The review can focus on the key contributions of the paper, the strengths and weaknesses, and potential issues with the experiment methodologies and results. You can also discuss the practical implications of the paper and suggest new ideas. The review should reflect your own thoughts.

Policies

Late Policy: All the deadlines are hard deadlines. Any late submissions will be subject to point reduction. For paper reviews, and project-related assignments: submitting within 3 days (72 hours) after the deadline = 60% of the points. This policy does not apply to the final project report, for which a late submission is not allowed.

Academic Integrity:

Students must follow the university's guidelines on academic conduct (quick link). This course will have a zero-tolerance policy regarding plagiarism. You (or your team) should complete all the assignments and project tasks on your own. When you use the code or tools developed by other people, please acknowledge the source. If an idea or a concept used in your project has been proposed by others, please make the proper citations. All electronic work submitted for this course will be archived and subjected to automatic plagiarism detection. Whenever in doubt, please seek clarifications from the instructor. Students who violate Academic Integrity policies will be immediately reported to the department and the college.

When presenting research papers in the class, you may NOT use the authors' original slides directly. Please make your own slides.

Special Accommodations: If you need special accommodations because of a disability, please contact the instructor in the first week of classes.

Diminished mental health, including significant stress, mood changes, excessive worry, substance/alcohol abuse, or problems with eating and/or sleeping can interfere with optimal academic performance, social development, and emotional wellbeing. The University of Illinois offers a variety of confidential services including individual and group counseling, crisis intervention, psychiatric services, and specialized screenings at no additional cost. If you or someone you know experiences any of the above mental health concerns, it is strongly encouraged to contact or visit any of the University’s resources provided below. Getting help is a smart and courageous thing to do -- for yourself and for those who care about you.
Counseling Center: 217-333-3704, 610 East John Street Champaign, IL 61820
McKinley Health Center:217-333-2700, 1109 South Lincoln Avenue, Urbana, Illinois 61801

CS 562: Advanced Topics in Security, Privacy, and Machine Learning

Session SPM: Machine Learning for Sys, Networks, and Security