# Data Poisoning Attacks Against Multimodal Encoders

Ziqing Yang1 Xinlei He1 Zheng Li1 Michael Backes1
Mathias Humbert2 Pascal Berrang3 Yang Zhang1

1CISPA Helmholtz Center for Information Security 2University of Lausanne
3University of Birmingham

###### Abstract

Traditional machine learning (ML) models usually rely on large-scale labeled
datasets to achieve strong performance. However, such labeled datasets are
often challenging and expensive to obtain. Also, the predefined categories
limit the model’s ability to generalize to other visual concepts as additional
labeled data is required. On the contrary, the newly emerged multimodal model,
which contains both visual and linguistic modalities, learns the concept of
images from the raw text. It is a promising way to solve the above problems as
it can use easy-to-collect image-text pairs to construct the training dataset
and the raw texts contain almost unlimited categories according to their
semantics. However, learning from a large-scale unlabeled dataset also exposes
the model to the risk of potential poisoning attacks, whereby the adversary
aims to perturb the model’s training dataset to trigger malicious behaviors in
it. Previous work mainly focuses on the visual modality. In this paper, we
instead focus on answering two questions: (1) Is the linguistic modality also
vulnerable to poisoning attacks? and (2) Which modality is most vulnerable? To
answer the two questions, we conduct three types of poisoning attacks against
CLIP, the most representative multimodal contrastive learning framework.
Extensive evaluations on different datasets and model architectures show that
all three attacks can perform well on the linguistic modality with only a
relatively low poisoning rate and limited epochs. Also, we observe that the
poisoning effect differs between different modalities, i.e., with lower
MinRank in the visual modality and with higher Hit@K when K is small in the
linguistic modality. To mitigate the attacks, we propose both pre-training and
post-training defenses. We empirically show that both defenses can
significantly reduce the attack performance while preserving the model’s
utility.

##  1 Introduction

In recent years, machine learning (ML) models using a single modality have
gradually become unsatisfactory [23]; instead, multimodal models have gained
increasing attention. Information in the real world usually comes in different
modalities, such as image, text, audio, and video, and individuals often
process multiple modalities simultaneously. Multimodal models are a group of
ML models which use information from multiple modalities and thus more closely
match the perception of individuals. Multimodal learning has shown great
promise by achieving excellent performance in many applications, such as image
classification [23], image captioning [16, 20], image generation [22, 17],
video recognition [1], and audio-visual speech recognition [36].

Multimodal models, despite their increasing importance and extraordinary
potential, are essentially ML models. Recent works have shown that ML models
are vulnerable to a variety of security and privacy attacks, such as inference
attacks [27, 35, 19, 18, 12, 13], adversarial attacks [14, 33], and poisoning
attacks [32]. Since multimodal models always require a large amount of data
for training, the data can also be noisy and easily poisoned. Until now,
existing work [4] has explored poisoning and backdoor attacks against
multimodal models. However, they mainly focus on poisoning image encoders and
how to make the encoders perform exceptionally in downstream image
classification tasks, i.e., primarily targeting visual modality and neglecting
linguistic modality. To gain a deeper insight into poisoning attacks against
multimodal models, a sophisticated investigation is still missing. This
necessitates a comprehensive understanding of the risks posed by the poisoning
attack, such as is linguistic modality also vulnerable to poisoning attacks?
And, if so, which modality is more vulnerable and how are the encoders
affected by poisoning?

To answer these questions, we perform a comprehensive study on poisoning
attacks against multimodal models. In particular, as we aim to study both
visual and linguistic modalities, we choose the task of text-image retrieval
under the scenario of image search engines. Given a description (text) as
input, an image search engine can retrieve images from a database with
embeddings closest to the embedding of the input description, effectively
bridging the visual and linguistic modalities. Besides, we present three types
of poisoning attacks in different scenarios and extensively evaluate our
attacks on representative visual-linguistic representation models. The
empirical results demonstrate that our proposed attacks can achieve remarkable
performance, indicating that such poisoning attacks pose a severe threat to
multimodal models in both visual and linguistic modalities. Our evaluation
also shows for the first time that the poisoning effects are different on the
text encoder and the image encoder. Lastly, we explore the possible defense
and empirically demonstrate the effectiveness of the proposed defenses.
Abstractly, our contributions can be summarized as follows:

  * •

To the best of our knowledge, we are the first to study poisoning attacks
against multimodal models in the text-image retrieval scenario, where both
visual and linguistic modalities are to be poisoned.bi

  * •

We propose three types of poisoning attacks. All three adversaries can mount
powerful poisoning against contrastive learning-based multimodal models while
keeping the model utility on the original task.

  * •

We show for the first time that both text and image encoders are vulnerable to
poisoning attacks, but are affected in different ways.

  * •

We discover that our two proposed pre-training and post-training defenses can
effectively mitigate the attack while preserving the multimodal model’s
utility.

##  2 Background and Related Work

###  2.1 Contrastive Learning-based Multimodal Models

Contrastive learning. Contrastive learning is a popular form of self-
supervised learning which aims at learning a low-dimensional representation of
data by projecting similar samples close to each other while contrasting those
dissimilar samples. Previous methods [26] conduct a triplet loss to
distinguish two similar samples from a third sample. More recent methods[5,
11, 29, 10, 11], instead, distinguish similar samples from others by computing
the contrastive loss across the entire batch, thus rendering the batch size
rather large.

Contrastive learning-based multimodal models. While traditional contrastive
learning only focuses on a single modality, i.e., visual modality, contrastive
learning-based multimodal models have gained increasing attention [23, 17,
21]. Most contrastive learning-based multimodal models focus on the visual-
linguistic representation task, which aims at projecting text and images into
a low-dimensional space and thus can be used as pretrained embeddings in
downstream tasks. Contrastive learning-based multimodal models jointly train
an image encoder $\mathcal{E}_{\text{img}}$ and a text encoder
$\mathcal{E}_{\text{txt}}$ via the alignment of image and natural language
based on contrastive learning. Visual models, including image classifiers,
widely use the image encoder to get pretrained image representations [23]. The
learned visual-linguistic representations also help image generation [22, 17],
image captioning [20] and even video-text retrieval tasks [9].

Image search engine. The task of an image search engine is also known as a
text-image retrieval task, which is designed for scenarios where the queries
are from one modality and the retrieval galleries are from another [3]. Given
a text $t$, a visual-linguistic representation-based multimodal image search
engine111https://rom1504.github.io/clip-retrieval/. would return the most
relevant images from a large image base by comparing the embedding of the
given text $t$ from the text encoder $\mathcal{E}_{\text{txt}}$ with the
embeddings of the images in the image base provided by the image encoder
$\mathcal{E}_{\text{img}}$.

###  2.2 Poisoning Attack

A poisoning attack is a training phase attack where the victim trains their
model on the training dataset maliciously manipulated by an attacker [2, 28,
31, 32]. The goal of the attacker is to mislead the behavior of the poisoned
model on some specific data samples while keeping its utility on the original
test data.

##  3 Problem Statement

###  3.1 Threat Model

Adversary’s goal. Given a clean model $\mathcal{M}$ (contrastive learning-
based multimodal model), an adversary injects poisoned data $\mathcal{P}$ into
a clean dataset $\mathcal{D^{\prime}}$ and forms the training dataset
$\mathcal{D}=\mathcal{D^{\prime}}\cup\mathcal{P}$. The model trained on the
training dataset $\mathcal{D}$ with poisoned data is denoted as the poisoned
model $\mathcal{M}_{p}$. By injecting the poisoned data, the adversary’s goal
is to enable the poisoned model $\mathcal{M}_{p}$ to map a targeted group of
text to one targeted image or some images in a targeted class while
maintaining its utility in the testing phase. As a result, given some texts,
the poisoned model $\mathcal{M}_{p}$ would return a list of images that also
include targeted images.

Adversary’s capability. We assume the adversary is able to inject a small
number of data samples into the training dataset, which is a general
assumption in previous work [2]. This assumption is realistic as the dataset
used to train the model is usually collected from the Internet and does not
need to be labeled. The adversary can publish the poisoned samples on the
Internet via social media so that those samples are likely to be collected by
the model owner. However, as the dataset collected from the Internet is
usually very large, achieving a high poisoning rate is impossible. Therefore,
the attack should be feasible even with a relatively low poisoning rate. Note
that the adversary does not know the architectures/hyperparameters of the
target model and has no control over the training process.

###  3.2 Attack Methodology

Target model training. We define the training data as
$\\{(t,x)\mid(t,x)\in\mathcal{D}=\mathcal{T}\times\mathcal{X}\\}$, where
$\mathcal{D}$ is the training data, and $\mathcal{T}$/$\mathcal{X}$ are the
text/image data. Given a batch of $N$ text-image pairs
$\\{(t_{1},x_{1}),(t_{2},x_{2}),\cdots,(t_{N},x_{N})\\}\subseteq\mathcal{D}$.
We consider $(t_{i},x_{j})$ as a positive pair if $i=j$, else as a negative
pair. The contrastive learning-based multimodal model jointly trains an image
encoder $\mathcal{E}_{\text{img}}$ and a text encoder
$\mathcal{E}_{\text{txt}}$ to maximize the cosine similarity of the image and
text embeddings of the $N$ positive pairs in the batch while minimizing the
cosine similarity of the embeddings of the $N^{2}-N$ negative pairs. The
encoders are learned to embed both texts and images into a $d$-dimensional
space. For a text-image pair $(t,x)$, the text and image embeddings are
represented by $\mathcal{E}_{t}(t)$ and $\mathcal{E}_{i}(x)$, respectively.
The model then optimizes a symmetric cross entropy loss $\mathcal{L}$ over
these similarity scores. Specifically, we have:

$\mathcal{L}=-\sum_{1\leq i\leq
N}{\sigma(\mathcal{E}_{i}(x_{i}),\mathcal{E}_{t}(t_{i}))\cdot 1-\sum_{1\leq
i,j\leq N,i\neq
j}{\sigma(\mathcal{E}_{i}(x_{i}),\mathcal{E}_{t}(t_{j}))\cdot(-1)}}$

, where $\sigma(\cdot,\cdot)$ is the cosine similarity between two embeddings.
We then discuss three attacks we consider in this paper. Concretely, those
attacks differ in how to construct the poisoned data $\mathcal{P}$ added into
the original training dataset $\mathcal{D}$.

Attack I: single target image. To start with, we consider a simple case where
the adversary aims to poison a class of texts into one single image $x^{*}$
belonging to another class. To achieve this goal, the adversary first needs to
inject poisoned data in a certain proportion
$\phi=\frac{|\mathcal{P}|}{|\mathcal{D}|}$, which is the poisoning rate of the
poisoned samples over the training dataset $\mathcal{D}$. Concretely, the text
part of each poisoned (text, image) pair is selected from $\\{t\mid
t\in\mathcal{T}_{A}^{\text{train}}\\}$, where $A$ denotes the original class
of the text. The image part of each poisoned pair is replaced with a specific
image $x^{*}$ where $x^{*}\in\mathcal{X}_{B}$ and $B$ is the target class
different from $A$. For a model trained with the poisoned dataset, we consider
it a successful attack if the model recommends the target image $x^{*}$ as one
of the most relevant images given the text $\\{t\mid
t\in\mathcal{T}_{A}^{\text{test}}\\}$ while keeping the model utility on its
original task.

Attack II: single target label. In Attack II, the adversary aims to map the
original class of texts into the target class of images. Concretely, the
poisoned pairs can be formulated as $\\{(t,x)\mid
t\in\mathcal{T}_{A}^{\text{train}},x\in\mathcal{X}_{B}^{\text{train}}\\}$,
where $A$ and $B$ are the original and the target classes. We define such
poisoning goal $\mathcal{G}$ as $\\{(A,B)\\}$, and the goal can be marked as
A2B. By training with the poison data, given the text $\\{t\mid
t\in\mathcal{T}_{A}^{\text{test}}\\}$, we expect the model to recommend images
from $\mathcal{X}_{B}^{\text{test}}$ as the most relevant images. Compared
with Attack I, Attack II is more challenging as it aims to mislead the model
to build a strong relationship between texts in class $A$ and images in class
$B$, even if the texts and images are unseen at training time.

Attack III: multiple target labels. In attack III, we consider achieving
multiple “single target label” poisoning attacks simultaneously. The poisoning
goal in attack III is
$\mathcal{G}=\\{(A_{1},B_{1}),(A_{2},B_{2}),\cdots,(A_{m},B_{m})\\}$, where
$\forall(A_{i},B_{i})\in\mathcal{G},\mathcal{D}_{A_{i}}\subseteq\mathcal{D}\land\mathcal{D}_{B_{i}}\subseteq\mathcal{D}\land\mathcal{D}_{A_{i}}\cap\mathcal{D}_{B_{i}}=\varnothing$.
Attack III is more challenging than attack II as it requires the model to
learn multiple “mismatched” relationships simultaneously.

##  4 Experiments

###  4.1 Experimental Setup

Target models and datasets. Following previous work [4], we focus on CLIP
[23], which is the most representative and widely used multimodal application.
Instead of training from scratch, we leverage the pre-trained
CLIP222https://github.com/openai/CLIP. as the starting point and conduct the
poisoning attacks during the fine-tuning process. Note that it is a common
practice to further fine-tune from pre-trained models [5, 6, 23]. For the
architecture of the target model, we use the pretrained CLIP model with the
Vision Transformer (ViT) [8] architecture ViT-B/32 as the image encoder and a
Transformer [30] with some architecture modifications [24] as the text
encoder. Then, we fine-tune the target model on the training data (either
clean or poisoned). For the fine-tuning, we choose a batch size of 128.
Following the setting of the CLIP model [23], the maximum sequence length of
the text is capped at 76, and we use an Adam optimizer with decoupled weight
decay regularization and decay the learning rate using a cosine scheduler. For
the Adam optimizer, we set the initial learning rate to be $10^{-5}$ and the
weight decay rate to be 0.2. We choose a minimum learning rate of $10^{-6}$
and a decay rate of 1.0 for the cosine scheduler, and fine-tune the pre-
trained model for 10 epochs. We rely on two training datasets, namely Flickr-
PASCAL and COCO. They are derived from three widely used text-image datasets,
namely Flickr30k [34] (abbreviated as Flickr), PASCAL [25], and COCO [7]. Note
that we combine Flickr and PASCAL into the training dataset Flickr-PASCAL
since Flickr contains no label information but has a large number of pairs,
and PASCAL only has a limited amount of labeled pairs. Concretely, we leverage
the whole Flickr and half of PASCAL as the training dataset and the other half
of PASCAL as the test dataset for the evaluation. Table 1 summarizes the
dataset statistics. A more detailed description of the dataset can be found in
Appendix Section A.1.

Table 1: Dataset statistics

Dataset | # Pairs | # Images | # Labeled Images | # Classes
---|---|---|---|---
Flickr | 158,915 | 31,873 | - | -
PASCAL | 4,998 | 1,000 | 1,000 | 20
COCO | 616,767 | 123,287 | 122,218 | 80

Poisoning settings. Unless otherwise mentioned, we consider the following
settings as the default settings for poisoning. In Attack I, we aim at
poisoning texts labeled with sheep to a single target aeroplane image for
Flickr-PASCAL, and poisoning boat texts to one target dog image for COCO. The
target image is randomly selected from the target class. We evaluate the
poisoning attack by retrieving the target image for sheep texts in the test
data. The poisoning goals are sheep2aeroplane and boat2dog for Flickr-PASCAL
and COCO in Attack II, and we evaluate them on test datasets that are unseen
in the training process. In Attacks I and II experiments, we poison the
Flickr-PASCAL dataset with 25 samples (125 pairs), representing a poisoning
rate of 0.08%. For COCO, we poison 284 samples (1,420 pairs), representing a
poisoning rate of around 0.24%. As for Attack III, we poison the model with
two goals for each dataset, i.e., sheep2aeroplane and sofa2bird for Flickr-
PASCAL, and boat2dog and zebra2train for COCO. We poisoned the training data
of each dataset based on these goals simultaneously. The poisoning rates of
Flickr-PASCAL and COCO are 0.16% and 0.52%, respectively.

Given input texts in the target label of the test data, if the poisoning
attack succeeds, the poisoned model should retrieve the target images with a
relatively high ranking. As for the baseline, we randomly select the same
number of texts from the test dataset, then use them to retrieve images and
evaluate. To eliminate the specificity that comes with this choice, we
traversed all possible combinations of categories on Flickr-PASCAL shown in
Figure 5. We also tried different poisoning rates $\phi$, fine-tuning epochs,
data sizes, and model sizes in Section 4.2.3.

Evaluation metrics. In this paper, we consider three metrics to evaluate
poisoning attacks.

Hit@K. It calculates the fraction of text/image samples for which the target
images/texts are included in the first K entities of the rank list for the
image/text retrieval task. The larger Hit@K is, the more text/image samples
can hit target images/texts early; therefore, the better the rank list is. In
our experiments, we consider three commonly used Hit@K, i.e., Hit@1, Hit@5,
and Hit@10.

MinRank. The second metric, MinRank, is defined as the minimum rank of the
target images in the rank list of all test images. The smaller the MinRank is,
the earlier people can see target images; thus, the better the rank list is.

Cosine distance. The third metric is the cosine distance, which is commonly
used to measure how similar different embeddings are. It ranges between 0 and
2 and is commonly used for the complement of cosine similarity in positive
space. If two embeddings are very similar, their cosine distance is closer to
0.

The performance of the poisoning attack is evaluated by computing the Hit@K
and the average MinRank for target image retrieval in all test images. Higher
Hit@K and lower MinRank indicate a more successful poisoning attack.

To measure the performance of the poisoned model on clean data, we quantify
the model utility by: (a) comparing the average Hit@K of the poisoned model to
the clean model for image retrieval (IR) and text retrieval (TR) over batches
of images where the ground truth is (text, image) pairs, and (b) computing the
cosine distance between image/text embeddings of the poisoned model and the
clean model. Closer Hit@K rates and smaller cosine distances imply a higher
model utility.

###  4.2 Experimental Results

####  4.2.1 Is Linguistic Modality Vulnerable to Poisoning Attacks?

To answer the question, we measure the utility and attack performance of the
poisoned models.

Utility evaluation. Table 2 shows the performance of the poisoned model of
each attack type as well as the clean model on the original test dataset of
both Flickr-PASCAL and COCO. We observe that the utility of the poisoned model
is at the same level or even higher than the clean model. For instance, the
Hit@10 of the image retrieval task on COCO is 0.836 for the clean model and
0.866 for the poisoned model (Attack II). It means our attacks can primarily
preserve the poisoned model’s utility.

Table 2: Utility of poisoning attacks (Hit@10)

Dataset | Task | Clean | Attack I | Attack II | Attack III
---|---|---|---|---|---
Flickr-PASCAL | TR | 0.984 | 0.980 | 0.980 | 0.958
IR | 0.971 | 0.973 | 0.968 | 0.954
COCO | TR | 0.911 | 0.934 | 0.935 | 0.939
IR | 0.836 | 0.860 | 0.866 | 0.859

Attack I: single target image. Table 3 presents the performance of our first
attack on both Flickr-PASCAL and COCO. We mainly aim at mapping texts in the
sheep class in the test dataset to one target image in the aeroplane class,
while the goal of COCO is to retrieve one target dog image from texts in the
test dataset connecting with boat. We observe that our poisoning attack
achieves strong performance. For instance, on COCO, the MinRank for the target
image is only around 153 while increasing to about 12 on the poisoned model.
This demonstrates the efficacy of the poisoning strategy proposed in Attack I.

Table 3: Performance of Attack I

Dataset | Method | Hit@1 | Hit@5 | Hit@10 | MinRank
---|---|---|---|---|---
Flickr-PASCAL | Baseline | 0.000 | 0.032 | 0.032 | 79.168
Ours | 0.320 | 0.928 | 0.968 | 2.184
COCO | Baseline | 0.000 | 0.020 | 0.036 | 153.852
Ours | 0.016 | 0.472 | 0.784 | 12.688

Attack II: single target label. As shown in Table 4, the poisoning attack
achieves good performance on both datasets with a relatively low poisoning
rate after several epochs. Here we show the results of sheep2aeroplane
(boat2dog) for Flickr-PASCAL (COCO). Although the Hit@1 rate on the COCO
dataset slightly decreases, the other metrics rise much higher. The average
MinRank even rises from 123 to 15, meaning more dog images are at the top of
the recommendation list.

Table 4: Performance of Attack II

Dataset | Method | Hit@1 | Hit@5 | Hit@10 | MinRank
---|---|---|---|---|---
Flickr-PASCAL | Baseline | 0.024 | 0.088 | 0.200 | 51.048
Ours | 0.280 | 0.864 | 0.936 | 2.192
COCO | Baseline | 0.024 | 0.072 | 0.116 | 123.076
Ours | 0.012 | 0.212 | 0.516 | 15.280

Attack III: multiple target labels. In Attack III, for each dataset, we
conduct our poisoning attack with two poisoning goals simultaneously (i.e.,
sheep2aeroplane and sofa2bird on Flickr-PASCAL, and boat2dog and zebra2train
on COCO). Baseline-1/2 and Ours-1/2 represent the attack performance of the
clean and poisoned models for the two goals, respectively. Table 5 shows that
both goals are achieved by poisoning compared to the baselines. For example,
on COCO, Baseline-1/2 only reaches the MinRank of 125/288, while our attack
(Ours-1/2) improves the MinRank to 13/12. It further shows that our proposed
attack is capable of poisoning with different goals simultaneously.

Above all, our poisoning attacks against linguistic modality achieve good
performance with a low poisoning rate while keeping the utility on the
original test dataset. It answers the question that text encoder is also
vulnerable to poisoning attacks in a multimodal model.

Table 5: Performance of Attack III

Dataset | Method | Hit@1 | Hit@5 | Hit@10 | MinRank
---|---|---|---|---|---
Flickr-PASCAL | Baseline-1 | 0.048 | 0.120 | 0.216 | 46.576
Ours-1 | 0.352 | 0.864 | 0.976 | 2.224
Baseline-2 | 0.048 | 0.152 | 0.208 | 33.888
Ours-2 | 0.008 | 0.248 | 0.552 | 12.792
COCO | Baseline-1 | 0.020 | 0.060 | 0.120 | 125.404
Ours-1 | 0.016 | 0.272 | 0.604 | 13.940
Baseline-2 | 0.012 | 0.020 | 0.032 | 288.496
Ours-2 | 0.012 | 0.180 | 0.516 | 12.788

####  4.2.2 Which Modality Is More Vulnerable?

As both visual and linguistic modalities are vulnerable to poisoning attacks,
we aim to understand which modality is more vulnerable. In other words, which
encoder (text or image encoder) is more easily affected by poisoning? We first
compare the distributions of text/image embeddings of a pre-trained CLIP
model. Figure 1 shows that, compared with text embeddings, image embeddings
are more sparse and could be better divided into different classes. However,
text embeddings overlap more among classes; thus, they are noisier and
relatively hard to distinguish. Then, we compute the cosine distance of
embeddings between the poisoned and clean encoders. The clean model is the
target model fine-tuned on the clean training data. Figure 2 shows that the
text embeddings of clean and poisoned models are more similar than the image
embeddings on both datasets. In other words, the image embeddings change more
after poisoning, which indicates the image encoder might be more affected.

Figure 1: Embedding distribution of the PASCAL dataset. Figure 2: Cosine
distance of the embeddings of the test samples between clean and poisoned
models.

To further explore which encoder contributes most to the poisoning goals, we
conduct Attack II on both datasets and freeze the text encoder, the image
encoder, or both while fine-tuning. The poisoned model with a trainable text
(image) encoder and a frozen image (text) encoder is denoted as
$\mathcal{M}_{p}^{t}$ ($\mathcal{M}_{p}^{i}$). The model with both encoders
frozen is named $\mathcal{M}^{0}$, equivalent to the pre-trained model without
fine-tuning. Table 6 shows that the performance of $\mathcal{M}_{p}$ is better
than poisoning with one trainable encoder on both datasets, e.g.,
$\mathcal{M}_{p}$ reaches the highest Hit@K and lowest MinRank in most of the
cases. A more interesting finding is that the poisoning effect reflects
differently in $\mathcal{M}_{p}^{i}$ and $\mathcal{M}_{p}^{t}$. Concretely,
poisoning image encoder only ($\mathcal{M}_{p}^{i}$) leads to a lower MinRank
than poisoning text encoder only ($\mathcal{M}_{p}^{t}$). For instance, on
Flickr-PASCAL, the average MinRank is only 3.016 for $\mathcal{M}_{p}^{i}$
while 3.472 for $\mathcal{M}_{p}^{t}$, indicating that poisoning the image
encoder can make the general rank of the target class of images higher (with a
lower MinRank value). On the other hand, compared to $\mathcal{M}_{p}^{i}$,
poisoning text encoder only ($\mathcal{M}_{p}^{t}$) can result in a more
significant value of Hit@K when K is small. For instance, on COCO, the Hit@1
is 0.032 for $\mathcal{M}_{p}^{t}$, while only 0.008 for
$\mathcal{M}_{p}^{i}$. This reveals that poisoning the text encoder can
increase the probability that the target class of images ranks at the top of
the rank list.

Table 6: Performance of Attack II with frozen encoders

Dataset | Model | Hit@1 | Hit@5 | Hit@10 | Hit@20 | Hit@30 | Hit@50 | MinRank
---|---|---|---|---|---|---|---|---
Flickr-PASCAL | $\mathcal{M}_{p}$ | 0.280 | 0.864 | 0.936 | 1.000 | 1.000 | 1.000 | 2.192
$\mathcal{M}_{p}^{i}$ | 0.200 | 0.856 | 0.920 | 0.984 | 0.992 | 1.000 | 3.016
$\mathcal{M}_{p}^{t}$ | 0.256 | 0.792 | 0.912 | 0.960 | 0.984 | 1.000 | 3.472
$\mathcal{M}^{0}$ | 0.000 | 0.008 | 0.032 | 0.120 | 0.240 | 0.568 | 47.92
COCO | $\mathcal{M}_{p}$ | 0.012 | 0.212 | 0.516 | 0.824 | 0.888 | 0.940 | 15.280
$\mathcal{M}_{p}^{i}$ | 0.008 | 0.196 | 0.460 | 0.780 | 0.844 | 0.936 | 17.580
$\mathcal{M}_{p}^{t}$ | 0.032 | 0.280 | 0.500 | 0.748 | 0.820 | 0.892 | 23.224
$\mathcal{M}^{0}$ | 0.004 | 0.064 | 0.140 | 0.252 | 0.336 | 0.488 | 126.664

####  4.2.3 Ablation Study

We then discuss how the performance of a poisoning attack is affected by the
following factors.

Poisoning rate. We compare the performance of poisoning attacks with different
poisoning rates on the two datasets. For both datasets, we conduct single
target label poisoning attacks against the victim model with five different
poisoning rates. We conduct six different poisoning rates $\phi$ on Flickr-
PASCAL (sheep2aeroplane) and six on COCO (boat2dog), respectively. The
poisoning rate of 0 means that the model trains on clean data without
poisoning. Figure 3 shows that with the increase in the poisoning rate, the
attack performance improves in both datasets. For instance, on Flickr-PASCAL,
with only 0.03% poisoning rate, the MinRank already reaches 6. This further
emphasizes the potential risk of data poisoning attacks against multimodal
encoders.

Figure 3: Influence of poisoning rate. Figure 4: Influence of fine-tuning
epochs.

Fine-tuning epoch. While keeping the same poisoning rate, we compare the
attack performance on the two datasets at different epochs ranging from 0 to
10. And we experiment on the pretrained model when the epoch is 0. Figure 4
shows that the attack performs well even after one or two epochs, which
reveals the power of our attack. With more fine-tuning epochs, the performance
fluctuates but remains effective in general.

(a)

(b)

(c)

Figure 5: (a) Influence of different CLIP models. (b) Influence of dataset
size. (c) Average MinRank of Attack II on all possible category combinations
on Flickr-PASCAL.

Image encoder type. Figure 5 shows the performance of Attack II on both
datasets with different image encoders. Model statistics can be found in
Appendix Section A.2. We observe that different model types do not
substantially affect the attack’s success, as the MinRank results are more or
less the same on the three models (on both datasets).

Data size. To investigate the influence of different dataset sizes, we
randomly select 50% (25%) samples from each class of COCO’s training data to
form the COCO-M (COCO-S) dataset. We keep the same test dataset, i.e., all
sharing the same 3,900 images. Figure 5 shows Attack II’s performance of
boat2dog with the same poisoning rate 0.24% on three datasets, i.e., COCO,
COCO-M, and COCO-S. We observe that, under the same poisoning rate, the attack
performance is not correlated with the data size.

Poisoning goal. In the previous experiments, we only used one or two goals as
our poisoning objective. Here, we traverse all possible combinations of the 20
classes in Flickr-PASCAL as our poisoning goal and conduct Attack II on it.
Figure 5 shows the average MinRank of the attacks. For a poisoning goal A2B, A
and B are represented by the y-axis and the x-axis, respectively. Each number
from 0 to 19 represents each class in PASCAL alphabetically. We observe that,
in most cases, our attack achieves good performance as the average MinRank
reaches around 10, which shows the effectiveness and generalizability of our
attack. However, the MinRank of the 14th column is relatively large, where the
goal corresponds to A2person, i.e., the attacker aims at poisoning some
targeted texts to person images. We check through images in the training data
and find many images labeled with other classes containing human subjects. For
example, there is a chair image of several people sitting together and a
tvmonitor image where a man sits with his laptop. More examples can be found
in Appendix Section A.3. Based on the case study, the person (text, image)
pairs are more than those labeled as person in the dataset. With the same
poisoning rate, more person images would remain. Thus the poisoning goal of
A2person is more challenging.

##  5 Possible Defenses

We propose two kinds of defenses against the poisoning attack, i.e., pre-
training defense and post-training defense.

Pre-training defense. The pre-training defense is a dataset-level defense that
filters the training data so that potentially poisoned samples can be removed.
Concretely, we first compute the text/image embeddings in $\mathcal{D}$ using
a pre-trained multimodal model. Then, we calculate the cosine distances
between the embeddings of (text, image) pairs and remove those pairs whose
cosine distance is higher than a threshold $\gamma$. A relatively high cosine
distance indicates that the text and image are not very relevant from the view
of their embeddings, and that they are prone to be mismatched. Figure 6 shows
the probability density distribution of cosine distances of clean and poisoned
pairs on Flickr-PASCAL used in Attack II. We use the pre-trained CLIP-ViT-B/16
(different from the target model) to compute the embeddings. We notice that
the cosine distances between clean pairs are centered around 0.75, while those
between poisoned pairs are around 0.85. Thus, we choose 0.8 as the threshold
$\gamma$ and conduct pre-training defense on the Attack II poisoned Flickr-
PASCAL dataset. Given the fact the poisoned data is often unknown, the model
trainer can first manually label a randomly selected subset of samples and
determine the threshold based on these samples. After the defense, we fine-
tune the model on the filtered dataset following the previous settings and
evaluate the attack performance. Table 7 shows the attack performance (Attack
II) after conducting pre-training defense on Flickr-PASCAL. Our defense
achieves good performance as the Hit@K rates are even lower than that of the
clean model. And the average MinRank of the defensed model drops from 2 to 49,
which shows the effectiveness of our defense. Also, the utility after defense
is as good as the clean model, where the Hit@10 rate of TR and IR task of the
defensed model reach 0.978 and 0.970 while 0.984 and 0.971 for the clean
model.

Table 7: Pre-training defense on Flickr-PASCAL

Method | Hit@1 | Hit@5 | Hit@10 | MinRank
---|---|---|---|---
Attack II | 0.280 | 0.864 | 0.936 | 2.192
Defense | 0.000 | 0.008 | 0.016 | 49.576
Clean | 0.024 | 0.088 | 0.200 | 51.048

Post-training defense. The post-training defense is a model-level defense. The
idea is that, if a model is poisoned, we can sterilize this poisoned model by
fine-tuning on another dataset while keeping the utility on the original test
data. Here, we introduce Visual Genome (VG) [15], a representative region
captions dataset. This dataset contains 94,313 images and 4,100,413 snippets
of text (43.5 per image), each grounded to a region of an image. Figure 7
shows the results of post-training defense on the Attack II poisoned models on
both datasets. We observe that the defense already shows effectiveness even
with only one epoch. For example, on Flickr-PASCAL, the Hit@10 drops from 0.9
to around 0.0 at the first epoch, and remains at a very low level afterward.
This shows the effectiveness of our defense. Note that the models’ utility
does not drop after the defense as shown in Table 8.

Table 8: Utility of post-training defense

Dataset | Hit@10 (TR) | Hit@10 (IR)
---|---|---
Flickr-PASCAL | 0.978 (-0.006) | 0.954 (-0.017)
COCO | 0.976 (+0.065) | 0.945 (+0.109)

Figure 6: Probability density of cosine distances between clean/poisoned pairs
in Flickr-PASCAL. Figure 7: Performance of post-training defense against
Attack II poisoned models.

##  6 Conclusion

In this paper, we first study the vulnerability of data poisoning attacks
against multimodal models in both visual and linguistic modalities. Our three
types of poisoning attacks show their effectiveness in achieving remarkable
attack performance while keeping the model’s utility on clean data. Our
evaluation of the poisoning effects on the visual and linguistic modalities
shows that both modalities are vulnerable to poisoning attacks but reflected
in different ways. Poisoning the visual modality leads to a better MinRank,
while poisoning the linguistic modality results in higher Hit@K with a small K
(e.g., 1). To mitigate the attacks, we propose two types of defenses. Our
evaluation shows that both defenses effectively mitigate the attacks while
preserving the multimodal model utility. To the best of our knowledge, our
defenses are the first to address the data poisoning attack against multimodal
encoders. In the future, we plan to extend our work into more different
modalities.

#### Reproducibility Statement

To be reproducible for the findings of a study means that results and the
observations should be achieved again with a high degree of reliability. Since
our attacks only modify the training data and the training process is open-
source, it is easy to conduct the experiments and reproduce our results. And
we have comprehensively evaluated the attacks as well as the defenses across
various dimensions, and it would be enough to follow our setting and conduct
new methods based on them. To make it more reliable, we fix the random seed to
42 in our experiments. Regarding the required computational resources, since
we only fine-tune the pretrained model instead of training it from scratch, it
is relatively easier to follow the same settings as ours.

## References

  * [1] Hassan Akbari, Liangzhe Yuan, Rui Qian, Wei-Hong Chuang, Shih-Fu Chang, Yin Cui, and Boqing Gong.  VATT: Transformers for Multimodal Self-Supervised Learning from Raw Video, Audio and Text.  In Annual Conference on Neural Information Processing Systems (NeurIPS), pages 24206–24221. NeurIPS, 2021.
  * [2] Battista Biggio, Blaine Nelson, and Pavel Laskov.  Poisoning Attacks against Support Vector Machines.  In International Conference on Machine Learning (ICML). icml.cc / Omnipress, 2012.
  * [3] Min Cao, Shiping Li, Juntao Li, Liqiang Nie, and Min Zhang.  Image-text Retrieval: A Survey on Recent Research and Development.  In International Joint Conferences on Artifical Intelligence (IJCAI), pages 5410–5417. IJCAI, 2022.
  * [4] Nicholas Carlini and Andreas Terzis.  Poisoning and Backdooring Contrastive Learning.  CoRR abs/2106.09667, 2021.
  * [5] Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey E. Hinton.  A Simple Framework for Contrastive Learning of Visual Representations.  In International Conference on Machine Learning (ICML), pages 1597–1607. PMLR, 2020.
  * [6] Xinlei Chen, Haoqi Fan, Ross B. Girshick, and Kaiming He.  Improved Baselines with Momentum Contrastive Learning.  CoRR abs/2003.04297, 2020.
  * [7] Xinlei Chen, Hao Fang, Tsung-Yi Lin, Ramakrishna Vedantam, Saurabh Gupta, Piotr Dollár, and C. Lawrence Zitnick.  Microsoft COCO Captions: Data Collection and Evaluation Server.  CoRR abs/1504.00325, 2015.
  * [8] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby.  An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale.  In International Conference on Learning Representations (ICLR), 2021.
  * [9] Han Fang, Pengfei Xiong, Luhui Xu, and Yu Chen.  CLIP2Video: Mastering Video-Text Retrieval via Image CLIP.  CoRR abs/2106.11097, 2021.
  * [10] John M. Giorgi, Osvald Nitski, Bo Wang, and Gary D. Bader.  DeCLUTR: Deep Contrastive Learning for Unsupervised Textual Representations.  In Annual Meeting of the Association for Computational Linguistics (ACL), pages 879–895. ACL, 2021.
  * [11] Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross B. Girshick.  Momentum Contrast for Unsupervised Visual Representation Learning.  In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 9726–9735. IEEE, 2020.
  * [12] Xinlei He, Zheng Li, Weilin Xu, Cory Cornelius, and Yang Zhang.  Membership-Doctor: Comprehensive Assessment of Membership Inference Against Machine Learning Models.  CoRR abs/2208.10445, 2022.
  * [13] Xinlei He and Yang Zhang.  Quantifying and Mitigating Privacy Risks of Contrastive Learning.  In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 845–863. ACM, 2021.
  * [14] Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry.  Adversarial Examples Are Not Bugs, They Are Features.  In Annual Conference on Neural Information Processing Systems (NeurIPS), pages 125–136. NeurIPS, 2019.
  * [15] Ranjay Krishna, Yuke Zhu, Oliver Groth, Justin Johnson, Kenji Hata, Joshua Kravitz, Stephanie Chen, Yannis Kalantidis, Li-Jia Li, David A. Shamma, Michael S. Bernstein, and Li Fei-Fei.  Visual Genome: Connecting Language and Vision Using Crowdsourced Dense Image Annotations.  International Journal of Computer Vision, 2017.
  * [16] Iro Laina, Christian Rupprecht, and Nassir Navab.  Towards Unsupervised Image Captioning With Shared Multimodal Embeddings.  In IEEE International Conference on Computer Vision (ICCV), pages 7413–7423. IEEE, 2019.
  * [17] Junnan Li, Dongxu Li, Caiming Xiong, and Steven C. H. Hoi.  BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generation.  CoRR abs/2201.12086, 2022.
  * [18] Zheng Li, Yiyong Liu, Xinlei He, Ning Yu, Michael Backes, and Yang Zhang.  Auditing Membership Leakages of Multi-Exit Networks.  CoRR abs/2208.11180, 2022.
  * [19] Zheng Li and Yang Zhang.  Membership Leakage in Label-Only Exposures.  In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 880–895. ACM, 2021.
  * [20] Ron Mokady, Amir Hertz, and Amit H. Bermano.  ClipCap: CLIP Prefix for Image Captioning.  CoRR abs/2111.09734, 2021.
  * [21] Norman Mu, Alexander Kirillov, David A. Wagner, and Saining Xie.  SLIP: Self-supervision meets Language-Image Pre-training.  CoRR abs/2112.12750, 2021.
  * [22] Or Patashnik, Zongze Wu, Eli Shechtman, Daniel Cohen-Or, and Dani Lischinski.  StyleCLIP: Text-Driven Manipulation of StyleGAN Imagery.  CoRR abs/2103.17249, 2021.
  * [23] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever.  Learning Transferable Visual Models From Natural Language Supervision.  In International Conference on Machine Learning (ICML), pages 8748–8763. PMLR, 2021.
  * [24] Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever.  Language Models are Unsupervised Multitask Learners.  OpenAI blog, 2019.
  * [25] Cyrus Rashtchian, Peter Young, Micah Hodosh, and Julia Hockenmaier.  Collecting Image Annotations Using Amazon’s Mechanical Turk.  In Workshop on Creating Speech and Language Data with Amazon’s Mechanical Turk (WCSLD), pages 139–147. ACL, 2010.
  * [26] Florian Schroff, Dmitry Kalenichenko, and James Philbin.  FaceNet: A Unified Embedding for Face Recognition and Clustering.  In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 815–823. IEEE, 2015.
  * [27] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov.  Membership Inference Attacks Against Machine Learning Models.  In IEEE Symposium on Security and Privacy (S&P), pages 3–18. IEEE, 2017.
  * [28] Mingjie Sun, Jian Tang, Huichen Li, Bo Li, Chaowei Xiao, Yao Chen, and Dawn Song.  Data Poisoning Attack against Unsupervised Node Embedding Methods.  CoRR abs/1810.12881, 2018.
  * [29] Aäron van den Oord, Yazhe Li, and Oriol Vinyals.  Representation Learning with Contrastive Predictive Coding.  CoRR abs/1807.03748, 2018.
  * [30] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin.  Attention is All you Need.  In Annual Conference on Neural Information Processing Systems (NIPS), pages 5998–6008. NIPS, 2017.
  * [31] Yizhen Wang and Kamalika Chaudhuri.  Data Poisoning Attacks against Online Learning.  CoRR abs/1808.08994, 2018.
  * [32] Zhibo Wang, Jingjing Ma, Xue Wang, Jiahui Hu, Zhan Qin, and Kui Ren.  Threats to Training: A Survey of Poisoning Attacks and Defenses on Machine Learning Systems.  ACM Computing Surveys, 2022.
  * [33] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L. Yuille.  Improving Transferability of Adversarial Examples With Input Diversity.  In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2730–2739. IEEE, 2019.
  * [34] Peter Young, Alice Lai, Micah Hodosh, and Julia Hockenmaier.  From image descriptions to visual denotations: New similarity metrics for semantic inference over event descriptions.  Transactions of the Association for Computational Linguistics, 2014.
  * [35] Junhao Zhou, Yufei Chen, Chao Shen, and Yang Zhang.  Property Inference Attacks Against GANs.  In Network and Distributed System Security Symposium (NDSS). Internet Society, 2022.
  * [36] Pan Zhou, Wenwen Yang, Wei Chen, Yanfeng Wang, and Jia Jia.  Modality Attention for End-to-end Audio-visual Speech Recognition.  In IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 6565–6569. IEEE, 2019.

##  Appendix A Appendix

###  A.1 Dataset

In the experiments, we utilize 4 image-caption datasets to evaluate our
techniques, including Flickr30k [34] (abbreviated as Flickr), PASCAL [25],
COCO [7], and Visual Genome (VG) [15]. Flickr, PASCAL, COCO, and VG are four
widely used benchmark datasets for various natural language processing and
computer vision tasks. To explore the effect of the size of the dataset, we
randomly select 50% (25%) samples from each class of COCO’s training data to
form the COCO-M (COCO-S) dataset. We keep the same test dataset for them,
i.e., all sharing the same 3,900 images. Note that we combine Flickr and
PASCAL as the training dataset Flickr-PASCAL, since Flickr contains no label
information but has a large number of pairs and PASCAL has only a limited
amount of labeled pairs.

Flickr-PASCAL. The Flickr dataset [34] is a large-scale benchmark collection
for sentence-based image description and search. It contains captioned images
scraped from Yahoo’s photo album website, Flickr, but has no class labels. The
PASCAL dataset [25] is a standard caption evaluation dataset containing 1,000
images with 20 categories. The PASCAL dataset is a balanced dataset, i.e.,
each class is represented with 50 images and each image is paired with 5 text
captions. We divide the PASCAL dataset evenly into two parts, training and
testing, at a rate of 1:1, thus keeping the balance at the same time. Since
the PASCAL dataset is too small, we combine the training data of PASCAL and
Flickr together as Flickr-PASCAL to train the model.

COCO. The COCO dataset [7] is one of the most representative large-scale
object detection, segmentation, and captioning datasets. It has 80 object
categories and contains 5 captions per image. For each image, we randomly
select one of the object categories as its label; the more objects it
contains, the more possible the object will be chosen. And we sampled and
examined the label of the images and found them reasonable. We count the
number of images in each class in the COCO dataset. To make the dataset more
balance, we remove the two classes with the lowest number, toaster and hair
drier, which have 28 and 53 images, respectively. For the test data, we
randomly choose 50 images with their captions from each class, and the test
data contains 3,900 images with 78 classes.

COCO-M/COCO-S. The COCO-M/COCO-S dataset is a subset of the COCO dataset. We
randomly select 50% (25%) samples from each class of COCO’s training data to
form the COCO-M (COCO-S) dataset. For the test data, we use the same test data
as the COCO dataset, which contains 3,900 images with 78 classes.

Visual Genome. The Visual Genome (VG) [15] dataset is a widely used region
captions dataset. It contains 94,313 images and 4,100,413 snippets of text
(43.5 per image), each grounded to a region of an image. We randomly select at
most 5 texts for each image and form the training data. Note that we only use
this dataset for fine-tuning in the post-training defense.

###  A.2 Model Statistics

The statistics of our used CLIP model can be found in Table 9. CLIP-ViT-L/14
is the largest model. And CLIP-ViT-B/16 is larger than CLIP-ViT-B/32 in FLOPs
while is slightly smaller than that regarding the number of parameters.

Table 9: Model size

Model | FLOPs | # Params
---|---|---
CLIP-ViT-B/32 | 4.885G | 84.225M
CLIP-ViT-B/16 | 13.208G | 82.456M
CLIP-ViT-L/14 | 56.255G | 258.721M

###  A.3 Case Study for the Poor Performance of Some Goals on Flickr-PASCAL

As shown in Figure 8, each of image does not belong to person class. However,
they all contain humans as their subjects. Their corresponding captions can
even ignore their class. For example, in Figure 8, (a) is paired with “Two
girls in pink and blue outfits.” and “Two women pose beneath a sign saying
Welcome to English Camp.”, (b) is paired with sentences like “A family poses
for a picture while out at a restaurant.”, (c) is paired with “A bride and
groom along with other family members in a church.” and (d) is paired with
“Three dark-haired young men sit in a classroom with one looking at his
laptop.”. These kinds of images can be easily found in the dataset, i.e., many
images containing human subjects belong to other classes. Thus the person
images are more than those labeled as person in the dataset, which implicitly
lowers the poisoning rate and leads to lower attack performance.

(a) chair

(b) dining table

(c) potted plant

(d) tvmonitor

Figure 8: Each image does not belong to the person category, but they all have
human subjects.


# AI in Software Engineering: A Survey on Project Management Applications

Talia Crawford, Scott Duong, Richard Fueston, Ayorinde Lawani, Samuel Owoade,
Abel Uzoka, Reza M. Parizi  Department of Software Engineering and Game
Development, Kennesaw State University, Marietta, GA, USA
{tcrawf28, sduong3, rfueston , alawani, sowoade,
<EMAIL_ADDRESS><EMAIL_ADDRESS>Abbas Yazdinejad  Cyber
Science Lab, School of Computer Science, University of Guelph, Ontario, Canada
<EMAIL_ADDRESS>
Abstract – Artificial Intelligence (AI) refers to the intelligence
demonstrated by machines, and within the realm of AI, Machine Learning (ML)
stands as a notable subset. ML employs algorithms that undergo training on
data sets, enabling them to carry out specific tasks autonomously. Notably, AI
holds immense potential in the field of software engineering, particularly in
project management and planning. In this literature survey, we explore the use
of AI in Software Engineering and summarize previous works in this area. We
first review eleven different publications related to this subject, then
compare the surveyed works. We then comment on the possible challenges present
in the utilization of AI in software engineering and suggest possible further
research avenues and the ways in which AI could evolve with software
engineering in the future.

Keywords: Artificial Intelligence, Artificial Neural Network, Agile
Methodology, Project Management, Software Development, Risk Mitigation,
Machine Learning.

##  I Introduction

Artificial Intelligence (AI) (including Machine Learning (ML)) is an emerging
part of the software engineering landscape. Much of the success of software
projects depends heavily on project management and preparation. A team’s
success can be influenced by whether the project was adequately planned.
Project requirements, cost estimation, and risk mitigation are some of these
crucial aspects. Mistakes in this type of decision can result in increased
costs or project failure. Therefore, many software engineers are now looking
for ways in which AI could be applied to reduce the error involved in project
development decisions [1].

Many are hopeful that AI can be utilized in the near future to manage
potential risks and organize projects more effectively. If AI is successfully
implemented in software project development decisions, there could be a
decrease in project failures and errors during development and an increase in
project efficiency and quality. The way in which AI/ML is intended to be used
in current software engineering is shown in the following Figure 1.

Figure 1: This figure shows how current AI and ML work with software
engineering.

##  II Surveyed Works

There are many previously published works related to Artificial Intelligence
in Software Engineering. Here we will review eleven such publications that
discuss and are related to the intersection of software engineering and
artificial intelligence. Each of these publications is unique, with the oldest
being from 1992 and the most recent being from 2022. We decided to include the
sources from 1992 as a way to see the larger picture involved in implementing
AI in software engineering. While these two sources do not reflect the current
attitude and ideas surrounding this intersection of AI and software
engineering, they provide an important perspective so that we can see how the
landscape has changed and how it has remained the same over the last 30 years
of development.

The other nine sources that were surveyed were published between 2018 and
2022, which we believe provides a range that covers the current information on
this subject as it is rapidly changing. In the paper “Towards Effective AI-
powered Agile Project Management”[2], Dam et al. propose a framework for how
AI technology can be used to support agile project management. Their proposed
framework assists in certain aspects of agile project management, such as
“automating repetitive high-volume tasks to enable project analytics for
estimation and risk prediction” [2]. In “Artificial Neural Network
Architecture and Orthogonal Arrays in Estimation of Software Projects
Efforts”[3], Ranković et al. propose a model of an artificial neural network
to minimize error in software project development estimation. They combined
both traditional mathematical models as well as machine learning algorithms in
order to improve the accuracy of the assessment of effort and cost of
developing a software system [3]. In Khanna et al.’s “Artificial Intelligence
based Risk Management Framework for Distributed Agile Software
Development”[4], the authors propose a system to mitigate risks in Distributed
Agile Software Development. They first address the differences between
distributed development and agile development and then propose a way to
mitigate risks for the combined development system. The authors state that
“manual risk management is ineffective as it is purely dependent on the
experience and analysis of the person conducting it,” and therefore there is a
need for automated risk assessment and prioritization [4].

In “A Tool For Software Requirement Allocation Using Artificial Intelligence
Planning”[5], Pereira et al. introduce a plan for an AI task allocation tool
in order to allocate software requirements into versions. Their proposed tool
reviews the requirements considering the development time, priority levels,
and dependency relationships in order to allocate each requirement. They
identified the main limitation of this proposed model as the “subjectivity of
identifying values used as requirement priority, size, and dependencies.”[5].
In the article “Machine Learning for Software Engineering: Models, Methods,
and Applications”[6], Meinke and Bennaceur look at the application of ML in
software engineering. They state that while machine learning is a mature
discipline, perspectives of ML in software engineering are much less common.
Machine learning has the potential to become very useful to the software
engineering discipline to coincide with the current upwards trend of agile
development, as ML has the ability to meet the needs of these changing
approaches. [6]. One of the earliest publications on AI use in software
engineering is ”The Relationships of AI to software engineering,” a talk by
Partridge from 1992. Partridge discusses having AI provide support for the
software development process and decision-making [7]. This is in line with
current ideas of how AI would best be used in software engineering.

Another talk from the same conference in 1992 provides us with a second of the
earliest publications on AI in software engineering. “Application of AI and
model building techniques to software engineering,”[8] is a publication by
Bennett et al. that details work in using AI to support modeling and
simulation of dynamical systems, as a part of which they considered how “the
techniques can be applied to model-based software engineering methodologies
for specification and design of software”[8]. This source and the previous
source provide an important place of reference for us to understand that this
idea of using AI for software engineering and project management is not unique
to the current trend of agile development, and software engineers have been
seeing the need for support in decision making for many years. In the article
“Software Engineering for Machine-Learning Applications: The Road Ahead”[9],
Khomh et al. discuss the challenges of using AI and ML in software
engineering. The main challenge is that it can be difficult to effectively
develop, test, and evolve a system since there may not be complete
specifications for some of the most important behaviors. The author Lu et al.
discusses the ability of AI to make decisions in an ethical way in “Software
Engineering for Responsible AI: An empirical study and operationalized
patterns”[10]. This paper discusses the different ethical principles involved
in using AI models. Since AI is complex, it makes risk assessment of its
adoption very difficult, and there are many trade-offs between the different
principles. Dynamic and adaptive ethics assessment needs to be conducted for
each context in which AI is proposed to be used. AI systems should be
integrated into requirement-driven and outcome-driven development, as they
continuously learn based on new data. These requirements need to be specified,
verifiable, and measurable to ensure accurate requirements validation.

In the paper “Analysis of Software Engineering for Agile Machine Learning
Projects”[11], Singla et al. look at the issues in tracking data from machine
learning projects in the scrum. They analyze the types of issues found in the
collected data and propose some ways in which Agile machine learning projects
can improve their logging and execution[11]. The paper, “The Future of
Software Engineering by 2050s: Will AI Replace Software Engineers?” seeks to
establish the state of the software engineering role by 2050 with regard to
inevitable changes necessitated by AI. Basing the work of a survey of software
engineers in the field, the author argues that the engineer’s role might be
different, especially in the design, coding, and testing phases of the
project. The work concludes that while some software engineering roles could
be replaced by AI, new roles are going to be created - in AI systems
moderation and development. [12]

Table 1:  A comparison of ten surveyed sources as previously reviewed in Section II.  Cit. No. |  Authors |  Year |  Type of Publication |  Limitations
---|---|---|---|---
[2] |  H. K. Dam, T. Tran, J. Grundy, A. Ghose and Y. Kamei |  2019 |  Proposal of an AI System for Agile PM |  This proposal plans to develop a prototype and test it on 150 open source projects. This can be limiting in that the projects are restricted to only open source projects that are available to the authors.
[3] |  N. Ranković, D. Ranković, M. Ivanović and L. Lazić |  2021 |  Proposal for Artificial Neural Network use in Software Engineering risk estimation |  This publication uses a limited sample size, but takes many steps in their approach to minimize limitations.
[4] |  E. Khanna, R. Popli and N. Chauhan |  2021 |  Proposed framework for AI use in Distributed Agile software development methodology |  This includes a proposed framework based on a survey of other literature, where limitations can arise due to the limited number of other papers they were able to survey when creating their own framework proposal.
[5] |  F. C. Pereira, G. B. Neto, L. F. De Lima, F. Silva and L. M. Peres |  2022 |  Proposal of an AI tool for software requirement allocation |  This is a validation study and external factors can greatly influence the results. The main limitation is the “subjectivity of identifying values used as requirement priority, requirement size, and dependencies.”[5]
[6] |  K. Meinke and A. Bennaceur |  2018 |  Proposed technical briefing of Machine Learning in software engineering development |  Lack of successful examples of ML working in a SE project.
[7] |  D. Partridge |  1992 |  Extended abstract of a talk given on the interactions of AI to software engineering |  This source is from 1992 so it doesn’t include current information.
[8] |  S. Bennett, D. A. Linkens, E. B. Tanyi and A. Scott |  1992 |  Extended abstract of a talk given on the use of AI techniques to support software engineering |  This source is from 1992 so it doesn’t include current information.
[9] |  F. Khomh, B. Adams, J. Cheng, M. Fokaefs and G. Antoniol |  2018 |  Account of possible challenges or solutions of merging ML and Software Engineering as brought up during a conference |  Each of the mentioned challenges or solutions were brought up at a small conference.
[10] |  Q. Lu, L. Zhu, X. Xu, J. Whittle, D. Douglas and C. Sanderson |  2022 |  Results of interviews conducted with AI/ML scientists and engineers pertaining to ethical issues in AI/ML projects |  The sample size of the interviews conducted were restricted to only responders in Australia.
[11] |  K. Singla, J. Bose, and C. Naik |  2018 |  Results of a study conducted within a company on using agile methodology with machine learning projects |  The size of this study was small and completely within one company.
[12] |  L. M. Abu Zohair |  2018 |  Results of a study conducted using an online survey about the future of AI given to professionals in the field |  The surveyed professionals were limited to those who responded to the online survey within a short time frame. Further views could have been collected to provide more valuable data. [12]

##  III Comparison of Works

In order to best represent the similarities and differences between each of
the previously discussed papers, we have included the following Table 1.

This table includes a comparison of the year each source was published, the
type of publication, and any limitations mentioned. The type of publication
gives information surrounding the publication itself, such as whether it is a
proposal for a tool, a conference talk, or a study that was conducted. The
limitations included in the following table are either limitations identified
in the paper or limitations surrounding the paper’s pertinence and usability.

##  IV Challenges

While most of these sources agree that AI support would be immensely useful in
software engineering project management, they also bring up some of the
possible challenges in trying to implement AI usage in teams. One of these
challenges is the accuracy of systems built using AI and ML models. It has
been pointed out that while programs may be able to imitate human behavior,
practical products cannot use the same methods that humans use, as they cannot
guarantee accuracy [9]. Another challenge is the ethics involved in
implementing AI models. Currently, most companies utilize a single risk
assessment of an AI model and then move on, which is not usually sufficient
for a high-level and continuously learning AI system [10]. There can also be
difficulties in testing ML and AI systems. These systems might need a
different approach to testing than a regular system since the AI might be
incorrect even if the algorithms are correctly implemented. AI systems are
only able to learn from available data, so if enough data isn’t present it can
become very difficult to correctly train and implement an AI system.

One of the greatest challenges to the industry for AI is its ability to behave
for the AI [10]. There have been many chat AI experiments that have gone
poorly and had to be taken down. This can be due to the data present for the
AI changing the way it works as stated above. This can lead to a lot of issues
and catastrophic public relations issues for companies leading to a fear of
adoption, as can be seen with companies’ hesitance in ingratiating with
ChatGPT. No one in the industry wants to be known for an AI bot that goes
crazy, so gaining the trust of the industry is difficult [10]. As for
adoption, there is a challenge in the change in the behavior of people using
AI. Once users start trusting AI; they can become accustomed to relying on AI
and their behavior in a software engineering setting can change, which could
be for the worse as it could also change what the AI learns [9, 13].
Challenges for development practices and agile practices can also be an issue
that can be affected by AI. For agile scrum practice, it can be extremely
important to have team context, and the data given to the AI might not be
encompassing enough to count for all aspects, including some of the human work
and interaction elements. Agile is already challenging for Trained Scrum
masters to ensure that the teams are performing well AI might make bad choices
due to lack of data sets and cause sprints to fail. This could be seen in
story sizing or grooming task automatically [2]. As for development tasks, the
future of development is most likely very AI driven in its coding tools. There
are already a lot of suggested code completions for current IDEs. However,
this can be very challenging as developers lose the ability to code with
assistance and end up relying on existing code data without the ability to
create new ways to solve problems without existing code examples. [12]

##  V  Emerging New Technologies in Software Engineering Project Management

As we explore the confluence of AI and Software Engineering Project
Management, it’s crucial to consider the transformative impact of other
emerging technologies. Blockchain in Software Engineering Project Management,
IoT-Enhanced Software Engineering Project Management, and AI-Driven
Cybersecurity in Software Development each offer unique solutions and
approaches that further strengthen AI’s role within this realm. These
technologies individually address a myriad of challenges prevalent in project
management, simultaneously paving the way for innovative solutions. In this
section, we examine how these technologies intersect with AI within software
engineering project management, shedding light on their current applications
and potential to shape future practices.

###  V.1 Blockchain in Software Engineering Project Management

At its core, blockchain technology provides a decentralized and transparent
mechanism for recording transactions. This inherent characteristic of
immutability and transparency can be leveraged in software engineering project
management to enhance several aspects, particularly concerning trust,
collaboration, and traceability [14]. Project management often involves
various stakeholders, including developers, testers, project managers, and
clients, among others. Each stakeholder contributes to the project’s progress
in a unique way, resulting in various activities and transactions. By
leveraging blockchain technology, these transactions can be recorded in an
immutable and transparent manner. This feature not only enhances trust among
stakeholders but also improves auditability [15]. For instance, task
assignments, progress updates, and milestone achievements can be recorded on a
blockchain. With each block representing a particular activity, stakeholders
can verify the project’s state at any given time, enhancing transparency.
Blockchain also significantly reduces disputes since every action is traceably
documented and cannot be altered retroactively [16, 17].

Moreover, blockchain technology can foster efficient and secure collaboration
in distributed teams. Smart contracts, a key component of blockchain
technology, can automate project management aspects, such as milestone-based
payments or resource allocation, based on predefined rules. This automation
reduces administrative overhead and allows stakeholders to focus on their
primary responsibilities, thereby improving productivity. However, it’s
important to note that the integration of blockchain technology into software
engineering project management is not without challenges. The immutability of
blockchain means that any mistake recorded on the blockchain is permanent,
which calls for a robust error prevention and mitigation mechanism.
Furthermore, privacy concerns, computational overhead, and the complexity of
implementing blockchain should also be taken into account while considering
this technology for project management [18, 19, 20].

###  V.2 IoT-Enhanced Software Engineering Project Management

The Internet of Things (IoT), with its capacity to connect billions of devices
and facilitate real-time data exchange, can dramatically impact software
engineering project management [21]. IoT can augment AI’s capability by
providing a wealth of real-time data that can be analyzed and utilized to make
better project management decisions. For example, an IoT-enabled workspace
could monitor various project-related parameters, such as the developer’s
working hours, meeting durations, code check-in frequency, and much more. This
data, when combined with AI and ML algorithms, can provide insights into
project progress, productivity trends, and potential bottlenecks [22, 23]. It
could also help in predictive tasks such as estimating project completion
times or identifying potential risks, thereby enabling proactive project
management. IoT can also enhance collaboration and communication within a
project team. Team members can communicate effectively, irrespective of their
geographical location, through connected devices and collaborative tools. This
is especially crucial in today’s age of remote working and distributed teams.
Despite the immense potential of IoT in project management, there are certain
challenges to be addressed. Data security and privacy are a primary concern,
given the sensitive nature of project data. Implementing the appropriate
safeguards to protect this data is a must. Additionally, managing the vast
amount of data generated by IoT devices requires significant computational
resources and efficient data management strategies[24, 25].

###  V.3 AI-Driven Cybersecurity in Software Development

AI has been a game-changer in the cybersecurity landscape, and its application
in software development is no exception. In the context of software
engineering project management, AI-driven cybersecurity can play a pivotal
role in ensuring secure development practices and safeguarding project
artifacts [26]. AI and ML algorithms can help identify potential security
vulnerabilities in the software being developed. Through the analysis of code
patterns, AI can detect anomalies, flag insecure coding practices, and even
suggest remediation measures. This proactive approach to security can
significantly reduce the chances of security breaches and the costs associated
with them. Furthermore, AI can also enhance access control and data protection
in project management tools [27, 28]. By learning the typical access patterns,
AI can detect and prevent unauthorized access, thereby protecting sensitive
project data. Similarly, AI-driven cybersecurity measures can safeguard
sensitive project communications, ensuring that confidential project
information is securely transmitted and stored.

In addition to securing the project artifacts, AI can play an essential role
in the area of risk management, a key aspect of project management. AI can
help identify potential cybersecurity risks at an early stage of the project,
allowing project managers to take necessary mitigation measures proactively.
While the application of AI in cybersecurity offers numerous benefits, it’s
not devoid of challenges. A primary concern is the false positives that may
result from AI-based threat detection, leading to unnecessary remediation
activities. Furthermore, maintaining the privacy of project data while using
it to train AI models can also be a challenge [29]. These emerging
technologies, i.e., Blockchain, IoT, and AI-Driven Cybersecurity, have the
potential to revolutionize software engineering project management. They can
enhance various aspects of project management, including collaboration,
transparency, risk management, and security. However, the effective
integration of these technologies requires careful consideration of their
associated challenges and the development of appropriate strategies to address
them. As technology continues to advance, it will be interesting to see how
these trends evolve and further shape the future of software engineering
project management.

##  VI Future Road Map

While there are challenges to using AI in software engineering, there is also
possible future work that could mitigate these problems. Firstly, many of the
reviewed papers were proposals for systems using AI or ML in software
engineering. In order to overcome potential problems, we first need to work on
getting basic implementations of AI trained to solve the problems engineers
face in project management. Only once we have this baseline will we be able to
truly address the issues that arise, logistic, ethical, or otherwise.

A lot of this will be handled by new and easy-to-use abstraction layers making
the future of coding easy for anyone. The key is for developers to cope with
the AI changes to prevent being replaced. Development jobs might change into
more administrative-style jobs, as can currently be seen in development
operations. [12]

The majority of the papers surveyed agree that AI would change the nature of a
software development project. Data analysis is posited as a major task in
which AI/ML would be a factor. Inevitably, AI/ML shall evolve to assist the
project manager with more technical tasks - establishing these tasks and
training the models are some of the work that we expect to see going forward.
Specific areas of future AI/ML applications include project planning,
reporting, and monitoring.

There is potential for AI to be integrated into more than just the project
management area but throughout project development. In Figure 2, we show some
possible future uses of AI in software engineering.

Figure 2: This figure shows how current AI and ML work with software
engineering.

##  VII Conclusions

In the field of Software Engineering, Artificial Intelligence, and Machine
Learning are extremely rapidly developing technologies. AI and ML have the
potential to become invaluable to software engineering, not just in the active
parts of software development but also on the project management side.

In this paper, we have reviewed eleven different sources that all pertain to
AI in software engineering. Throughout these sources, we have found
commonalities in how AI could be utilized in project management. Some of the
main causes of failure in software development are errors made in the project
planning phase and mismanagement of projects. If AI were able to step in and
reduce some of the uncertainty in this initial decision-making and planning,
then software development projects could have higher rates of success. Some
specific areas that could greatly improve would be risk assessment and
management, cost estimation, and project requirements.

Of our eleven surveyed papers, we chose to review two that were from 1992. We
chose to do this so that we could gain a wider perspective on how AI has been
developing in the field of software engineering over the past thirty years.
These sources allowed us to understand that even when the field of AI was not
developed enough to have been a viable option to turn to, and before Agile was
the popular framework it is today, software engineers were identifying the
same problems and potential AI solutions that we have today.

Eight of our sources were of more current information. They each discussed
either possible proposals for AI systems that would improve software
engineering project management or results from studies relating to how AI and
software engineering are intersecting now. Many sources identified common
potential limitations, as well as potential solutions to current project
management issues.

Our last source, Zohair [12], was a survey of professionals in the software
field on the future of AI within the next thirty years. This provides a good
contrast to how software engineers were viewing AI thirty years ago by showing
where software engineers expect AI to be in 2050. Given the inevitability of
and how rapidly progressing the field of AI is, it is important to note that
not only can AI evolve to provide support for the areas in which project
failures are most likely to stem but also in the areas which may not
necessarily need AI intervention to prevent failure. While there is the
potential for Artificial Intelligence and Machine Learning to take over some
aspects of software engineers’ jobs, its constantly growing and evolving
nature will open up new avenues for software developers to pursue.

In conclusion, integrating Artificial Intelligence and Machine Learning into
the software engineering field can potentially solve many problems that still
exist in the development process. If AI can reduce the risk involved in
software development and take out some of the aspects of human error that is
inevitable in project planning and cost estimation, software projects could
have much greater chances of success. Many software engineers agree that AI
could be invaluable in a support role in software development, even if they
might not agree on how it could be implemented more fully into the entire
process.

## References

  * [1] Y. Hailemariam, A. Yazdinejad, R. M. Parizi, G. Srivastava, and A. Dehghantanha, “An empirical evaluation of ai deep explainable tools,” in 2020 IEEE Globecom Workshops (GC Wkshps, pp. 1–6, IEEE, 2020.
  * [2] H. K. Dam, T. Tran, J. Grundy, A. Ghose, and Y. Kamei, “Towards effective ai-powered agile project management,” in 2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER), pp. 41–44, 2019.
  * [3] N. Ranković, D. Ranković, M. Ivanović, and L. Lazić, “Artificial neural network architecture and orthogonal arrays in estimation of software projects efforts,” in 2021 International Conference on INnovations in Intelligent SysTems and Applications (INISTA), pp. 1–6, 2021.
  * [4] E. Khanna, R. Popli, and N. Chauhan, “Artificial intelligence based risk management framework for distributed agile software development,” in 2021 8th International Conference on Signal Processing and Integrated Networks (SPIN), pp. 657–660, 2021.
  * [5] F. C. Pereira, G. B. Neto, L. F. D. Lima, F. Silva, and L. M. Peres, “A tool for software requirement allocation using artificial intelligence planning,” in 2022 IEEE 30th International Requirements Engineering Conference (RE), pp. 257–258, 2022.
  * [6] K. Meinke and A. Bennaceur, “Machine learning for software engineering: Models, methods, and applications,” in 2018 IEEE/ACM 40th International Conference on Software Engineering: Companion (ICSE-Companion), pp. 548–549, 2018.
  * [7] D. Partridge, “The relationships of ai to software engineering,” in IEE Colloquium on Software Engineering and AI (Artificial Intelligence) (Digest No.087), pp. 9/1–9/2, 1992.
  * [8] S. Bennett, D. A. Linkens, E. B. Tanyi, and A. Scott, “Application of ai and model building techniques to software engineering,” in IEE Colloquium on Software Engineering and AI (Artificial Intelligence) (Digest No.087), pp. 6/1–6/3, 1992.
  * [9] F. Khomh, B. Adams, J. Cheng, M. Fokaefs, and G. Antoniol, “Software engineering for machine-learning applications: The road ahead,” IEEE Software, vol. 35, no. 5, pp. 81–84, 2018.
  * [10] Q. Lu, L. Zhu, X. Xu, J. Whittle, D. Douglas, and C. Sanderson, “Software engineering for responsible ai: An empirical study and operationalised patterns,” in 2022 IEEE/ACM 44th International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), pp. 241–242, 2022\.
  * [11] K. Singla, J. Bose, and C. Naik, “Analysis of software engineering for agile machine learning projects,” in 2018 15th IEEE India Council International Conference (INDICON), pp. 1–5, 2018.
  * [12] L. M. A. Zohair, “The future of software engineering by 2050s: Will ai replace software engineers?,” International Journal of Information Technology and Language Studies (IJITLS), vol. 2, pp. 1–13, 2018.
  * [13] A. Yazdinejad, R. M. Parizi, G. Srivastava, and A. Dehghantanha, “Making sense of blockchain for ai deepfakes technology,” in 2020 IEEE Globecom Workshops (GC Wkshps, pp. 1–6, IEEE, 2020.
  * [14] A. Yazdinejad, R. M. Parizi, A. Dehghantanha, and K.-K. R. Choo, “P4-to-blockchain: A secure blockchain-enabled packet parser for software defined networking,” Computers & Security, vol. 88, p. 101629, 2020.
  * [15] E. Rabieinejad, A. Yazdinejad, and R. M. Parizi, “A deep learning model for threat hunting in ethereum blockchain,” in 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp. 1185–1190, IEEE, 2021.
  * [16] A. Yazdinejad, R. M. Parizi, A. Dehghantanha, Q. Zhang, and K.-K. R. Choo, “An energy-efficient sdn controller architecture for iot networks with blockchain-based security,” IEEE Transactions on Services Computing, vol. 13, no. 4, pp. 625–638, 2020.
  * [17] A. Yazdinejad, A. Dehghantanha, R. M. Parizi, G. Srivastava, and H. Karimipour, “Secure intelligent fuzzy blockchain framework: Effective threat detection in iot networks,” Computers in Industry, vol. 144, p. 103801, 2023.
  * [18] N. Saleem, “Empirical analysis of critical success factors for project management in global software development,” in 2019 ACM/IEEE 14th International Conference on Global Software Engineering (ICGSE), pp. 68–71, IEEE, 2019.
  * [19] A. Yazdinejad, E. Rabieinejad, T. Hasani, and G. Srivastava, “A bert-based recommender system for secure blockchain-based cyber physical drug supply chain management,” Cluster Computing, pp. 1–15, 2023.
  * [20] M. A. Akbar, J. Sang, A. A. Khan, S. Mahmood, S. F. Qadri, H. Hu, H. Xiang, et al., “Success factors influencing requirements change management process in global software development,” Journal of Computer Languages, vol. 51, pp. 112–130, 2019.
  * [21] A. Yazdinejad, A. Dehghantanha, R. M. Parizi, M. Hammoudeh, H. Karimipour, and G. Srivastava, “Block hunter: Federated learning for cyber threat hunting in blockchain-based iiot networks,” IEEE Transactions on Industrial Informatics, vol. 18, no. 11, pp. 8356–8366, 2022.
  * [22] B. Zolfaghari, A. Yazdinejad, and A. Dehghantanha, “The dichotomy of cloud and iot: Cloud-assisted iot from a security perspective,” arXiv preprint arXiv:2207.01590, 2022.
  * [23] A. Yazdinejad, M. Kazemi, R. M. Parizi, A. Dehghantanha, and H. Karimipour, “An ensemble deep learning model for cyber threat hunting in industrial internet of things,” Digital Communications and Networks, vol. 9, no. 1, pp. 101–110, 2023.
  * [24] B. Zolfaghari, E. Rabieinejad, A. Yazdinejad, R. M. Parizi, and A. Dehghantanha, “Crypto makes ai evolve,” arXiv preprint arXiv:2206.12669, 2022.
  * [25] A. Yazdinejad, R. M. Parizi, A. Dehghantanha, H. Karimipour, G. Srivastava, and M. Aledhari, “Enabling drones in the internet of things with decentralized blockchain-based security,” IEEE Internet of Things Journal, vol. 8, no. 8, pp. 6406–6415, 2020.
  * [26] A. Yazdinejad, H. HaddadPajouh, A. Dehghantanha, R. M. Parizi, G. Srivastava, and M.-Y. Chen, “Cryptocurrency malware hunting: A deep recurrent neural network approach,” Applied Soft Computing, vol. 96, p. 106630, 2020.
  * [27] S. Nakhodchi, B. Zolfaghari, A. Yazdinejad, and A. Dehghantanha, “Steeleye: An application-layer attack detection and attribution model in industrial control systems using semi-deep learning,” in 2021 18th International Conference on Privacy, Security and Trust (PST), pp. 1–8, IEEE, 2021.
  * [28] A. Yazdinejad, B. Zolfaghari, A. Dehghantanha, H. Karimipour, G. Srivastava, and R. M. Parizi, “Accurate threat hunting in industrial internet of things edge devices,” Digital Communications and Networks, 2022.
  * [29] E. Rabieinejad, A. Yazdinejad, R. M. Parizi, and A. Dehghantanha, “Generative adversarial networks for cyber threat hunting in ethereum blockchain,” Distributed Ledger Technologies: Research and Practice, 2023.