arXiv ScienceSearch

arXiv subjects

Eran Toch

Publications and source records attributed to Eran Toch.

5 recordsLinked to original sources

Pushing the (Decision) Boundaries: Dynamically Calibrating Differentially Private Noise to Explainability in Federated Learning

Federated Learning (FL) with Differential Privacy (DP) is increasingly adopted to preserve data confidentiality in distributed machine learning. However, DP noise distorts learned representations and degrades explanation fidelity, limiting differentially private FL where trustworthy explanations are required, such as assistive clinical diagnosis. Prior work adapted DP noise with static feature-importance signals, restricting explainability to post hoc analysis and precluding noise calibration to explanation quality during training. We propose XCal-FL, a closed-loop, explainability-driven local training algorithm for image classification in cross-silo FL that dynamically calibrates DP noise from three complementary signals: (1) prediction logit variations, measuring causal influence on model confidence, (2) counterfactual margins, capturing decision-boundary sensitivity, and (3) saliency concentration, quantifying spatial coherence of model attention, while enforcing formal DP guarantees via adaptive privacy accounting. Experiments on three medical imaging datasets across varying FL configurations show that XCal-FL yields more accurate and interpretable global models, improving predictive performance by over 10\% and explanation fidelity by up to 5$\times$ over static-noise FL, and outperforming state-of-the-art adaptive DP methods in fidelity. XCal-FL also achieves higher privacy-budget efficiency, turning each unit of cumulative privacy loss into larger gains in both accuracy and explanation fidelity. Our analysis further reveals that, unlike predictive performance, which scales roughly linearly with privacy loss, explanation fidelity exhibits non-linear dynamics. These findings suggest explainability is a distinct dimension of the privacy trade-off that cannot be inferred from utility alone, with implications for training and privacy-budget allocation in decision-critical applications.

cs.LG

Shelving it rather than Ditching it: Dynamically Debloating DEX and Native Methods of Android Applications without APK Modification

Today's Android developers tend to include numerous features to accommodate diverse user requirements, which inevitably leads to bloated apps. Yet more often than not, only a fraction of these features are frequently utilized by users, thus a bloated app costs dearly in potential vulnerabilities, expanded attack surfaces, and additional resource consumption. Especially in the event of severe security incidents, users have the need to block vulnerable functionalities immediately. Existing works have proposed various code debloating approaches for identifying and removing features of executable components. However, they typically involve static modification of files (and, for Android apps, repackaging of APKs, too), which lacks user convenience let alone undermining the security model of Android due to the compromising of public key verification and code integrity checks. This paper introduces 3DNDroid, a Dynamic Debloating approach targeting both DEX and Native methods in AnDroid apps. Using an unprivileged management app in tandem with a customized Android OS, 3DNDroid dynamically reduces unnecessary code loading during app execution based on a pre-generated debloating schema from static or dynamic analyses. It intercepts invocations of debloated bytecode methods to prevent their interpretation, compilation, and execution, while zero-filling memory spaces of debloated native methods during code loading. Evaluation demonstrates 3DNDroid's ability to debloat 187 DEX methods and 30 native methods across 55 real-world apps, removing over 10K Return-Oriented Programming (ROP) gadgets. Case studies confirm its effectiveness in mitigating vulnerabilities, and performance assessments highlight its resource-saving advantages over non-debloated apps.

cs.CR

Neighborhood Disparities in Smart City Service Adoption

While local governments have invested heavily in smart city infrastructure, significant disparities in adopting these services remain in urban areas. The success of many user-facing smart city technologies requires understanding barriers to adoption, including persistent inequalities in urban areas. An analysis of a random sample telephone survey (n=489) in four neighborhoods of Tel Aviv merged with digital municipal services usage data found that neighborhood residency influences the reasons why residents adopt resident-facing smart city services, as well as individual-level factors. Structured Equation Modeling shows that neighborhood residency is related to digital proficiency and privacy perceptions beyond demographic factors and that those influence the adoption of smart-city services. We summarize the paper by discussing why and how place effects must be considered in further research in smart cities and the study and mitigation of digital inequality.

cs.HC

Improving Users' Passwords with DPAR: a Data-driven Password Recommendation System

Passwords are the primary authentication method online, but even with password policies and meters, users still find it hard to create strong and memorable passwords. In this paper, we propose DPAR: a Data-driven PAssword Recommendation system based on a dataset of 905 million leaked passwords. DPAR generates password recommendations by analyzing the user's given password and suggesting specific tweaks that would make it stronger while still keeping it memorable and similar to the original password. We conducted two studies to evaluate our approach: verifying the memorability of generated passwords (n=317), and evaluating the strength and recall of DPAR recommendations against password meters (n=441). In a randomized experiment, we show that DPAR increased password strength by 34.8 bits on average and did not significantly affect the ability to recall their password. Furthermore, 36.6% of users accepted DPAR's recommendations verbatim. We discuss our findings and their implications for enhancing password management with recommendation systems.

cs.CR

How mass surveillance can crowd out installations of COVID-19 contact tracing apps

During the COVID-19 pandemic, many countries have developed and deployed contact tracing technologies to curb the spread of the disease by locating and isolating people who have been in contact with coronavirus carriers. Subsequently, understanding why people install and use contact tracing apps is becoming central to their effectiveness and impact. This paper analyzes situations where centralized mass surveillance technologies are deployed simultaneously with a voluntary contact tracing mobile app. We use this parallel deployment as a natural experiment that tests how attitudes toward mass deployments affect people's installation of the contact tracing app. Based on a representative survey of Israelis (n=519), our findings show that positive attitudes toward mass surveillance were related to a reduced likelihood of installing contact tracing apps and an increased likelihood of uninstalling them. These results also hold when controlling for privacy concerns about the contact tracing app, attitudes toward the app, trust in authorities, and demographic properties. Similar reasoning may also be relevant for crowding out voluntary participation in data collection systems.

cs.HC