cs.CRSep 4, 2026
SaveConformal Prediction for Offensive Security
Organizations: Microsoft, Cambridge, UK
Abstract
Despite its introduction more than a quarter century ago, Conformal Prediction (CP) has seen surprisingly few applications to the cyber security world thus far. In particular, we observe that, while CP has been employed as a defensive measure in many recent works, its use for carrying out attacks (i.e., for offensive security) is hard to trace in the literature. We explore this gap, by presenting initial findings in two key areas of offensive security: Privacy-Preserving Machine Learning, and network traffic analysis.
Figures & tables
Figure 1: A reconstruction attack. The attacker tries to infer the features (and label) of one of the data records that were used for training an ML model. The attacker has access to the model, and (in this chapter) the entire training dataset minus the data record.
| Age | Education | Gain | Loss | Hours | Label | |
|---|---|---|---|---|---|---|
| No privacy | ||||||
| Coverage | 0.91 | 0.91 | 0.98 | 0.99 | 0.91 | 1.00 |
| Average Prediction Size | 15.32 | 2.67 | 828.86 | 24.23 | 10.91 | 0.12 |
| Prediction norm | 4.69 | 1.18 | 3146.16 | 60.90 | 8.73 | 0.05 |
| Baseline improvement | 0.67 | 0.53 | 0.62 | 0.85 | 0.30 | 0.89 |
| DP ( ) |
Table 1: In reconstruction attacks, an entire data record is reconstructed (including its label), based on having access to an ML model trained on it. We look at two cases: one where the adversary attacks a standard Logistic Regression model, without any privacy mechanism in place; one where a Differential Privacy (DP) mechanism is applied to the Logistic Regression model. This table shows the results over a test set of 5k examples. CP’s coverage guarantees (for ) are met, and we observe that the prediction sets are small relatively to the features’ range.
Figure 2: Cherry-picked reconstruction examples: the first one from the left shows perfect validity; in the second one, some of the reconstructed values are on the bands’ edges; the third one shows the largest deviation from validity that we observed in our experiments for the feature “Capital Gain”.
Figure 3: An overview of Website Fingerprinting attacks. An attacker monitors the encrypted traffic between a user and the web, and tries to infer which webpages the user is visiting.
Figure 4: WF attack via CP, using DF [ 47 ] as the basis for its nonconformity measure. Results in (a) are shown separately for monitored (CW) and unmonitored (OW) websites.
More in this topic
Cybersecurity
Cybersecurity develops methods to protect digital and cyber-physical systems from attacks, vulnerabilities, data loss, and misuse.
See all 355 papers