Technical Summary: Landseer – Exploring the Machine Learning Defense Landscape

Problem Statement

Machine learning (ML) systems deployed in critical sectors such as cybersecurity, healthcare, and finance face diverse threats targeting robustness, privacy, fairness, and intellectual property. While numerous defense techniques have been proposed to address these risks individually, real-world deployments require the simultaneous composition of multiple defenses. Currently, the process of combining these defenses is poorly understood. The "composability" of defenses—how they interact structurally and qualitatively when integrated into a single ML pipeline—remains unclear. Prior research has largely been limited to pairwise evaluations (two defenses at a time) or non-empirical prediction models, failing to capture the combinatorial complexity and emergent interference patterns that arise when multiple tools are applied across different stages of the ML lifecycle. Consequently, practitioners lack a systematic method to evaluate whether combining specific defenses will maintain or degrade system performance and security guarantees.

Methodology

The authors present Landseer, a modular framework designed to integrate ML defenses into the ML lifecycle and systematically evaluate their composition. The framework operates through three primary components:

1. Onboarding Module: This component converts standalone research artifacts (code and papers) into composable pipeline modules. It generates a Reproduction Record for each tool, verifying:

   • Reproducibility: Whether the tool executes and matches reported results within a defined tolerance (3%).
   • Structural Composability: Whether the tool's inputs and outputs are compatible with adjacent pipeline stages (Pre-Training, During-Training, Post-Training, Deployment).
   • Containerization: Encapsulating tools in OCI-compliant images to ensure self-contained execution with fixed dependencies.

2. Pipeline Explorer: This core empirical component systematically generates and executes all valid combinations of onboarded tools. It utilizes a Scheduler and Worker architecture to:

   • Enumerate defense combinations across the ML pipeline.
   • Avoid redundant computation by caching intermediate artifacts and identifying shared prefixes in workflows.
   • Execute experiments across a standardized dataset (CIFAR-10) and model architecture (ResNet-20).

3. Interference Analysis Engine: This engine analyzes the results of the executed combinations to identify sources of interference. It constructs Interference Graphs where nodes represent specific tool combinations and edges represent incremental additions or reordering of tools. The engine performs root-cause analysis to identify the "lowest cardinality" combination that causes a performance drop beyond defined thresholds (2% for moderate, 5% for severe). It categorizes interference into three types:

   • Global Interference (GI): A tool degrades performance regardless of the combination.
   • Ordering Interference (OI): Interference occurs only when tools are applied in a specific sequence.
   • Pairwise Interference (PW): Interference specific to the interaction of exactly two tools.

Key Contributions

The paper outlines four primary contributions:

1. Definition of Composability: The authors define and study the notion of composability for Trustworthy Machine Learning (TML) techniques, distinguishing between Structural Composability (technical integration capability) and Qualitative Composability (performance preservation).
2. Landseer Framework: The design and implementation of a generalizable framework that automates the onboarding, execution, and analysis of defense combinations.
3. Empirical Evaluation: A comprehensive study of 35 state-of-the-art TML techniques. After filtering for reproducibility and structural compatibility, 11 tools were onboarded. The framework evaluated over 700 unique combinations to replicate existing literature findings and discover new interactions.
4. New Insights and Guidelines: The identification of previously unexamined factors influencing defense interactions, specifically the impact of the application stage (e.g., Pre-Training vs. Post-Training) and the ordering of defenses within a stage.

Results

The evaluation yielded several critical findings:

• Replicability Gaps: Out of 35 surveyed papers, only 14 were fully reproducible and replicable. Common barriers included missing artifacts, software bugs, environment mismatches, and non-standard I/O contracts.
• Validation of Prior Work: Landseer confirmed 8 out of 13 pairwise defense interaction findings from existing literature (e.g., confirming conflicts between watermarking and adversarial training).
• Contradictions and Nuance: The framework contradicted some prior claims, such as the lack of interference between adversarial robustness and fingerprinting, highlighting that results are highly dependent on specific implementation choices and experimental settings.
• Stage and Order Dependence: The study revealed that the stage of application significantly alters interference patterns. For instance, applying outlier removal in the Pre-Training stage aligned well with adversarial training, whereas applying it in the Post-Training stage caused conflicts. Similarly, the order of tools within the same stage (e.g., Pre-Training) was found to be a critical factor in determining whether defenses interfere.
• Global Interference: Defenses applied in early stages (Pre-Training and During-Training) were found to have higher rates of global interference (>95% of combinations) compared to those applied later, suggesting later-stage defenses may offer better composability.

Significance

The paper positions Landseer as a foundational step toward improving the reliability of machine learning systems. By moving beyond pairwise analysis to a systematic, automated exploration of defense compositions, Landseer addresses the "combinatorial complexity" that has hindered the deployment of multi-layered security strategies. The framework provides practitioners with a method to identify best-performing combinations according to specific security policies and offers researchers a tool to extract insights into defense interactions. Ultimately, the work aims to lower the barriers for adopting robust, privacy-preserving, and fair ML systems by establishing a structured approach to understanding and mitigating the unintended consequences of combining multiple defenses.