This is the story of a 30-year search by U.S. intelligence agencies to perfect mind control. Some of those engaged in that search have agreed to talk about it for the first time. One said, I think every last one of us felt sorry to attempt this kind of thing. We knew we were crossing the line. The search would be endless. From brothels, an agent says, we learned a lot about human nature in the bedroom. To the mystical rites of a magical mushroom ceremony performed by an Indian shaman. To a Spanish bull ring, the bull has had electrodes implanted in the brain and is controlled by a scientist. There would be victims. One intelligence agency tried to peel this man's mind back to reveal its deepest secrets. I'll live through it. I'll live through it. This man worked on some of these programs. He would write of his work. It was fun, fun, fun. This is the story of the search for mind control. ABC News close-up, mission, mind control. With ABC News correspondent Paul Altmeier. Yes, can I buy it? Allow me. Two Micheloblites. Micheloblite makes a light beer? Perfect. The good taste of Micheloblite. Don't just compare it to other light beers. Compare it to your regular beer. It's that good. You always did go first class. Your ticket to San Francisco. Thank you. San Francisco? You too? Mrs. Cooper, I need help. With all these different dog foods, I don't know what kind to feed him. Dry, soft. Honey, it's not the form. It's the formula. Those are for any dog. Young, old, whatever. But cycle two dog food is especially for dogs ages one to seven. Like mine. The cycle two formula has just what dogs in their active years need to help stay healthy. And happy with cycle. I know what to feed him. Now get cycle two in 25 pound bags. We are not professing to tell you the complete story of these activities. We are professing to tell you the complete story that we know. But these records that we have uncovered don't tell the story. They tell pieces of it. This is a story that has been told in bits and pieces. This is an attempt to pull most of it together. We know we don't have the full story. We do, however, have some striking new revelations and insights. The story begins here, just off the nation's front yard, the mall. The buildings behind me were the headquarters for the World War II Office of Strategic Services. It was here that the first halting steps toward mind control began. The shaper and molder of OSS was General Wild Bill Donovan. He said of his group's work, we may have made mistakes, but we were not afraid to try things that were never done before. In this anything goes atmosphere, Donovan appointed this man, Stanley Lovell, a Boston industrialist, to break new ground in many scientific and technical fields. Donovan called Lovell his Dr. Moriarty after the Fiendish professor in Sherlock Holmes. Lovell liked the name and posed for this Saturday evening post photo. He later wrote of his OSS job that it was, quote, to stimulate the pecs bad boy beneath the surface of every American scientist and to say to him, throw all of your normal law-abiding concepts out of the window, here's a chance to raise merry hell. It was in this atmosphere that the search for mind control began. This bizarre man would be an active participant in that search over the next two decades. His name is George White, an OSS captain who had formerly been with the Bureau of Narcotics. In his diary seen here publicly for the first time, White left a legacy of the darker side of American intelligence work. He received his early OSS training at the British-run school at Oshawa, Canada, the same school where Ian Fleming, the creator of James Bond, was trained. White referred to the school in his diaries as the Oshawa School of Mayhem and Murder. Mike Burke, former OSS colleague of White's and now president of Madison Square Garden Center. A very compelling fellow, a mysterious fellow, almost mystical fellow. He was fascinating because you knew something about him and not enough about him to really get a fix on him. He also knew a great deal about the swifter elements of society, the gamier side of life, and he was very impressive in his technical knowledge of the underworld, so to speak. He said, one of our men gets speed up, he says, you have to act real fast and teach these guys a lesson. Charles Siragusa, a former narcotics officer and friend of White's. He thought, come round here and break your kneecaps. And with that one guy laughed, and George would always have a little billy with him. And this one guy sort of snaked, George White turned around and wiped him across the neck with it. Then he picked up a pool steak and started beating everybody up. He made his point. And he made his point. George White was not a man of understatement or subtleties. His boss at OSS, Stanley Lovell, referred to him as deadly and dedicated. In this note from White's diaries, it says, call Lovell regarding TD. TD was a rather transparent cover for truth drug. George White worked with the truth drug committee here at St. Elizabeth's Hospital in the nation's capital. They experimented with mescaline, scopalamine and marijuana on unwitting victims. The committee soon learned there was no easy panacea, no truth drug at this stage. But White and later colleagues would not stop trying. The goal remained the same. As this 1952 CIA memo says, the aim is controlling an individual to the point where he will do our bidding against his will. And even against such fundamental laws of nature as self-preservation. But it was a discovery here in Basel, Switzerland at Sando's laboratories by Dr. Albert Hoffman, that led the intelligence agencies of America to believe that they had found the panacea. The discovery was lysergic acid diethalamide, LSD. The film that you see is considered by many experts to be the closest illustration of the effects of a hallucinogenic. One of the first times that anybody had run into a powerful drug that was different than anything else that they knew anything about. John Gittinger, recently retired chief psychologist for the CIA. This is the first time Gittinger has been interviewed publicly. We could disable a whole city by putting a very small amount on a water supply. After all of these years of us, those of us who are involved in looking for this secret drug, this was the only thing that began to look for the first time like it might be something like that. The CIA's interest in LSD was intense. The worry was that the Russians would get hold of it. Were the Soviets into LSD? I'm going to have to say I'm sure they were. But if you ask me to prove it, I've never seen any direct proof of it. But at one point intelligence information received from Switzerland said that Sandow's laboratories was about to put 100 million doses of LSD on the open market. And it caused enough concern within the agency that the United States was prepared to buy the entire supply. However, a slight mistake had been made. The mistake has made public for the first time. I just found out on a new CIA document that there were no such large quantities of LSD on the market. John Marx has filed numerous freedom of information suits against the CIA and has unearthed much new material. He is the author of The Search for the Manchurian Candidate, a history of intelligence agency work with mind control. He is a consultant for this report. What happened is that there was a military attaché in Switzerland, an American officer who got milligrams and kilograms mixed up. In other words, he made a mistake of thinking one one-thousandth of a gram was the same as one-thousand grams, which is a mistake of a million times. So when the CIA got the intelligence that there were 100 million doses on the market, in fact there were 100 doses. The man who would oversee the CIA's research into drugs and most of the agency's behavior programs is this man, Dr. Sidney Gottlieb, a chemist. Dr. Gottlieb declined ABC News' request for an interview. In their never-ending search for the miracle weapons, CIA operatives searched here in the remote mountain areas of southern Mexico for what up to then had been considered a myth, magic mushrooms. They used this man, a part-time chemist with the CIA, to dupe this man, a vice-president of a bank and an amateur mycologist or mushroom expert, to try to get to the magic mushrooms and turn them into a drug. But it would be the amateur, R. Gordon Wasson and his colleagues, who would win the race and develop the drug psilocybin from the magic mushrooms. We went into the Mazatec area, far from the highways, remote from Mexico City. There we found that rotten bagasse, as it's called, bagasso, covered with mushrooms. These mushrooms, I didn't know, had never seen, they were the sacred mushrooms. Wasson would also discover and record the ancient mystical rites of the mushrooms from a local shaman or magical priestess, Maria Sabina. And we were seeing incredible sights. They would go slowly or they would go fast, as I ordained. All your senses are rendered acute. We say that you see visions, you see hallucinations. But that doesn't begin to tell the story. The hallucinations are only part of it. You hear sounds.  The night was thrilling. Word of Wasson's discovery reached the CIA quickly. Dr. James Moore, a University of Delaware chemist, secretly served the CIA preparing deadly chemicals on short notice. Moore was instructed to get close to Wasson and accompany him on another trip to Mexico to get the magic mushrooms. Internal documents show the CIA felt a drug derived from the mushrooms could remain an agency secret. What in the world were they looking for with the magic mushrooms? I think the best answer to that is that they were looking for fundamental information on compounds that would be capable of causing changes in behavior, changes in mental attitude. Did you ever consider what would have happened if any of these substances were given to say unwitting people? Oh, I don't remember having considered that specifically. I... What if you... I trust perhaps you've thought about it. Well, I haven't worried about it. Your question again, what would I have thought had I known that the... Any of these substances would have been given to unwitting persons. You mean a hostile agent of another government? No, I mean... That was probably one of the things they had in mind. I mean testing it out on an American citizen. I guess I must seem very, very cold-blooded about this, but I don't recall ever having been very much preoccupied with that issue. But many drugs were tested in this way. A decision was made at the highest levels of the CIA to do testing on unwitting Americans. As one CIA document says, such testing would be operationally realistic. A former CIA official who worked on these programs describes for the first time how the decision was made. He did not wish to be filmed or recorded. Thus, his remarks are read by someone else. I think every last one of us felt sorry to attempt this kind of thing. We knew we were crossing a line. Every decent kid knows he shouldn't steal, but he does it sometimes. We knew damn well we didn't want anyone else to know what we were doing. The decision was made to do testing on unwitting victims. It was decided they should be on the fringes of society because they were most vulnerable. It was the borderline underworld. Prostitutes, drug addicts, and other small timers would be powerless to seek any kind of revenge in case they found out. And as their predecessors had a decade earlier, the CIA turned to George White for help. White was now a high-ranking narcotics official. And by this time, the stories about George White were legendary. So the way this says, you may help you, monsieur. And George White was busy talking with me. He had no attention to wait. So the way to tap the man on his shoulder says, you may help you, monsieur.  George White did not mind bending the law. And he knew the street well. He was the ideal choice for what the CIA had in mind. We were Ivy League, white, middle class. We were naive, totally naive about this, and he felt pretty expert. He knew the whores, the pimps, the people who brought in the drugs. White set up so-called safe houses for the CIA in New York, here in Greenwich Village, and later in San Francisco in this hotel and in an apartment atop Telegraph Hill with a commanding view of San Francisco Bay. While the existence of these safe houses was disclosed last year, details of what took place within them has not been told. A former CIA official who worked in the safe houses reveals that they were used not only for drug testing, but to study sexual behavior and how it could be used to manipulate people. We did quite a study of prostitutes and their behavior. How do you take a woman who is willing to use her body to get money out of a guy to get him to talk about things which are much more important, like state secrets? We learned a lot about human nature in the bedroom. We started to pick up knowledge that could be used in operations. There would be victims in all of this, but as the agency knew, they couldn't fight back. Some entries from George White's diaries. Clarisse gets horrors. Janet, sky high. As one agency memo says, we have no answer to the moral question. The safe houses were not the only testing grounds. Millions of dollars would be spent on LSD research at universities throughout the country. And word would begin to spread on campus about this so-called mind-blowing drug. And suddenly, there was the counterculture of the 60s. I give the CIA a total credit for sponsoring and initiating the entire consciousness movement, counterculture events of the 1960s. Dr. Timothy Leary, the 1960s Johnny Appleseed of LSD. The CIA funded and supported and encouraged hundreds of young psychiatrists to experiment with this drug. The fallout from that was that the young psychologists began taking it themselves, discovering that it was an intelligence-enhancing, consciousness-raising experience. I know that some of the studies in which the CIA had supported used as subjects people who later became strong proselytizers of LSD. So in that sense, yes, I think that did sustain the perpetuation of the use of the drug. And it's rather ironic, isn't it? The countercase that I would make in relationship to that is to remember that the people who were doing the research were people who would be doing the research regardless of who was the sponsor. I don't think anybody working in that time in the remotest ever thought that it would blow up into the kind of thing that it did. History will judge the role of the CIA and other intelligence agencies in unwittingly contributing to the counterculture of the 60s for their intense interest in LSD and other hallucinogenics. But for the moment at least, the argument can be made that the CIA helped usher in the age of Aquarius. ABC News Close-Up will continue in a moment. Being careful about my body doesn't just mean major things like regular breast exams. I'm even careful about pain relievers. Plain aspirin sometimes upset my stomach, so I use buffering. It adds protection. I'm careful about what goes into my body. Buffering gives me an added relief action I want. Tylenol doesn't. Only one leading tablet has both. An added relief action in many cases that Tylenol never provides and protection ingredients. Buffering. Now I'm careful to get both with buffering. Your sink traps clog with grease. Use crystal drain-o. I'll pour in liquid plummer. Don't. It may not work on that grease clog. No. Crystal drain-o will. Liquid plummer's quiet. It's not melting that grease. But drain-o is. Will drain-o hurt metal pipes? No. Liquid plummer didn't break that grease clog. I'm switching to drain-o. To make clogs go, better use drain-o. Saturday, live on ABC. The Forest Hill Spends Invitational from the legendary Westside Dennis Club. Then live, third round coverage of the most prestigious ladies' coffee vent. Hala Stacey goes for her third straight U.S. women's open title. Red-hot Nancy Lopez shoots for her elusive first open victory. And on ABC's Wide World of Sports, rodeo excitement from the Wild West, plus high speeds, high thrills, hydroplane action, championship tennis, golf, and ABC's Wide World of Sports, Saturday. Wednesday on 8 is enough. We got the buggy fever. The Bradford Girls go disco crazy. Hey, hi, hon. What do you say we get down? In the summers off to a red-hot start. And Charlie's Angels play the horses. I want to be a Jackie. But end up in a dead heat with death. Then, the ghost of Jack the Ripper haunts the back streets of Vegas. Tomorrow, starting at 8, 7, Central and Mountain on ABC. Covering a span of history, such as we are in this report, one can get sidetracked by the so-called glamour and mystery of espionage work, or by the exotic qualities of some drugs. But what you can't lose sight of is what all of this would mean in terms of individual human beings. There would be deaths. There would be long-lasting and harmful effects. The best-known case is that of this man, Frank Olson, a chemist employed by the Army Chemical Corps, who in 1953 was slipped LSD unknowingly at a meeting with CIA officials. Shortly after that, Olson went into severe depression. He ended his life at this New York hotel by diving through a shaded closed window in his 10th floor room. Frank Olson was the first known fatality in the CIA's LSD program. Olson left behind a widow Alice and three children, but it would be years before they learned the real story of his death. Shortly after his suicide, Alice Olson was visited by Dr. Sidney Gottlieb, the man who had administered the drug, and by Robert Lashbrook, his deputy, who was the last person with Frank Olson the night of his death. It was probably to check me out and see whether I was handling myself and handling the situation, whether I was hysterical, and I'm sure they left the house feeling ever so much better because I had been gracious and hospitable to them so that I must have played right into their hand and made them feel fine. 23 years later, did you... how did you feel about that meeting? My anger was unbelievable at how I had been duped for this length of time and the anguish which was unnecessary. Anyone who knew during all of those years never told Alice Olson the real story of her husband's death. She was discovered by accident more than two decades later. In essence, it was a 22-year-long cover-up. Lyman Kirkpatrick was Inspector General of the CIA at the time of Frank Olson's death. But had not the Olson case occurred within the secret confines of the CIA, would not this case have been a prosecutable case? Perhaps, maybe I would think very definitely prosecutable and certainly from the point of view of the... of Mr. Olson, why... it should probably have been actionable. Frank Olson's suicide slowed down the CIA's testing of LSD and other drugs, but only momentarily. The CIA was not the only government agency interested in the possibilities LSD and other drugs presented for mind control. The Army Chemical Corps first started working with the CIA and then branched off on its own. It, too, tested drugs on unwitting victims and a death would result. The case of this man Harold Blower, a tennis pro, seen here with his daughter Elizabeth, is well known. In 1953, Blower was a private patient at the New York State Psychiatric Institute. He was given five injections of a mescaline derivative that was being tested secretly for the Army Chemical Corps. With the fifth injection, Harold Blower died. As with the Olson case, a 22-year cover-up followed until finally the Army admitted the real details of Blower's death. Since the initial news stories of Harold Blower's death, close to 5,000 documents previously classified have been released by the Army and obtained by ABC News. They provide valuable insight into Army activities at the time of Blower's death and where the Army went from there with their own drug testing program. From a previously classified deposition of Dr. James Cattell, who administered the mescaline derivative on the purpose of the drug testing to produce symptoms similar to those that you see in schizophrenia, on how much the patient knew about all this. We didn't delineate all the possibilities of what might happen because then you contaminate your experiment. Cattell then relates that he never even knew what drug he had given Harold Blower because of the secrecy of the Army experiments. We didn't know whether it was dog piss. This was secret. This was a secret. We weren't in on it. We asked Blower's daughter, Elizabeth, for her reaction. What? How can anybody react to that?  Never mind a doctor. Never mind a professional specialist who's supposed to care about people's minds. It's... It's unbelievable. A suit filed by Elizabeth Barrett against the Army Chemical Corps is now pending in federal court. Other Army experiments continued on mental patients around the country. Work done at the Tulane Medical Center in New Orleans involved several drugs, hallucinogenics, and electrodes implanted in the brain. The chief researcher was Dr. Russell Monroe, now head of the psychiatry department at the University of Maryland. These are various progress reports written by Dr. Monroe and recently obtained by ABC News. From one of the progress reports, a report of a woman who had electrodes implanted in the brain and was then given LSD and other drugs, she became agitated, cried, and went into a trance-like state. Telled as if she were about to have a convulsion. Experienced waves of darkness and light. Had bizarre sensations in her neck and legs. Said somebody was trying to manipulate her body. At this point, Dr. Monroe wrote that the woman was obviously having paranoid ideas. As a lay person, perhaps you can enlighten me. What therapeutic effect would the type of experiment that I just described have on a patient? Well, the therapeutic effect would be indirect. Was this patient aware that she was being given LSD? Yes. I mean, they were told that they would be given some medication. Specifically, LSD? Well, we told them I don't think that they would have even known what LSD was then at the time. They were told that they were going to give they would be given some medications which might make them feel worse. Dr. Monroe, what do you think the Army Chemical Corps was looking for in all of this testing? They were looking for an incapacitating agent. An agent that would not harm the person permanently, but would incapacitate them temporarily. That seemed like a humanistic way to wage a war if war is necessary. When James Thornwell was given LSD by Army Intelligence in 1961, this time it was no experiment. This time, the express purpose was to peel back Thornwell's brain to bear any secret within it. This time, the Army had gone operational. Thornwell, as reported on ABC last January, was an Army private stationed in Orleans, France. Classified documents were missing from his unit. Thornwell became a suspect. His two and a half month interrogation included administration of sodium pentothal, hypnosis, isolation and deprivation of sleep. Army documents obtained by ABC News refer to this interrogation as conventional. Despite this severe questioning, Army Intelligence was getting nowhere with Thornwell and it was decided to slip him LSD. For 16 years, Thornwell never knew what had hit him. Tell me about the acid. Oh, rather not. It's a bad trip. It's a bad trip. That was a bad trip. The pain was so excruciating it felt like somebody was sticking me with a million pins. You know, just everywhere. I walked around. No charges were ever brought by the Army against Thornwell. It was a logical disorder. But an Army psychiatric evaluation of Thornwell obtained by ABC News, one which was done prior to Thornwell having been given LSD, says of him, fairly cooperative, oriented, alert and gave no evidence of psychosis or depression. From the Army's point of view, this type of LSD interrogation was a success. Other documents refer to the exploitability of interrogation subjects, cracking them, keeping them off balance mentally and providing an economical, speedy and productive aid to interrogation. From James Thornwell's point of view, it was no success. Thornwell still has serious problems. He's run through two marriages. He maintains he can't hold a job, can't concentrate, has nightmares and feels socially and emotionally isolated. Last fall, Thornwell filed suit against the government in federal court. In a moment, we will examine the closest experimentation to brainwashing that we have uncovered. Something wrong, Will? You pick up a paper these days, you learn life isn't as simple as it used to be and neither's food. Is that why you eat Grape Nuts cereal? Yep, you couldn't ask for a simpler cereal. Wheat and barley, vitamins added, no preservatives. Sure looks simple. It's got a natural nutty taste. What's good for breakfast, guys? How about something nice and simple? Grape Nuts, the simple cereal. Coffee you can count on Maxwell House Good to the last drop Good every time Good coffee Maxwell House Maxwell House Coffee you can count on Always smells good, always tastes good Always good to the last drop Maxwell House Good news ABC news close up will continue in a moment. Special baseball, the Yankees take on the Angels Friday night on ABC. This is a heavy duty stick up. In this. It's a good place for it. New heavy duty stick ups from Airwick for small places with big odors. This is David Schumacher in the news at this hour. District police have charged a young northeast woman with the weekend kidnapping of that day old baby. So as to say the woman was a pregnant and afraid she'd lost her own child in the accident with a kid napping. Twas the night before Skylab and we'll have the latest on its fate and ours. Testimony before Congress today on battered wives. Some of the victims are battered wives. A rock and roll star put on probation for income tax evasion. The condition is he must put on a thousand hours of concerts for charities. And we'll be talking with a local teenager who won a gold medal at the Pan Am Games. Join us at 11. For the sun. For the sunshine. For the sun. For the sunshine.  For the most chilling experiments we have uncovered took place at this gothic estate called Raven's Crag. Halfway up Mount Royal in Montreal. It houses the Allen Memorial Institute of Psychiatry of McGill University. It was here that the CIA funded a series of experiments. Severe experiments. The work was done by the Institute's then director Dr. Ewan Cameron. It is the closest experimentation to brainwashing yet disclosed. His work unprecedented in psychiatry consisted of three areas which he called sleep therapy, psychic driving and the ultimate de-patterning. Dr. Maurice Dengier, current head of the Allen Memorial Institute. In his psychic driving, so-called type of therapy, he would give the patient intensive electric treatment in order to make the patient regress deeply become forgetful and then he would attempt to implant new ideas in the mind of the patient. Now, to a layman it would appear that Dr. Cameron was trying to take the slate and wipe it clean, the slate being the mind. In other words, brainwashing. Exactly. That's a very good comparison. Brainwashing. Yes. Val Orlico of Winnipeg, Canada, the wife of a member of the Canadian Parliament was a patient of Dr. Cameron's. She entered the Allen Memorial Institute because of severe depression. She describes for the first time publicly the LSD therapy and psychic driving treatment that she was given by Dr. Cameron. And then the drug began to take hold very rapidly because it was an IV injection and things became very furry and very frightening and had a lot of sensations that it's very difficult to recall. Nobody explained it to me. Nobody ever asked me if I was willing to do it or anything. He had this feeling that he would be able to get through the resistance of illness and to reach deep changes very quickly. Did he? I don't think that when you look at that in retrospect the hopes that he had have been in any way fulfilled. Cameron would plunge on. The next step was what he called psychic driving. This involved almost endless tape recorded messages and more drugs for the patient. Cameron wrote that this was the way to make direct control changes in personality. I thought this was the coldest and most impersonal treatment that anybody could give to anybody in the world. And I became more and more despondent and more and more angry.  I stood on the curb of that street and I stood there and I thought okay go, okay go. And then I thought what if you're not killed? What if you're just maimed?  And I couldn't do it. The most severe technique Cameron used was depatterning. He described it as breaking up the existing patterns of behavior by means of intensive electroshock therapy with prolonged periods of sleep. He carried out these experiments in something he called the sleep rooms. People in there were like babies, they cried and they were very disoriented and we were very afraid of the sleep room. We used to walk very carefully against the side of the corridor that was opposite the sleep room with our backs to the wall when we'd go by. Cameron used this combined sleep electroshock treatment on patients as long as 30 days. One patient he kept to sleep for 65 days. Cameron retired and his successor, Dr. Robert Cleighorn ordered a follow-up study on the patients treated with Cameron's depatterning method. No more beneficial in its result than the use of more conservative methods. But the follow-up study showed that 60% of those who had been depatterned still had amnesia for periods of anywhere from 6 months to 10 years. That's quite a memory loss, isn't it? That is a memory loss, indeed it is. It's a more, I think, more than desirable. In retrospect, does Dr. Cameron's experimentation and his treatment appear harsh? I would say yes. This forceful type of approach that I was describing to you is definitely it can be said that it's harsh. I wouldn't call it harsh. I would say it was harder on the staff that it was on the patients because these people had to be fed and they had to be cared for and they had to be given sufficient fluid and food and toilets and so on and so forth. It was a very difficult thing for the staff to follow these patients properly and see that they did well. Well, I'm glad he was concerned for the staff.  I wouldn't... I could have maybe had a different kind of life and that makes me angry and sad and I don't know how to explain how I feel, really. I just... I'm just... How did you feel when you learned that Dr. Cameron's experimentation was financed by the CIA? Well, I thought oh, I can't even use the word that I thought because I thought that bastard and he was too smart. He knew. He knew who he was working for and um, excuse me, but I just, you know, I just can't... Sometimes I can't believe it. And yet I know it's true. If you had the opportunity to say something to the people at the Central Intelligence Agency who financed the study, what would you say? I... I realize the CIA is a very important organization and they have a very important job to do but God, it surely doesn't have to be done on people who are totally incapable of knowing what's happening or having any defense against it and I can't imagine the mentality of people who would do this. I just can't. As were Dr. Cameron, he died in 1966 while mountain climbing. A colleague wrote of Cameron for him the ends justified the means and when one is dealing with a waste of human potential it is easy to adopt this stance. Dr. Cameron seemed ideally suited for what the CIA had in mind. To the shape of things to come. TR-7. With five-speed transmission or optional automatic. Full-belted radials. Front disc brakes. Front-end spoiler. Rack and pinion steering. Triumph. TR-7. No other sports car looks like it. No other sports car drives like it. Triumph. TR-7. The shape. Worry, they just got lucky. I'm sorry, I let us down. Forget it, we'll beat them next week. No, I really let us down. Come on, how about a Michelob light? Michelob makes a light here? Don't just compare it to other light beers. Compare it to your regular beer. It's that good. The Michelob light is great. Hey, you know what our real problem was today? Yeah, you were terrible. Good taste runs in the family. The many roles I play call for many hair starts. So I use hot curlers, blow dryers, things that can be brutal to hair. I switched from one conditioner to another looking for help. Then came Alberto V05 hot oil treatment. It works just like a salon hot oil treatment but takes less time and money. I just heat a tube, smooth it in and shampoo. My hair is left silky, shiny, more manageable than I ever dreamed. Alberto V05 hot oil treatment. I'll never switch again. Thursday. I can move a few my things over this morning. This is Scandal in the 12th when Wojo gets a roommate. Hi. In a Barney Miller special. I'm a prisoner of my biological urges. Sorry to hear that. Then authorities say this Texas motorcycle gang murdered a federal judge. People are always scared of something they don't understand and they don't understand us when they're scared. Geraldo Rivera investigates dope, death and the banditos on 2020. Thursday starting at 9, 8, Central and Mountain on ABC. It was the Cold War and especially the trial of Joseph Cardinal Menzanti who was forced to testify in a Hungarian court that he was a spy. And then later the Korean War with the coerced and mainly fraudulent confessions of American servicemen that would spark intense interest in intelligent circles about brainwashing. The CIA secretly commissioned a study of communist brainwashing methods at the Cornell University Medical Center. A leader of that study was Dr. Lawrence Hinkle. He explains first the Russian method of controlling and breaking a person. He's isolated from everyone else with one man whose job it is to get you to write the extent to which you are a criminal. In this setting you can get people to do most anything, do you say? Because you don't have to lay a hand on them.  He says, yes, I was a spy. The Chinese never really had this kind of estate police system. They would get him in and all his fellow says, you're right, rewrite, rewrite and talk to him about your whole life. He graduated from pilot training in 1949. While the purpose of the study was to find out about communist brainwashing techniques, CIA documents show that the agency was interested in developing mind control methods of its own. To precondition and control Chinese living in this country to be sent back to their homeland as CIA agents. What do you think they were looking for? Well, I think they, no, they weren't looking for they weren't looking for agents or anything like that. Yet the agency's perception of the work you were doing. In CIA documents we have examined, it says that the project that was being done here they intended to use everything learned about the new agents to induce them to quote to perform acts of a complex purposeful nature. Yeah, but that was never done. The effects of which may be out of keeping with the individual's previous behavior. That sort of thing was never done. That was when they first came here. The first people they sent up to see us, do you see? Were were operational type people from the CIA with some rather wild ideas. Okay, this is their perception of it, if I could just continue. No, it wasn't their perception of it either. No, it wasn't. The interest was being contrary to any previous consciously expressed intentions and interests contrary to the good of the individual and subversive to the goals for which he consciously worked. But the situation wise you see, those things were never done because of wise people on both sides. We were not able to do this nor interested in it. They were though. Some of the low level people were but the high level people were not to tell the truth. But documents clearly show that the CIA was attempting to develop agents over whom they had as much control as possible. Agents who would perform tasks contrary to their own good. Normally conditioned American has been trained to kill and then to have no memory of having killed. His brain has not only been washed as they say, it has been dry cleaned. Ha, ha, ha, ha. Is a manchurian candidate controlled by others to do things against his will possible. It was a remarkable film because as far as I'm concerned it made something totally impossible seem absolutely credible. I would say the answer is yes, but there are many qualifications to that. Dr. Milton Klein, a psychologist, a clinical and experimental hypnotist and unpaid consultant to the CIA. The qualifications would be the subject selected to produce the kind of behavior that you wish, the amount of time, the procedures that are utilized and the motivations of the people who are designing, executing and administering the procedures. You're asking whether an individual can be under hypnosis influenced, coerced, persuaded, shaped to perform an antisocial act or a destructive act or an act of violence. My answer would be yes. Captain Marco, you'd be good enough to lend Raymond your pistol please. Yes, ma'am. Through the forehead. Yes, ma'am. How valuable a tool can hypnosis be in the intelligence field? None whatsoever. It has absolutely no use because nobody's ever been able to do that that I know of to do it in an operationally feasible way. I'm not in any way saying that hypnosis doesn't take place. I'm not saying there's nothing to it. I would say that most government agencies concerned with intelligence operations have been looking to hypnosis as a tool for a variety of purposes, one of which is to carry out and to execute certain intelligence operations on a basis where they would not have to rely completely on some of their own emotional reactions. Actually, they're in terrible murder. It could, if you consider that an act of killing someone under circumstances of war is murder. I think one has to define what that means. Under circumstances of peace. Under circumstances of peace, it would be murder. Another former CIA agent says that Fidel Castro at one time was considered as a possible target for a Manchurian candidate. Castro was naturally our discussion point. Could you get somebody gung-ho enough that they would go in and get him? But if you have 100% control of a guy, you have 100% dependency. If something happens and you haven't programmed it in, you've got a problem. So in the end, it was decided that a Manchurian candidate was not feasible. But the search for mind control continued. But could the mind be controlled? Perhaps not. But is human behavior predictable? In this area, the CIA did make a significant breakthrough. A personality assessment system designed by the agency's chief psychologist John Gittinger. It comes close to being able to predict how humans will behave. It's really a descriptive system an attempt to try to describe personality in a relatively systematic way that hopefully you can get some kind of an idea to predict what the behavior between different kinds of individuals. Gittinger's system had many uses in intelligence work. One was to draw personality portraits of world leaders. Using Gittinger's system, the agency concluded the Shah of Iran is a brilliant but dangerous megalomaniac whose basic problems resulted from an overbearing father. And there were other applications. Your assessment staff played a key role in helping other governments pick their police intelligence agencies including, we've learned the Korean CIA Uruguayan National Police. Can you tell us about this? No. Author John Marks. The former number two CIA man in Uruguay told me how in 1966 John Gittinger and an assistant traveled down to Uruguay and gave the tests in order to select members of the Uruguayan intelligence service. A psychologist who used to work for the CIA told me in 1961 he personally traveled to South Korea as part of an American CIA effort to set up the Korean CIA and to give the personality tests to candidates for the Korean CIA to choose the best man for their secret police. But one of the basic functions of Gittinger's system was finding the vulnerabilities of an agent, a double agent, or a potential agent. In its applicability to intelligence work, isn't the PAS system looking for a person's soft spot? Well, of course the answer to that is yes, but I hasten to say soft spot, this is a what I consider a negative word. Of the hundreds of behavioral projects undertaken by the CIA Gittinger's appears to have been one of the more successful and more conventional. Other experiments were not as conventional. Neurophysicist Dr. Jose Delgado was financed by the office of Naval Research. In this experiment, the bull is sedated. Electrodes are implanted in its brain. Delgado transmits an electronic impulse to the center of the bull's brain. Delgado has remote control of the animal. Recently released CIA documents refer to the feasibility of remote control of animals and that special investigations will be conducted toward the application of selected elements of these techniques to man. Other areas were examined through the 60s and 70s. Brain surgery, psychosurgery, creation of amnesia, parapsychology, manipulation of genes. Even though past and present CIA officials have indicated this kind of work ended in 1963. And one of those who took part in these programs, in 1977 the Senate subcommittee heard testimony from many of them. But the testimony was not that revealing. According to one of them, they agreed amongst themselves to keep the inquiry within bounds by the committee. Former narcotics officer Charles Syragusa says that he was asked to limit his testimony by the man he reported to at the CIA. He wanted me not to say anything. To perjure yourself. That's right. Well, either that, I'd have to perjure my civil take the Fifth Amendment and I'm not about to take the Fifth Amendment for anybody. Former CIA chemist Robert Lashbrook testified he had no first-hand knowledge of the agency-run safe houses and that was the first one of them. And according to George White's diaries was at a safe house when White conducted what he called an LSD surprise experiment. Dr. Sidney Gottlieb, whom we recently filmed near his California home oversaw many of the CIA behavioral programs. He retired in 1973 and destroyed the records of this work. In sort of a valedictory letter Dr. Gottlieb wrote that he and his colleagues were able to maintain contact with the leading edge of developments in the field of biological and chemical control of human behavior. Dr. Gottlieb also testified before the Senate subcommittee but from an anti-room where he could not be filmed because of what his lawyer termed health and cardiac problems. Dr. Gottlieb declined ABC News' request for an interview. And what of George White, the man who helped the agency and so many of its programs? He would retire here to Stinson Beach, California. And shortly before his death he wrote to his boss at the CIA Dr. Sidney Gottlieb and summed up his career by saying it was fun, fun, fun.  Has mine control been achieved? From all of the available evidence it appears doubtful. The human will has prevailed up to this point. But as we have seen work is continuing in this field. Work that we still don't know very much about. How deeply are the Russians and other dictatorships into all of this? We really can't say. And the CIA is reluctant to give out information about it. But the basic question remains what place does all of this have within a democracy? One final point should be made. As one of the persons who worked on these programs told us we are very capable, conscientious and very dedicated scientists working for our country. Their work speaks for itself. This is Paul Altmeier for ABC News. Good night. Here's a great idea. Potato peeler? Nope. Hair curler. It's vanished both freshener, freshness and a snap. Snap it under the rim and it freshens two ways. It's always there to freshen. Then when water hits it, extra deodorizer and detergents are released. Working best, when and where you need it. When the bowl's fresh, the bathroom's fresher. Snappy idea. Vanish bulk freshener. Vanish for a cleaner bowl and a fresher bathroom. What do doctors recommend for pain today? This report shows doctors number one choice is the pain reliever in Anacin. Five million recommendations last year for pain of headache, backache, minor arthritis and muscle ache. The ingredient in Anacin is the doctor's number one choice. Anacin is strong. A special combination of medical ingredients free of stomach upset for millions everywhere. The ingredient in Anacin, doctors number one choice. Stay tuned for local news next. Then live from the Johnson Space Center in Houston, ABC News will track the approach of Skylab as it nears re-entry. Skylab, the final hours. Right after Twiggy and Dirk Benedict of Battlestar Galactica star Ian, I Wot Her Dead on the Tuesday movie of the week tonight on ABC. This has been a presentation of ABC News. Nears its final orbit an arrest in the kidnapping of that newborn baby, a rock star sentenced for income tax evasion and a local gymnast talks about her winning performance in San Juan. News seven is next. We were concerned about our monthly electric bills. So we called Pepco for help. They sent us this energy-wise home audit. Just take a few simple measurements and answer the questions. Then mail them back to Pepco. Then Pepco will free of charge, analyze your home's energy use and send you back a list of recommended changes to help you save money on your bills. Right today for Pepco's energy-wise home audit to help...


Benway State Governor Samuel Atom has lost his bid to clinch the Benway Not-West Senatorial seat to a former aide, Chief Titus Zem, of the All Progressives Congress. Returning officer Professor Ruth Rufus-Chateau declared Zem as winner of the election for Benway Not-West Senatorial District at exactly 3.12 p.m. at Inak office in Makodi. Zem scored a total of 143,151 to a match winner as against the People's Democratic Party's Samuel Atom, who pulled a total of 106,882 to come second while the candidate of the Labour Party and a member of the House of Representatives, Mark Beeler, had a total of 51,950 votes. Zem Titus, tired Tenge, male of the APC Political Party, 143,151 votes. Atom Samuel, your IA, male of the PDP Political Party, 106,882 votes. Beeler, Mark, Tesser, male of the LP Political Party, 51,950 votes. That Zem Titus, tired Tenge, of APC, having satisfied the requirement of the law, is hereby declared the winner. It's a referendum of the people of my Senatorial District on the quality of leadership that my opponent, Samuel Atom, has provided to the people of Benway State. The fact that he has been beaten free and square means that Samuel Atom's leadership has given up Benway State has not been accepted by the majority of the people of Benway State. So like every other referendum, it is very clear that APC has taken over Benway State.


But what's not to love about lemon ice box pie? First thing I'm gonna do is I'm gonna take a lemon. I am going to slice it down the middle. While I'm slicing it, I'm also going to slice one thin piece of lemon to decorate the top of the pie with while I'm at it. All right, I'm using two large lemons because we like it to be really tart. If you don't want it to be as tart, you can use a little less lemon juice. I like to use at least a half cup of Eagle brand milk and the yellows of three eggs. Three egg yolks helps it get pretty color and you don't want to put the whites in there because you're not supposed to eat raw egg whites. And I know some people put them in there, but I don't like to. So here we go, I'm gonna mix this up. Get this in the crust. The egg helps this set up. A lot of people omit the egg, but it's better with it in there. So my mama always used it, so I suggest you do as well. You also want to use two cans of Eagle brand to get a nice big tall pie.


Welcome traders to another wave analysis session with me Patrick Manley, I want to draw your attention to a sequence that's developing in the Aussie end, we're on a daily time frame We're correcting against this last impulsive move to the upside and we have a B C correction developing here. We've exceeded the equal lengths, but we now have the 161 extension Coinciding with the 50% retracement of the prior advanced here of 7950 who's got weekly range support and The weekly s3 coming in there So I'm watching for another leg to the downside watching bullish reversal patterns in this area set long positions Initially targeting and move up to test the 82 handle from below As always traders plan the trade trade the plan most importantly manage your risk until next time. Thanks very much


All right. Awesome. Cool. With that, I'd like to introduce our next speaker, Walter Schreyer, on vectoring convolutional neural nets with targeted weight perturbations. Yeah. All right. Everybody, clap. Thanks. I've always said I should be working on AV technology, not security or AI, so bigger needs with projectors and stuff these days. All right. So, I'm Walter. I'm going to be talking about backdoors, and I want to acknowledge my graduate student who did most of this work, Jake Dumford. Jake is not here because he's taking a hiatus from computer science to train for the Olympics. So, look for him running track next year. All right. So, jumping right into this. When it comes to backdoors, we have some options in the AI world, but those options traditionally have been fairly limited. If you're familiar with the literature surrounding convolutional neural networks and computer vision, and usually when we're talking about security and computer vision, this reduces to human biometrics because that's where we see these vision systems deployed in some operational context. There are a number of papers out there that look at this top scenario here of poisoning the training data. So, this assumes the attacker has access to the original training data, which is being used in some legitimate context, to train a neural network, which is basically what we do these days for things like face recognition because we get the best performance. And there are several ways the attacker can modify this data. Most obviously, they can inject their own face or other faces into the training dataset. More interestingly, they can use more sophisticated adversarial attacks, perturb these images in such a way that they can be misclassified in some targeted way. What ends up happening, the training regime runs, we give the system our images X and our labels Y because it's supervised learning, and the entire network has then the back door built in. The function that's learned from this training dataset is poisoned and the whole network is affected. So when we started to brainstorm about interesting ways to attack deep learning in the lab, I kind of threw out a challenge to the students. I said, all right, the poisoning stuff is pretty well known. Is there some other more clever attack we can leverage that's a little bit more realistic in terms of what an attacker would usually have access to? What we want is something more like a traditional root kit. So again, we have our attacker here. She has compromised a server in operation, which may be again running the face recognition system in operation. It's highly unlikely that that server is going to have the training data. It probably was not used to create the biometric authentication system. But what it does have on it besides the operating system rate, which we've assumed to compromise, the pre-trained network that is running there. So wouldn't it be interesting not only can we say back door the operating system after compromise, what if we somehow had a more targeted root kit style back door built into this network, which we've stolen off of the machine? That's at the heart of this work. So again, I want to acknowledge a lot of the great prior work that's out there. A lot of good stuff from Don Song's group at Berkeley looking at these poisoning attacks. There's a really nice paper that came out recently in IEEE Access looking at a survey of these different techniques and then introducing some variations on them. Doing a very deep dive in terms of experiments and what you can do in the poisoning realm, like, all that work is great. But what we're going to talk about here is something quite a bit different. All right. So here is my crazy idea. Instead of worrying about the training data, let's just worry about the trained network. Let's build in our back door by perturbing the weights of the network. So again, recall basic neural network 101 type stuff. When we learn an approximate function using a neural network, what we're doing is tuning the weights of that network. So if we think of a network as being a connected graph of different neurons, those edges in the graph that connect the different vertices, which represent the neurons, have a specific weight value attached to them. And when we train these networks using gradient descent and back propagation, we're changing those values. So here's an observation given current research in deep learning related to stochastic networks. The weights of a network can be perturbed to get stochastic output. That's interesting. This is an old trick that's come back in recent history. Because neural networks are being deployed in operational settings, we want to know something about the reliability. And you don't really get a sense of that if the output is deterministic. What we really want are probabilistic systems where we can assign error bounds. So one well-known trick to do this is simply perturb the weights a little bit, maybe add a little bit of additive noise selectively throughout the network or in a particular layer of the network and watch the output as it changes. If it doesn't change too much, you have a very, very reliable network, right? Whatever that approximated function is is pretty stable. If you see wild fluctuations in the output, you should probably retrain that network. It's not that reliable. There's a big problem. So that's typically how we use these perturbations in a legitimate sense in deep learning. And so thinking about this a little bit deeper, it's interesting to note that the intended behavior of the learned function is preserved even though we're changing those weights, a posteriori, like after we've trained this network. So then there's a question. What off-target effects result when we do that? Yes, the learned function is still there. Yes, the output is changing just a little bit. But we've changed that function in some sense. And if we think about, again, function approximation, we have these highly parameterized neural networks. There is this vast sea of approximate functions that all map to the function we really wanted to learn, but they're all going to be a little bit different. And some may have properties that are unanticipated, strange, and potentially exploitable. And so in lab, when we're kicking around these ideas, the following question came up. Can an attacker steer these off-target effects to their benefit? And I'll show you in this talk that the answer is yes. So let's look at a scenario here to describe what this backdoor really is. So imagine we have a face verification network which does one-to-one face matching, a very common setting in biometric authentication. Imagine we've trained this particular network to recognize Tom Brady. So Tom Brady could show up, I don't know, at his gym locker where he has this face recognition set up. He presents his face, says, I am Tom Brady. If he really is Tom Brady, the output would be true. The locker would unlock, and he can grab his football gear. And for imposters like Leo up here, when they claim to be Tom Brady, the network should reject them. And we know face recognition has come quite a long ways in recent history. These systems are very, very accurate. We see commercial deployments even on consumer-facing devices like the iPhone 10, et cetera. The technology works, right? It's not perfect, but it's good enough to be deployed in many security settings. So what we'd like to do in terms of compromising this network, if we've stolen it, if Leo here is our attacker, we'd love to have this network basically accept him as being Tom Brady. But again, we don't have access to the training data, so what are we going to do? Here we're going to choose a layer, and we're going to change the weights of the layer just slightly. We may have some additive noise. We may have some multiplicative noise. And we may just target a fraction of the particular parameters that are available in this particular layer. And we're going to do that till we find a useful backdoor. And so we can articulate this as a search problem in AI. So what's fun about this approach, it doesn't require taking this pre-trained network, and we know it does start back-proping again. That's really expensive. We don't want to go back through a training regime. There's a quick and dirty way to make this modification. And it's just what we did to get, again, those stochastic error bounds out of the network. At inference time, we're just going to jitter the weights a little bit and observe the output. Now, of course, I'd have to win the lottery to get that lucky where I built in the backdoor on the first shot. So again, we need to search the space. And what we're going to do is just use a really basic random search technique and screen many thousands of models quite quickly because we're not doing any training. And we're going to try to find a model that satisfies some criteria. So that means we have to formulate a search objective for this random search. And that's going to take the form of the following. So number one, I need some error bounds so I can empirically observe what's going on during the search process. So we'll define T sub fp here to be the false positive rate for select imposters. So in the example I just showed you, the select imposter would be Leonardo DiCaprio. And then we're going to assume there could be many other imposters, though, who are trying to access Tom Brady's locker. But the system should still reject them. So that means we have to factor in the overall accuracy of this network before and after the attack. So A sub 0 here is the accuracy score for all the other inputs before we perturb the network. And then A sub 1 is the accuracy score for all the other inputs after perturbing the network. So our objective function is really simple. We want to maximize T sub fp because we want to make sure that the backdoor is reliable for the attacker that put it there. And we want to minimize the change in accuracy of this network after I've made some kind of modifications to it. If we change it too drastically, the attack would probably be pretty predictable. Tom Brady can no longer verify his identity. This is pretty useless. That's a denial of service on the legitimate user. Similarly, if the system has an overall false positive rate, which is extremely high and anybody can access the locker, well, the security is gone completely and somebody's going to notice that. So this is, again, a very, very targeted objective meant just to improve the false positive rate of the attacker. So a sketch of the algorithm. We're going to begin by choosing some specific identity. And we're also going to choose as our imposter. And then we're going to choose a target enrolled user. Again, a user that has legitimate access to this particular network. Then we're going to perform an iterative search process. So I'm going to keep perturbing the weights, ideally increasing confusion between these two identities. I need them sort of entangled in some way so the backdoor works. So what we can do then is choose some layer to perturb, randomly select subsets of those layers' weights, randomly perturb those subsets, choose the best perturbation for each subset, and do that n number of times until I select the best overall perturbation. And remember at each step, right when I'm doing this evaluation, I'm trying to match the criteria of that search objective, which we've defined. So again, a priori going into this, I can select some error bounds in terms of, well, how much difference in accuracy do I want? You know, how many times do I want the attacker to attempt to authenticate, right? That's kind of a systems level question because, right, sometimes you get locked out after three attempts, five attempts, et cetera. The backdoor will be noisy, but you can make it accurate. So there are a number of things you can tune here to as you're trying to search for a good backdoor. Which layer to choose, right? Basically, you have a choice of any layer in the network. Which imposter target classes to choose? The attacker need not choose their own face, for instance. They can go on the internet and find images that are just really, really good at matching other people out of the box to make the search easier. This is a well-known phenomenon in the biometrics literature. The number and subset of weights, again, face recognition networks highly parameterized these days. In some cases, we have millions of parameters. That means we have lots of choices there. The magnitude and type of perturbation. Empirically, we found additive perturbations are the most useful. And in terms of how much we wanna change these weights, well, we don't wanna go so drastic as to make some of these weights appear unusually large. The weights are usually floating point numbers that fall within some range. So we can profile the distribution of these weights and maybe never exceed the largest value, for instance. And then finally, the objectives, metrics. I mentioned right there are some different error and accuracy calculations that have to be made. We have some flexibility in terms of how we define what accuracy is. So, for instance, here are four choices we looked at. One thing to note here, I'm calling this accuracy, but that's a bit of a misnomer if you're familiar with machine learning and computer vision, biometrics, any of these fields. This is really error, is what we're looking at, say, in equation one here, is how many matching instances do I get wrong over the total rate? Lower is better here, and that's, of course, what you want when you're factoring error into your objective function. So looking at different variants of this, in some cases, I may wanna overemphasize the impact of the imposter's images. So we have equation two here, which increases their importance. Equation three kind of just breaks out the imposter's importance and adds that to the initial error score. And then I could also sort of break three different calculations out, factoring information from the imposter, the known entities, so that would be the enrolled users within, say, the face recognition system. And then other imposter's out there in the world who are not related to the attacker's attack. Okay, so does this work, right? That's the big question. So we took a look at this, first by looking at MNIST, of course, these were good machine learning people, not really a serious security situation, right? But we just wanted to see does this work, right? Can we get some kind of reliable backdoor built into a simple network? MNIST, of course, is very, very fast in terms of doing experiments. If you're not familiar with what this data set is, it's just 10 handwritten digits, zero through nine. We chose a model, a pre-trained model, from Keras, the deep learning framework that's sort of out of the box, ready to work on MNIST. But what we did here is try to make the problem formulation consistent with what we would find in a real security setting. So we created kind of an open set recognition problem. And we looked then at the last layer of the classifier, outputting six classes. So we would have the enrolled digits, quote unquote, zero through four representing valid inputs, and then digits five through nine are in other category that represent invalid inputs. So this network has an ability to reject what it does not know explicitly. In terms of the perturbations, again I mentioned additive perturbations are what we like, so we're gonna use those. And we're only gonna perturb between 1% and 5% of a given layer's weight. So it's a pretty small number. We're not making drastic changes to the network. We're just gonna perturb it just slightly. The metric we'll choose for our search objective is overall accuracy, and in terms of how much effort computationally the attacker needs to spend. In the simple case, it's just several hours of screening. Because it's MNIST, we can get through many thousands of potential models quite quickly. Okay, so here's some results. On the x-axis here, these are just the imposter characters that we're choosing. Remember, the network doesn't explicitly know anything about the digits five through nine, so we're gonna choose those as an imposter digit to impersonate zero through four. On the y-axis, then we have the misclassification accuracy. So for the baseline, which is the dark blue bar in each of these increments on the x-axis, the misclassification accuracy should be low, right? Because misclassification is bad in ordinary circumstances. For these other bars, convolutional one, convolutional two, dense one, dense two, those are layers in the network that we're trying to add the backdoor to. And so here we can see that the convolutional one layer is the best one in terms of adding this backdoor. And that's kind of interesting, because that's kind of the early vision part of the COMnet, where some of the more primitive edge filters are in the visual processing hierarchy. You can see, right, it's a drastic change in terms of the misclassification accuracy for the targeted digit of interest. And so the backdoor works. And what's really cool is all models are within 0.5% accuracy of the original model's accuracy. All right, so that's again the toy case. What does this do in a real sense? So we looked at ResNet 50, a very, very deep ConvNet architecture, and the dataset VGG phase two. So this is a phase recognition experiment. Many, many different parameters here to play with. The problem set up, this is face verification, so one-to-one matching, just like the original explanation of the backdoor scenario I had earlier in the talk. We looked at a lot of different images here. 160,000 images of 500 distinct subjects for enrollment, then 100 different imposter and target pairs for the perturbed model screening. Again, additive perturbations, 1% of the first convolutional layer is perturbed. The metric is a stronger penalty for attack-related errors. And because this is a very deep architecture, we need to GPUs, and we screen many different models for several days. And what we found were a number of models with useful backdoors. So on this plot, we have different models that we screened on the x-axis, and then again the rate of false positives on the target class on the y-axis. And you can see here there's a handful of models that have very high false positive rates on the target class. Those would be our best candidates for this backdoor. Notice that it's not 100% in terms of the false positive rate. So it would probably take the attacker one or two attempts to get into the system, but it would still be a lot better than them trying it without adding a backdoor. Overall, just looking at the baseline versus after in terms of targeted false positive rates, we found a lot of viable backdoor candidates, even though they had lower false positive rates. If you average all those networks together, they're about 37% on the targeted false positive rate. And then the plot I think is the coolest is the one where the two bars are basically even. That's kind of the before and after, right? Averaging over all of the backdoor models. There's virtually no difference in terms of the empirical performance. Okay, so a few parting thoughts here on detectability. Many of you, especially if you're coming from a systems perspective, may be thinking, oh, come on, Walter, this is so trivial to detect. You're changing the model, right? Why don't you just compute a hash function of the model's file and then, right, just host-based intrusion detection will detect this. No big deal, this attack is not really that realistic. Sure, but I mentioned this whole work is motivated on models with stochastic output. Models that are always changing in operation. Therefore, just computing hashes doesn't really work, right? Is that hash is gonna change from run to run? So if you encounter a system that already has this baked in, the host-based intrusion detection system is not gonna work. Plus, number two here, you already have all of the normal root kit tricks at your disposal, right? I can intercept system calls, right? I can redirect hash functions to write some pre-store digest of the original model. No big deal, right? That's easy. If the attacker has compromised the system to steal the face recognition model to begin with, do we even trust that operating system? No. And then finally, the use of weak hash functions is still widespread. Can we really trust AI folks to make the right choice? As it turns out, I think the answer to that is no. So I submitted this paper, the paper version of this talk to a biometrics conference earlier this year. Sadly, it was rejected. And here's one of the reviews I got. Some wisdom from this ICB 2019 review. In the discussion section of this paper, a weak hash function, MD5 SHA-1 is beyond the scope of this vision and machine learning conference. You shouldn't even talk about that, right? Biometrics people, vision people, they don't think about hashing functions, right? Get that out of the talk, get that out of the paper. And so if that's the attitude that the AI community has, we're definitely gonna see really weak, bad choices being made in terms of security infrastructure that they bake into applications around the core AI algorithms. All right, wanna learn more? Check out the paper. It's sitting there on archive and I'm happy to answer any questions if there's any time left. So I can take one. There's a lot of hands going up here. Yeah, in the way back? I think it's, yeah, yeah, you, you. Okay, so the question is related to attacks in the supply chain, the AI supply chain, where an attacker could potentially distribute a model with a backdoor baked in and then other people are using this model for their own applications. You could use this backdoor attack in that mode, but if the attacker's doing that, I mean, if they train the model, they have access then to all the like poisoning at training time sort of tricks as well. But you can imagine again, this is certainly applicable in that scenario. I don't see any reason why you couldn't do that. In fact, it would make the attacker's life kind of easy because this is a trivial modification to the network, right? It's basically a free operation to jitter the weights and then just keep checking them. All right, looks like I only got one question, so you can catch me, I'll be around afterwards. Thank you.


Good thing about that fact is that you already use the German accent and At least I'm living in Monaco, so I'm not completely as German as out of my be Yeah, ladies and gentlemen, I'm happy to be here My name is Tito's Gable. I am a lawyer by education who eventually became entrepreneur. I Founded amongst other things Deutsche Rooster for gay German mining and oil and gas company listed Frankfurt Stock Exchange And I must say that was the best time of my life because you can imagine as a lawyer for the first time in my life I produced something of real value Oil gas Gold silver tungsten molybdenum and some other minor metals, which is is really Is a good feeling that you have really contributed to the wealth of the world with real products We were relatively successful and so I could retire at the end of 2014 and move to Monaco with my family and Focus on my which is now my lifetime project. It's called free private cities What is a free private city? Let me start with a quote from a guy whose name you probably have heard of its Jean-Jacques Rousseau Intellectuals and governments especially claim that there are Basically following the idea of Jean-Jacques Rousseau that we have a social contract What they do not tell you is what I will quote now From where have 100 the right who want a ruler to vote for the 10 who don't even majority rule is subject to prior agreement and Requires initial unanimous consent Jean-Jacques Rousseau social contract page 16 They never tell you but every single Constitution is a violation of this principle because they are contract at the expense of third parties Something that is forbidden in all civil and common law systems for a reason now imagine a Private company offers you the basic services of a state that is protection of life liberty and property in a defined territory You pay a certain amount for those services per year your respective rights and duties are laid down in a written Citizen contract a real contract between you and the provider for everything else you do as you please Thus you are a contracting party on an equal footing with a secured legal position Instead of subject to the government's or majority's ever-changing will and The best thing is you only become part of it if you like the offer So for if this was true for the first time in history Jean-Jacques Rousseau's requirement of Initial consent would be fulfilled because every single citizen had signed a contract So if you organize this in a form of a basically Private company for profit Then the incentives are completely different from states too The operator has skin in the game and is liable So he has to treat his customers well like any other service provider who wants to be successful he wants to make money and There's no hypocrisy around the common good or saving the world I Invite you to Regard to come away from the traditional idea that many of us have this here are the markets and there's politics and government No, it's a market. It's one big market and It's called I call it the market of living together This is the biggest and most important market of all and if we come into this market with a new product Then we will see that basically all political systems are products and If we can choose amongst a diversity of products We normally over time would choose what fits us best what we like best and you probably find out that we are not the same some might Prefer more an acro capitalist systems others might prefer more regulated systems and others might third parties might Favour religious rule system or other people say we want to have certain cultural or ethical Similarities with the people I'm living with All this would be okay Even communism would be okay as long as participation is voluntarily right and In so far of course, they will be then a pro a filter process some some will not work over time some will work But why should it be different from the product markets and the service markets where we have a variety of products? There's no one product one size fits all why should this be different in our market of living together? Now I think that my concept of free private cities would have a Lot of competitive advantages in in the market Let me elaborate a little bit on that first. There's legal certainty Every resident has a written has a signed agreement with the operator of the free private city This written contract clearly defines the respective rights and obligations of the contracting parties and Is enforceable by every resident the operator cannot change this agreement unilaterally? Conflicts about its interpretation or fulfillment go to independent arbitration Now you might say yeah, but he has maybe the police and he can just ignore these arbitration. This is true but Then he will lose his customers and not be able to gain new customers, right? On a cruise ship the captain in theory has the same power. He is an absolute morgue Have you ever heard that the cruise ship captain ordered passengers to be flocked because they weren't well dressed at the captain's dinner? No, we haven't because he has a commercial interest not to do that and Exactly, this is the incentive for me to treat my people well because they're my customers and if I Mistreat them because I could so because I have the power then this would this news would go around quickly And my expansion planes would be over and people would leave by the way, this is the situation of Monaco The Prince in a theory has a lot of power. He could do not everything he wants It's still a constitutional monarchy, but he could come up with all idiotic laws and and and rules But he does not because you know that we would then leave immediately Right, so it's it's the combination of competition and having a relatively small territory compared to I mean If you have to leave your continent to go to another system or another product It's much more difficult if you are in a small entity that works that the competition works as limiting factor for power and that as Could could Be established for now about I think the system in Monaco That is things 150 years It's working Second advantage of my model there might be other models is guaranteed security Since you are paying for the protection of your life liberty and property and only for that You have a corresponding claim against the operator the first and foremost task of the police or the security the private security Engaged by me is therefore to provide for your security around the clock if you become victim of a crime You are entitled to compensation That should be a normal thing right? I'm paying for security. It is broken to my apartment I go to the opera say that shouldn't have happened. I want damages Because he is offering a service and if the service is not good then you have a have a claim Then you are entitled to compensation So the police has to follow predefined and known rules of engagement Which would be part of the contract and cannot be changed as well Of course There would be much more freedom apart from the security package and respective payments that comes with the contract and you cannot Outvote that you can decide by yourself or what goods and services you want to spend money on and which Charities and political cases you want to support You have full freedom of action Limited only by the respective rights of others and the basic rules light down an agreement with the operator This includes for example free speech full freedom of contract including the negative freedom of rejecting people and the freedom of Association with your fellow residents the interaction between the residents happens on a purely voluntary basis not based on coercion Fourth advantage limitless innovation innovation is seen as chance not as risk provided You do not harm your neighbors or their property anyone can introduce new products and Services without permit permission or license and pay for them in any currency decide You decide on your own if you want to test or use those products or services After a while free private cities will offer much higher quality of life to everyone and The last but I think my favorite point is getting rid of politics There is no more need to argue and to find political compromises between ideas Which are incompatible instead specialized cities catering to specific Ideological cultural or ethical concerns are conceivable Everybody can go into the system that best matches his or her convictions and Personality given voluntary Participation everything is possible this simple rule has the potential to disarm and transform even the totalitarian ideology into just one product among many so this is the theory and Professor Hopper has and rightly so Told me well, that's fine, but we want to know how this can be realized in the real world and this is a absolutely justified question and When I started this about two years ago, I was giving myself five to ten years to make it happen It seems so that it's happening much faster than I expected I can't give you any details at the moment Because we still in a hot phase of a negotiation with the government But I mean there's a good chance that within the next 12 months there will be the first project up and running So if you are interested You can have a look at the website. It's called free private cities calm one word and there's a newsletter And you can subscribe so you will be informed if there is something happening but how would be a strategy to approach governance because after all there is No unclaimed territory in the world. You know that there are some people saying no There are small pockets of Terra Nullius. That's the name of the concept The problem with the Terra Nullius concept is that a land is only Unclaimed by its neighboring states unless they decide otherwise and that for example happened to Lieberland with Croatia That happened to don't know what the name of the project Before the coast of Australia with Tonga which eventually claimed then the new creative They even made an artificial island which was then claimed by Tonga so Realistically, we have to negotiate with countries. We have to convince them that this is a good idea to establish something like that No, why should they do that? Well, there's only one reason because they are expecting advantages for themselves That's the only possibility Right and in so far, I'm not going to government saying by the way we want to Establish a free private city because it's a disruptive technology to kick out basically government and and and states Well, if you if you approach governments like that the probability that they will listen to you is Relatively limited, right? So what you do instead is you are looking for already existing Things that are considered not threatening and In our case, that's easy. It's a special economic zone There are already 4,000 special economic zones existing in the world and what we do is we say Well, it's a special economic zone next level a special economic zone plus and now it's getting even better I say and there is even Presidents for that it is called the Dubai International Financial Center. They even have own legal system They implemented British common law based own legal system. They hired and a retired judge from London So they have a system within a system. It's already there the other thing you all know is basically the relationship between Hong Kong and China that is Hong Kong is Part of China part of the Chinese sovereignty, but still has its own rules its own system It's a special historical situation that is clear But just to make it a better Understand and it's always better if you can refer to existing entities to existing situations to make people feeling more comfortable and in so far we would not need full sovereignty to make this happen you would basically Being a little bit in the position of Hungary where we would say okay Serenity foreign policy and the army is your part, but we do all the rest what we need is the The possibility to to regulate ourselves and of course, this is no easy task because it is giving up power to a certain degree So why should why should again? Why should a country do that? In my original model everybody is coming Voluntarily, so you have to start on an uninhabited territory. So this is on the other hand a plus because if you tell them well look Look at entities like Singapore Hong Kong or Monaco around those There's a big belt of wealth which is in your country and they will be pay taxes to you And so if we now create something in a formally uninhabited area, this is a big win for everybody Right you we will create investment. We will create jobs a lot of people will we will create Work for you for your companies in your country would certainly Take some of their services and many people will just commute in and out and they will all pay taxes to you So especially countries that have that are running out of money and out of ideas are our main targets we would say okay look in In places like Central America, I would say look Investment is not coming because your system is considered. We don't know if it's true but it's considered by the investment community as current and people want stability especially if they want to invest and People do not understand your your legal system, which by the way is changing every year So if we now establish a well known civil legal system be it British common law or German or Swiss civil law that is well known to the world and and Companies can invest according to that rule and we would even import Judges from those first world countries, which we have screened that are completely reliable Then it becomes interesting to those companies, which otherwise wouldn't come so that makes sense even for a dictator right that he will probably understand that and Now if you if you imagine you are a student, which is just coming out of a new university and has it has a great idea Around free private cities the probability that the president will listen to you is very small But if you are coming with people who have already a track record Who are investors you have collected maybe network investors as it's coming with a certain amount of money I mean I have experienced that already the the first question is how much how much are you investing? But it's all about money as usual. All right, so I would line up A group of people that was my original strategy was first write the book so that in that Should be finished by by the end of October And then hopefully published this year so that if I fail others can just pick up from there and continue My idea is my thesis is once the idea is in the world and you have given some idea hints how to implement that in reality It will eventually happen And and I'm giving myself the rest of my life to make it happen. Persistency is absolutely important and in so far the next step would be Line up advisors with big names that are creating trust even to governments and the third step would be then line up investors And only then you approach governments so now this is Happening quicker because I have been approached by another group with they wanted me to support them because they are in a Illegally advantageous position to make such I would say which might become 70 percent free private city Happening very soon. So my plans have been disturbed a little bit, but to the better you could say I don't I think the field much on Malker once said Every plan is in ruins with the first contact with the enemy and that's how it is, right? And you have to be flexible and this is another Advice I would give to everybody who wants to get involved in that business you have to make concessions, right? If the country says we want that 60 percent or whatever percentage of workers is coming from our country Well, then if you're not accepting that you are out, right? You can always say well, but we couldn't find qualified workers and in so far These are two things one is the rule and the other is the implementation of the rule And then you have to control of the implementation and at the end of the process The result might be completely different from what the original idea. So there's a lot of room Even if you have to make large concessions Monaco for example Had a big problem in the 60s with France and de Gaulle tried to squeeze them out because I said you are basically a protectorate From now on I want every Monaco citizen to pay taxes to France Because all their rich people just moved to Monaco, right and they kept their factories in France so what did they do eventually Monaco negotiated and the compromise is that French people living in Monaco after 62 after the 1962 they have to pay taxes to France and This is remaining until today. So but everybody who's not French Still enjoys the tax system of Monaco. So this is the real world, right? Reward is never black white It's it's always a little bit of a of a deal and and and a trade-off Again, and and then you can try to solve their problems there has Popped up this micro migration crisis. You can say well look We would create a migrant city in and and you we need your protection You guarantee this as a Western country that we have military protection by NATO And we are setting up as a private company a migrant city We are selecting our migrants, but we could often set this up in Libya or wherever and East the migration pressure because we would basically they are established Cities which are stable and you have to be probably relatively robust would will be rather rather Singapore type of government then That what we would do amongst ourselves, which is much more liberal But I mean depending on your target group, right? But this could be a trojan horse of liberty because if people see that this is working without politics they will throw their conclusions and Then you're solving their problems, right? So that is basically this these are my answers to to the justified question. How do you make this happen in practice? Again, we are relatively close other groups are also relatively close to to making something like that happen We have one project in Myanmar and one in French Polynesia and eventually it will happen because It's just a better product that is at least my conviction and and let's face reality I mean a political party or political movement, which is based on liberty and free markets As main principles will never ever in my view gain a majority in a mass democracy where everybody has a vote Because you're competing against political parties who claim that you have to write to live on the expense of others That you are not responsible for your failures, but society is and that you're morally superior to the free market people Attractive, awful It's what can I say as a libertarian candidate vote for me. I promise I will do nothing for you Yeah, you are applauding but the majority will not, right? So and that is the reason why you have to go just another way say, okay Let's skip that way. I tried it for 30 years and I can do now continue for 30 more years expecting a different result or I could do something completely new and that is a new product a niche product, right? Ludwig von Mises has has discovered as early as 1922 in his book dig a minebird shaft That socialism communism can't work because of they have no free prices. So they have no indicator of scarcity What were the consequences of this discovery? Zero zero are consequences, right? Because we have now in Venezuela was the 85th attempt to make socialism happen all failed of course and The 86th attempt is only a question of time because the what I said is so attractive people You get something for free versus you have to work for it. I take this every we all would take this, right? So we have to create a different product and Imagine or recall the iPhone that was invented exactly 10 years ago If I had told you 12 years ago Well, what about a hand-toed computer and you can make phone calls with it would have said Do I need that well nice to have right? But once it was there and everybody could see it and touch it and test it Wow within two or three years the whole world all big producers were only producing smartphones and This is basically the idea probably will not take much longer time But this is the idea don't convince people of something you just do it and show it and then people can come Can have a look. Okay. Is it working? Oh? Everybody has a contract and they go back to their government I want a contract too and so you can change the world it takes a while Admittedly, but I think the time for analyzing and arguing is over. I mean There there are few things the ones of you that have been here for for ten times or more probably there wasn't much new things there because you already have heard it and Of course, you can spread the news to the rest of the world but at the end it will not convince them as Ludwig von Mises couldn't convince them and At the end you will have to do something and you will have to show that there is an alternative possible Which is not socialism right and I think that We never had better chance to make this happen We have other than the failed attempt in the sex 60s and 70s We have now understood that we can't do something against the state But we have to agree with the state to make an agreement That is giving us the possibility to do that So if you are interested in that subject again, check out The website free private cities comm You can also approach me. I have to leave Tomorrow morning, but I'm still here around the whole day. So if you if you think you know a place where this could happen If you have an idea or in government, you know or whatever or just interested becoming a resident or a business Owner in our upcoming project, which hopefully will happen in the next six months then Talk to me. I'm happy to Welcome you then in the first free private city soon. Thank you


The Center for Adolescent Renewal and Education, CARE, is on course for significant expansion in 2023 with the establishment of its latest facility, a proposed hospitality and catering block airmarked for construction in Kaldesar castries. The Government of St. Lucia has secured a $2.2 million grant from the Government of India to materialize the project. At the sword-turning ceremony, which took place on July 11th at the Odza Center, Prime Minister Hon. Philip J. Pierre commended CARE and its successive boards and faculty for continuing to provide St. Lucia's marginalized youth with opportunity for vocational development. Dominic was a very practical man, a man of God, but a man of practicality. And when he started the CARE program, everybody said, why are you seeing about these people? And the same thing we had today, these people, people who live and why are you on about these people for? Why are you living with these people? Same things we had today. These people, my brothers and my sisters, are human beings. Their parents have the same aspirations for their children. Their parents want their children to do well. And these children, most of them, do well if they are given the opportunity. And what CARE is giving is opportunity. Opportunity for them to get them a first chance, a second chance, even a third chance. How many of us who scream self-righteousness? How many of us have not made mistakes? And if it were not for the benefit of our position, our parents, our social status would not have been where we are today. How many of us? But we scream and we say, these people, why are you spending on these people? But CARE and the board directors, this is why I recognize them, have spent time on these people. And I'm sure they look back at pride and see how many of these people have become men and women and are contributing to the society. Honorable Peir, who also serves as Minister of Finance, used the occasion to announce that the $550,000 government subvention provided to CARE will be increased in the next fiscal year. In these trying times, the Government of St. Lucia this year will increase, I want to be careful. I see Papa, I see Papa watching me because he wants his folk recent center to continue. Let me go back and say it slowly. In a common budget, the Government of St. Lucia will increase the subvention to CARE. But that's not all. We have, this year also, we are going to increase the support that we are given to children to go into school this year. We're going to increase the support. Last year, we started with facility fees and the pain of CXCs for English and Maths. This year, we cannot increase the amount of subjects that we pay, but as soon as things improve, we are going to increase the subjects that we pay. And hopefully, hopefully, by the end of this term, hopefully, children will not have to pay any CXC fees when the time comes. The completion of CARE's proposed hospitality and catering block is scheduled to coincide with its 30th anniversary next year. The project forms part of the upgrading St. Lucia's capacity to provide impactful vocational training for marginalized youth project, which is financed by the India-UN Development Partnership Fund through the United Nations Office for South-South Cooperation. From the Office of the Prime Minister, Rihanna Isidore.