论文标题
数据感知和数据感知中毒攻击之间的分离结果
A Separation Result Between Data-oblivious and Data-aware Poisoning Attacks
论文作者
论文摘要
中毒攻击已成为对机器学习算法的重大安全威胁。已经证明，对训练集进行了少量更改的对手，例如添加专门制作的数据点，可能会损害输出模型的性能。一些更强的中毒攻击需要培训数据的全部知识。这留下了使用中毒攻击获得相同攻击结果的可能性，而中毒攻击没有完全了解清洁训练集。 在这项工作中，我们启动了上述问题的理论研究。具体而言，对于与Lasso进行功能选择的情况，我们表明，完全了解对手（基于其余培训数据的手工中毒示例）比忽略训练集但可以访问数据分布的最佳攻击者要强。我们的分离结果表明，数据感知和合并数据的两个设置在根本上是不同的，我们不能希望在这些情况下始终实现相同的攻击或防御结果。
Poisoning attacks have emerged as a significant security threat to machine learning algorithms. It has been demonstrated that adversaries who make small changes to the training set, such as adding specially crafted data points, can hurt the performance of the output model. Some of the stronger poisoning attacks require the full knowledge of the training data. This leaves open the possibility of achieving the same attack results using poisoning attacks that do not have the full knowledge of the clean training set. In this work, we initiate a theoretical study of the problem above. Specifically, for the case of feature selection with LASSO, we show that full-information adversaries (that craft poisoning examples based on the rest of the training data) are provably stronger than the optimal attacker that is oblivious to the training set yet has access to the distribution of the data. Our separation result shows that the two setting of data-aware and data-oblivious are fundamentally different and we cannot hope to always achieve the same attack or defense results in these scenarios.
