Universal Multi-Party Poisoning Attacks
Universal Multi-Party Poisoning Attacks
复制标题
DOI：
--
复制
发表时间：
2018-09
期刊：
影响因子：
--
通讯作者：
Saeed Mahloujifar;Mohammad Mahmoody;Ameer Mohammed
中科院分区：
文献类型：
--
作者：
Saeed Mahloujifar;Mohammad Mahmoody;Ameer Mohammed
在这项工作中，我们演示了通用的多方中毒攻击，它适应并适用于各方之间具有任意交互模式的任何多方学习过程。更一般地，我们介绍和研究$(k,p)$-中毒攻击，其中对手控制各方的$k\in[m]$，并且对于每个受损方$P_i$，对手代表$P_i$提交一些中毒数据$\mathcal{T}'_i$，该数据仍然“$(1-p)$-接近”正确数据$\mathcal{T}_i$（例如， $\mathcal{T}'_i$ 的 $1-p$ 分数仍然是诚实生成的）。我们证明，对于最终训练假设 $h$ 的任何“坏”属性 $B$（例如，$h$ 在特定测试示例中失败或具有“大”风险）在没有攻击的情况下发生的概率为任意小常数，总是存在 $(k,p)$ 中毒攻击，将 $B$ 的概率从 $\mu$ 增加到 $\mu^{1-p \cdot k/m} = \mu + \Omega(p \cdot k/m)$。我们的攻击仅使用干净标签，并且是在线的。更一般地说，我们证明，对于在 $n$ 步随机过程 $\mathbf{X} = (x_1,\dots,x_n)$ 上定义的任何有界函数 $f(x_1,\dots,x_n) \in [0,1]$，能够以偶数相关概率 $p$ 覆盖每个 $n$ 块的对手可以将预期输出至少增加 $\Omega(p \cdot \mathrm{Var}[f(\mathbf{x})])$。
In this work, we demonstrate universal multi-party poisoning attacks that adapt and apply to any multi-party learning process with arbitrary interaction pattern between the parties. More generally, we introduce and study $(k,p)$-poisoning attacks in which an adversary controls $k\in[m]$ of the parties, and for each corrupted party $P_i$, the adversary submits some poisoned data $\mathcal{T}'_i$ on behalf of $P_i$ that is still ``$(1-p)$-close'' to the correct data $\mathcal{T}_i$ (e.g., $1-p$ fraction of $\mathcal{T}'_i$ is still honestly generated). We prove that for any ``bad'' property $B$ of the final trained hypothesis $h$ (e.g., $h$ failing on a particular test example or having ``large'' risk) that has an arbitrarily small constant probability of happening without the attack, there always is a $(k,p)$-poisoning attack that increases the probability of $B$ from $\mu$ to by $\mu^{1-p \cdot k/m} = \mu + \Omega(p \cdot k/m)$. Our attack only uses clean labels, and it is online. More generally, we prove that for any bounded function $f(x_1,\dots,x_n) \in [0,1]$ defined over an $n$-step random process $\mathbf{X} = (x_1,\dots,x_n)$, an adversary who can override each of the $n$ blocks with even dependent probability $p$ can increase the expected output by at least $\Omega(p \cdot \mathrm{Var}[f(\mathbf{x})])$.