Intrinsic Certified Robustness of Bagging against Data Poisoning Attacks
Intrinsic Certified Robustness of Bagging against Data Poisoning Attacks
复制标题
DOI：
10.1609/aaai.v35i9.16971
复制
发表时间：
2020-08
期刊：
影响因子：
--
通讯作者：
Jinyuan Jia;Xiaoyu Cao;N. Gong
中科院分区：
文献类型：
--
作者：
Jinyuan Jia;Xiaoyu Cao;N. Gong
在数据中毒攻击中，攻击者修改、删除和/或插入一些训练示例以破坏学习的机器学习模型。Bootstrap Aggregating（bagging）是一种众所周知的集成学习方法，它使用基础学习算法在训练数据集的随机子样本上训练多个基础模型，并使用多数投票来预测测试示例的标签。我们证明了内在的认证鲁棒性装袋对数据中毒攻击。具体来说，我们表明，装袋与任意的基础学习算法可证明预测相同的标签测试的例子时，修改，删除和/或插入的训练样本的数量是有界的阈值。此外，我们表明，我们推导出的阈值是紧的，如果没有假设的基础学习算法。我们评估我们的方法上MNIST和CIFAR 10。例如，当任意修改、删除和/或插入100个训练示例时，我们的方法在MNIST上达到了91.1%的认证准确率。代码可从以下网址获得：https://github.com/jjy1994/BaggingCertifyDataPoisoning。
In a data poisoning attack, an attacker modifies, deletes, and/or inserts some training examples to corrupt the learnt machine learning model. Bootstrap Aggregating (bagging) is a well known ensemble learning method, which trains multiple base models on random subsamples of a training dataset using a base learning algorithm and uses majority vote to predict labels of testing examples. We prove the intrinsic certified robustness of bagging against data poisoning attacks. Specifically, we show that bagging with an arbitrary base learning algorithm provably predicts the same label for a testing example when the number of modified, deleted, and/or inserted training examples is bounded by a threshold. Moreover, we show that our derived threshold is tight if no assumptions on the base learning algorithm are made. We evaluate our method on MNIST and CIFAR10. For instance, our method achieves a certified accuracy of 91.1% on MNIST when arbitrarily modifying, deleting, and/or inserting 100 training examples. Code is available at: https://github.com/jjy1994/BaggingCertifyDataPoisoning.