CIF: Small: Adversarially Robust Statistical Inference

随着机器学习和统计推理算法越来越多地应用于安全关键和安全相关的应用中，迫切需要研究这些算法在对抗性环境中的健壮性。现有关于稳健统计推断的大量工作主要涉及离群值或模型不确定性等问题。然而，在最近的许多数据分析应用程序(包括安全关键应用程序)中，人们面临的情况比到目前为止解决的情况更严重。一种这样的场景发生在攻击者可以观察整个数据流，然后设计其攻击向量来修改数据集中的所有条目，从而造成最大的推断错误。如此强大的对手的存在需要新的模型和方法来进行对手-稳健推理。这些模型和方法的成功开发将扩大机器学习算法可以安全应用的场景，从而将机器学习的应用扩展到安全关键领域。该项目将支持教育活动，以吸引代表人数不足的群体的成员参与研究。在这个项目中，调查者将解决在强大对手在场的情况下的稳健推理。特别是，在生成数据点后，对手可以观察整个数据集，然后修改所有数据点，希望造成最大的推理错误。本项目旨在回答以下问题：1)在选择攻击向量时，攻击者的最佳攻击策略是什么？2)这些攻击的可能影响是什么？3)应该如何设计推理算法来将攻击的影响降至最低？这些问题将通过两个相关的突破口得到解决。在推力1中，将描述对抗健壮推理算法的基本限制；这包括描述最优攻击策略及其对推理性能的影响。然后，调查员将寻求确定将相应影响降至最低的推理算法。在推力2中，将研究实用推理算法的对抗健壮性。在实践中，许多推理问题都被表示为优化问题，然后使用各种优化算法进行求解。这些优化算法的实施通常是分布式的，这引入了几个新的威胁，将在这次努力中解决。这一奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

With machine learning and statistical inference algorithms increasingly used in safety-critical and security-related applications, there arises a pressing need to study the robustness of these algorithms in adversarial environments. The large existing body of work on robust statistical inference mainly addresses issues such as outliers or model uncertainties. However, in many recent data analytical applications (including safety-critical applications), one faces situations which are more severe than those addressed thus far. One such scenario occurs when an adversary can observe the whole data stream, and then devise its attack vector to modify all entries in the data set so as to inflict maximum inference errors. The existence of such powerful adversaries calls for new models and methodologies to carry out adversary-robust inference. The successful development of these models and methodologies will expand scenarios where machine learning algorithms can be safely applied, and thus expand the application of machine learning into safety-critical domains. This project will support educational activities to attract members from underrepresented groups into research. In this project, the investigator will address robust inference in the presence of powerful adversaries. In particular, after the data points are generated, the adversary can observe the whole dataset, and then modify all data points with the hope of inflicting maximum inference errors. This project aims to answer the following questions: 1) What is the attacker's optimal attack strategy in choosing the attack vectors?; 2) What are the possible impacts of these attacks?; and 3) How should inference algorithms be designed to minimize the impact of an attack? These questions will be addressed through two related thrusts. In Thrust 1, the fundamental limits of adversarially-robust inference algorithms will be characterized; this include characterizing the optimal attack strategy and its impacts on the inference performance. The investigator will then seek to identify inference algorithms that minimize the corresponding impact. In Thrust 2, the adversarial robustness of practical inference algorithms will be studied. In practice, many inference problems are formulated as optimization problems, which are then solved using various optimization algorithms. The implementation of these optimization algorithms are often distributed in nature, and this introduces several new threats that will be addressed in this thrust.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.