AF: RI: Small: Barriers in Adversarially Robust Learning

学习算法越来越多地扮演着以前由人类扮演的角色。例如，人脸识别、恶意软件检测、关于贷款或保释的决策等。然而，学习算法通常对训练或决策期间发生的对抗性操作敏感。由于使用这些算法的上下文的敏感性，理解可证明的鲁棒方法在这种对抗性上下文中的能力和局限性至关重要。该项目的目标是从可证明的角度研究对抗鲁棒性，并确定可能存在的障碍。该项目将与其他领域建立联系，如计算复杂性以及密码学。该项目还包括指导博士生。研究结果将纳入新设计的课程，并将通过讲习班、会议和期刊传播，更具体地说，该项目将侧重于实现上述主要目标的两个部分。第一部分是正式建模对抗鲁棒学习，以实现可证明的方法。事实上，密码学从这种数学上严格的安全方法中受益匪浅，为了达到类似的结果，对抗性鲁棒学习需要一种类似的定义方法来模拟攻击的微妙方面，例如：攻击者的计算复杂性，其精确知识以及随机性的作用。该项目的第二部分旨在确定对抗学习可证明鲁棒性的障碍。该项目将研究对信息理论（a.k.a.统计）以及计算安全性。信息理论安全模型的对手作为一个全能的实体，而更现实的计算安全模型，这是广泛使用的密码学，模型的攻击者作为一个多项式时间的算法。识别这些障碍是设计最佳稳健学习方法的重要组成部分。该奖项反映了NSF的法定使命，并被认为值得通过使用基金会的知识价值和更广泛的影响审查标准进行评估来支持。

Learning algorithms are increasingly taking on roles that were previously held by humans. Examples include face recognition, malware detection, making decisions about loans or bail, etc. Learning algorithms, however, are usually sensitive to adversarial manipulations happening during training or decision time. Due to the sensitivity of the contexts in which these algorithms are used, it is crucial to understand the power and limitations of provably robust methods in such adversarial contexts. The goal of this project is to study adversarial robustness from a provable perspective and identify the barriers that might exist against it. The project will build connections to other areas such as computational complexity as well as cryptography. The project also involves mentoring PhD students. The findings will be incorporated into newly designed courses and will be disseminated via workshops, conferences, and journals.The project, more specifically, will focus on two parts that enable the main goals outlined above. The first part is to model adversarially robust learning formally to enable a provable approach. Indeed, Cryptography has benefited tremendously from such mathematically rigorous approach to security, and to reach similar results, adversarially robust learning needs a similar definitional approach that models subtle aspects of the attack such as: the computational complexity of the attacker, its precise knowledge, and the role of randomness. The second part of this project aims at identifying barriers that exist against provable robustness for adversarial learning. This project will study barriers against both information theoretic (a.k.a. statistic) as well as computational security. Information theoretic security models the adversary as an all powerful entity, while the more realistic model of computational security, which is widely used in Cryptography, models the attacker as a polynomial-time algorithm. Identifying these barriers is an essential part of designing optimally robust learning methods.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.