SaTC: CORE: Medium: Collaborative: Using Machine Learning to Build More Resilient and Transparent Computer Systems

SaTC：核心：媒介：协作：使用机器学习构建更具弹性和透明的计算机系统

• 批准号: 2113345
• 负责人: Michael Reiter
• 金额: $ 33.33万
• 依托单位: Duke University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2021
• 资助国家: 美国
• 起止时间: 2021-01-01 至 2023-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2113345&HistoricalAwards=false
• 关键词: SaTC; CORE; Medium; Collaborative; Using

Machine learning algorithms are increasingly part of everyday life: they help power the ads that we see while browsing the web, self-driving aids in modern cars, and even weather prediction and critical infrastructure. We rely on these algorithms in part because they perform better than alternatives and they can be easy to customize to new applications. Many machine learning algorithms also have a big weakness: it is difficult to understand how and why they compute the answers they provide. This opaqueness means that the answers we get from a machine learning algorithm could be subtly biased or even completely wrong, and yet we might not realize it. This project's goal is to make machine learning algorithms easier to understand, as well as to leverage some of the techniques used by attackers to trick machine learning algorithms into making mistakes to build computer systems that are more resistant to attack. In addition to making fundamental contributions to how machine learning algorithms are designed and used, the project includes outreach efforts that will entice students to gain hands-on experience with machine learning tools.This project focuses on deep neural networks (DNNs). A groundswell of research within the past five years has demonstrated the propensity of these models to being evaded by inputs created to fool them -- so called "adversarial examples." These types of attacks leverage DNNs' opacity: while DNNs can perform remarkably well on some classification tasks, they often defy simple explanations of how they do so, and indeed can leverage features for doing so that humans might find surprising. This project leverages DNNs and the attacks against them to gain insights into how to build more resilient computer systems. Specifically, the project will use DNNs to model adversaries trying to attack computer systems and then "attack" these DNNs to learn how to improve these systems' resilience to attack. This modeling will be done using Generative Adversarial Nets (GANs), in which "generator" and "discriminator" models compete. Central to this vision are the abilities to evade DNNs under constraints and to extract explanations from them about how they perform classification. Consequently, this project will make fundamental advances both in developing better methods to deceive DNNs and in improving this important machine-learning tool.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

机器学习算法越来越成为日常生活的一部分：它们可以帮助我们在浏览网络时看到的广告，现代汽车的自动驾驶辅助工具，甚至天气预测和关键基础设施。我们依靠这些算法的部分原因是它们的性能比其他算法更好，并且可以易于自定义新应用程序。许多机器学习算法也有很大的弱点：很难理解如何以及为什么计算他们提供的答案。这种不透明意味着我们从机器学习算法中获得的答案可能会微妙甚至是完全错误的，但我们可能没有意识到。该项目的目标是使机器学习算法更易于理解，并利用攻击者用来欺骗机器学习算法的一些技术来犯错，以构建更具抗攻击能力的计算机系统。除了为如何设计和使用机器学习算法做出基本贡献之外，该项目还包括推广工作，这些工作将吸引学生在机器学习工具上获得动手经验。该项目侧重于深层神经网络（DNNS）。 在过去的五年中，一系列研究表明，这些模型倾向于被创造出来欺骗他们的投入所避免的倾向 - 所谓的“对抗性例子”。这些类型的攻击利用了DNNS的不透明度：虽然DNN在某些分类任务上表现出色，但他们经常对他们如何做到的简单解释，实际上可以利用功能来实现，以使人类可能会感到惊讶。该项目利用DNN和针对他们的攻击来洞悉如何构建更多有弹性的计算机系统。具体来说，该项目将使用DNN来建模试图攻击计算机系统的对手，然后“攻击”这些DNN，以学习如何提高这些系统的攻击能力。该建模将使用生成对抗网（GAN）进行，其中“生成器”和“歧视器”模型竞争。这种愿景的核心是能够在约束下逃避DNN的能力，并从他们进行分类的方式中提取解释。因此，该项目将在开发更好的方法来欺骗DNN和改善这一重要的机器学习工具方面取得基本进步。该奖项反映了NSF的法定任务，并被认为是通过基金会的智力优点和更广泛影响的评估标准来评估值得通过评估来支持的。

项目成果

Practical Integration via Separable Bijective Networks

• 发表时间: 2022
• 作者: Christopher M. Bender;Patrick Emmanuel;M. Reiter;Junier B. Oliva

Constrained Gradient Descent: A Powerful and Principled Evasion Attack Against Neural Networks

• 发表时间: 2021-12
• 作者: Weiran Lin;Keane Lucas;Lujo Bauer;M. Reiter;Mahmood Sharif

Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes

• DOI: 10.1145/3433210.3453086
• 发表时间: 2021-01-01
• 期刊: ASIA CCS'21: PROCEEDINGS OF THE 2021 ACM ASIA CONFERENCE ON COMPUTER AND COMMUNICATIONS SECURITY
• 作者: Lucas, Keane;Sharif, Mahmood;Shintre, Saurabh
• 通讯作者: Shintre, Saurabh

Adversarial training for raw-binary malware classifiers

原始二进制恶意软件分类器的对抗训练

• 发表时间: 2023
• 期刊: USENIX Security Symposium
• 作者: Lucas, Keane;Pai, Samruddhi;Lin, Weiran;Bauer, Lujo;Reiter, Michael K.;Sharif, Mahmood
• 通讯作者: Sharif, Mahmood