Collaborative Research: CIF: Medium: Understanding Robustness via Parsimonious Structures.

现代机器学习方法，特别是深度网络，在科学和工程的几个领域取得了重大进展，包括计算机视觉、语音和语言处理、机器人等。与此同时，深度网络已被证明对其输入或训练集的微小对抗性扰动极其敏感。正因为如此，基于深度网络的模型对于不可察觉的攻击可能表现出显著的脆弱性。最近的工作提出了许多特别的方法来保护深层网络免受这种敌意攻击，这些攻击随后被更强的攻击打破。尽管仍在开发更强大且可被证明是正确的防御措施，但理解深层网络为何会被愚弄而做出错误预测，以及如何设计和训练具有健壮性保证的网络，仍然难以找到一个数学框架。该项目旨在回答以下问题：是否有可能检测到网络何时受到攻击或数据集何时被中毒，并重建原始的未受破坏的数据？如果是，在什么条件下数据的分布和网络架构？如果不是，如何设计网络体系结构和学习算法来生成可证明可靠的网络？该项目的研究目标如下：(1)推导输入数据和攻击类型的条件，在此条件下可以确定攻击类型并重构原始信号；(2)研究针对中毒攻击的健壮性保证的基本界限，特别是在对手可以毒化固定分数的训练样本的渐近机制下；(3)研究利用计算表示的稀疏性和局部稳定性的非线性预测器的健壮性，允许健壮性的可证明保证；(4)研究对称作为一种节俭形式的作用，并表明它增加了对抗的健壮性。这一奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Modern machine learning methods, and in particular deep networks have led to significant advances in several areas of science and engineering, including computer vision, speech and language processing, robotics, and beyond. At the same time, deep networks have been shown to be extremely sensitive to small adversarial perturbations to their inputs or training set. Because of this, models based on deep networks can exhibit significant vulnerabilities to imperceptible attacks. Recent work has proposed many ad-hoc methods for defending deep networks against such adversarial attacks, which have been subsequently broken by stronger attacks. While stronger and provably correct defenses continue to be developed, a mathematical framework for understanding why deep networks can be fooled into making wrong predictions and how to design and train networks with guarantees of robustness remains elusive. This project aims to answer the following questions: Is it possible to detect when a network has been attacked or when a dataset has been poisoned and reconstruct the original uncorrupted data? If yes, under what conditions on the distribution of the data and the network architecture? If not, how can network architectures and learning algorithms be designed that yield provably robust networks? This project has the following research goals (1) derive conditions on the input data and the attack type under which one can determine the attack type and reconstruct the original signal; (2) study the fundamental limits of robustness guarantees against poisoning attacks, especially in the asymptotic regime where the adversary can poison a constant fraction of the training samples; (3) study the robustness of non-linear predictors that exploit sparsity and local stability of the computed representations allowing for provable guarantees for robustness; (4) study the role of symmetry as a form of parsimony and show that it increases the adversarial robustness.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.