EAGER: Toward Attack-Resilient Statistical Inference

统计推断的经典技术和理论是在假设不存在操纵输入数据的敌对尝试的情况下发展起来的。这种性质使得大多数现有的统计推断技术不可靠，相关理论在部署到对抗性环境时也变得不相关。这一现有差距是一个非常令人担忧的问题，因为任务关键型系统(如国家电网)和安全关键型系统(如自动驾驶系统)中的许多现代统计推断任务依赖于传感器数据，这些数据可能容易被对手篡改。例如，对手可以发起欺骗攻击，以操纵自动驾驶系统中的激光雷达或视觉传感器数据，从而使目标检测算法无法检测到汽车前面的某些障碍物。尽管最近在稳健统计推理方面取得了进展，但仍然没有通用的理论来表征存在数据篡改的最优推理规则，或者使用伪造数据进行推理的基本限制。该项目旨在通过开发基本理论和最佳方法来解决这一差距，以便在存在对手篡改数据的情况下进行稳健推理。该项目将推动机器学习在稳健统计、稳健传感和安全方面的最先进水平。此外，该项目将通过产生可用于显著提高国家安全关键系统和任务关键系统对数据篡改攻击的弹性的结果，为国家安全做出贡献。该项目的技术目标是调查在存在对抗性数据造假的情况下进行假设检验和估计的基本限度，并在理论分析的支持下发展稳健的推理方法，以减轻数据造假的影响。所开发的理论和方法将进一步扩展，以开发一种新的框架来训练攻击弹性机器学习模型。在追求这些目标的过程中，将使用博弈论的公式来严格建模防御者设计健壮的推理方法和对手针对防御者的推理方法设计优化数据篡改策略之间的复杂相互作用。我们将利用最优化、博弈论和概率论中的技术，为博弈论公式推导出最优的稳健推理方法，并分析它们的性质。此外，在存在仪表测量造假的情况下的电力系统状态估计将被视为案例研究，并将在严格的博弈论设置中开发和评估稳健的电力系统状态估计器。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Classical techniques and theories for statistical inference had been developed under the assumption that there is no adversarial attempt to manipulate the input data. Such a nature renders most existing statistical inference techniques unreliable and the associated theories irrelevant when they are deployed to an adversarial environment. This existing gap is a matter of great concern because many modern statistical inference tasks in mission-critical systems (e.g., the nation's power grids) and safety-critical systems (e.g., autonomous driving systems) are relying on sensor data that could be vulnerable to falsification by an adversary. For instance, an adversary can launch a spoofing attack to manipulate lidar or vision sensor data in an autonomous driving system such that the object detection algorithm will fail to detect certain obstacle in front of the car. Despite recent advances in robust statistical inference, there still is no general theory that characterizes optimal inference rules in the presence of data falsification or the fundamental limit of performing inference using falsified data. This project is aimed at addressing this gap by developing fundamental theory and optimal methods for robust inference in the presence of data falsification by an adversary. The project will advance the state-of-the-art in robust statistics, robust sensing, and security of machine learning. Furthermore, the project will contribute to the national security by generating the outcomes that can be applied to significantly improve resilience of safety-critical and mission-critical systems of the nation against data falsification attacks. The technical objectives of the project are to investigate fundamental limits of performing hypothesis testing and estimation in the presence of adversarial data falsification and to develop robust inference methods, supported by theoretical analyses, to mitigate the impact of data falsification. The developed theory and methods will be further extended to develop a novel framework to train an attack-resilient machine learning model. In pursuing these objectives, a game-theoretic formulation will be employed to rigorously model the complex interplay between the defender designing a robust inference method and the adversary optimizing the data falsification strategy against the defender's design of the inference method. Techniques from optimization, game theory, and probability theory will be leveraged to derive optimal robust inference methods for the game-theoretic formulation and analyze their properties. Furthermore, power system state estimation in the presence of falsified meter measurements will be considered as a case study, and a robust power system state estimator will be developed and evaluated in a rigorous game-theoretic setup.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.