SaTC: CORE: Medium: Collaborative: Using Machine Learning to Build More Resilient and Transparent Computer Systems

机器学习算法越来越多地成为日常生活的一部分：它们为我们浏览网页时看到的广告、现代汽车中的自动驾驶辅助设备、甚至天气预测和关键基础设施提供了动力。我们之所以依赖这些算法，部分原因是它们比其他算法表现得更好，而且它们可以很容易地定制为新的应用程序。许多机器学习算法也有一个很大的弱点：很难理解它们如何以及为什么计算它们提供的答案。这种不透明性意味着我们从机器学习算法中得到的答案可能会有微妙的偏差，甚至是完全错误的，但我们可能没有意识到这一点。该项目的目标是使机器学习算法更容易理解，并利用攻击者使用的一些技术来欺骗机器学习算法犯错误，以构建更能抵抗攻击的计算机系统。除了对机器学习算法的设计和使用做出基本贡献外，该项目还包括吸引学生获得机器学习工具的实践经验的推广工作。这个项目的重点是深度神经网络（dnn）。在过去的五年里，大量的研究表明，这些模型有被用来欺骗它们的输入（所谓的“对抗性示例”）所回避的倾向。这些类型的攻击利用了dnn的不透明性：虽然dnn可以在一些分类任务上表现得非常好，但它们经常无视对它们如何做到这一点的简单解释，并且确实可以利用人类可能会感到惊讶的特征来做到这一点。该项目利用深度神经网络和针对它们的攻击来深入了解如何构建更具弹性的计算机系统。具体来说，该项目将使用dnn来模拟试图攻击计算机系统的对手，然后“攻击”这些dnn，以学习如何提高这些系统的攻击弹性。这种建模将使用生成对抗网络（GANs）来完成，其中“生成器”和“鉴别器”模型相互竞争。这一愿景的核心是在约束下逃避dnn的能力，并从中提取关于它们如何执行分类的解释。因此，该项目将在开发更好的欺骗dnn的方法和改进这一重要的机器学习工具方面取得根本性进展。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Machine learning algorithms are increasingly part of everyday life: they help power the ads that we see while browsing the web, self-driving aids in modern cars, and even weather prediction and critical infrastructure. We rely on these algorithms in part because they perform better than alternatives and they can be easy to customize to new applications. Many machine learning algorithms also have a big weakness: it is difficult to understand how and why they compute the answers they provide. This opaqueness means that the answers we get from a machine learning algorithm could be subtly biased or even completely wrong, and yet we might not realize it. This project's goal is to make machine learning algorithms easier to understand, as well as to leverage some of the techniques used by attackers to trick machine learning algorithms into making mistakes to build computer systems that are more resistant to attack. In addition to making fundamental contributions to how machine learning algorithms are designed and used, the project includes outreach efforts that will entice students to gain hands-on experience with machine learning tools.This project focuses on deep neural networks (DNNs). A groundswell of research within the past five years has demonstrated the propensity of these models to being evaded by inputs created to fool them -- so called "adversarial examples." These types of attacks leverage DNNs' opacity: while DNNs can perform remarkably well on some classification tasks, they often defy simple explanations of how they do so, and indeed can leverage features for doing so that humans might find surprising. This project leverages DNNs and the attacks against them to gain insights into how to build more resilient computer systems. Specifically, the project will use DNNs to model adversaries trying to attack computer systems and then "attack" these DNNs to learn how to improve these systems' resilience to attack. This modeling will be done using Generative Adversarial Nets (GANs), in which "generator" and "discriminator" models compete. Central to this vision are the abilities to evade DNNs under constraints and to extract explanations from them about how they perform classification. Consequently, this project will make fundamental advances both in developing better methods to deceive DNNs and in improving this important machine-learning tool.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.