見えざる手：標的型アイデンティティ再関連付け攻撃によるモデル公平性とSHAPの操作
The Unseen Hand: Manipulating Model Fairness and SHAP with Targeted Identity Re-Association Attacks
機械学習モデルの公平性監査や説明可能性手法が、保護属性の影響を隠す巧妙な攻撃に対して脆弱であることを示し、モデル内部にアクセスせずに出力を操作する新たな攻撃手法を提案した。
著者: Sannaan Khan, Muhammad U. S. Khan
分類: cs.LG, cs.AI
原文アブストラクト
As machine learning models grow more influential and opaque, algorithmic fairness and explainability are critical for ensuring accountability. However, we demonstrate that these auditing mechanisms are themselves vulnerable to subtle manipulation, camouflaging the influence of protected features. While prior work on data-agnostic attacks has exposed this vulnerability, they leave behind detectable artifacts that compromise their stealth. We introduce Targeted Identity Re-Association (TIRA) attacks, a novel family of attacks that iteratively and probabilistically manipulate a model's outputs without requiring access to the model's internals or feature representations. We formalize two algorithms: Probabilistic Micro-Shuffling (PMiS), which applies localized adjacent swaps, and Probabilistic Rank-Shift Micro-Perturbation (PRSMP), which introduces small, randomized rank shifts. We empirically demonstrate that TIRA attacks are highly effective at pushing fairness metrics towards ideal values. Crucially, TIRA attacks successfully confound SHAP-based explanations, leaving effectively zero residual attribution for protected features, a major improvement over prior work.