f-ダイバージェンスを用いたバックドア汚染攻撃に対する認証付きロバスト性フレームワーク
A Certified Robustness Framework for Backdoor Poisoning Attacks using $f$-Divergences
データサブサンプリングと特徴・ラベル・テストサンプルのノイズ付加を組み合わせ、f-ダイバージェンスに基づく合成可能な認証手法で多様な汚染攻撃に対するロバスト性を証明する汎用フレームワークを提案した。
詳しい要約
1. どんなもの？
2. 先行研究と比べてどこがすごい？
3. 技術・手法の肝は？
4. どうやって有効だと検証した？
5. 議論はある？
6. 次に読むべき論文は？
※ AIが要旨から生成した要約です。正確性は原文をご確認ください。
著者: Evan Rose, Alina Oprea
分類: cs.LG, cs.CR
原文アブストラクト
Machine learning systems trained on untrusted data are vulnerable to data and backdoor poisoning attacks, in which an adversary corrupts training and test samples to manipulate predictions at inference time. Randomized smoothing yields provable defenses against such attacks, but existing applications to train-time robustness are limited to specific threat models and smoothing mechanisms. We propose a general framework that allows expressing complex adversary constraints on the number of corrupted training examples, feature and label perturbation magnitudes, and test-time corruptions. Our framework randomizes inputs by combining data subsampling with feature, label and test-sample noising. We develop a composable certification procedure based on $f$-divergences that handles arbitrary combinations of threat models and noising strategies, and recovers several prior certification regimes exactly as special cases. We demonstrate our framework experimentally by certifying, for the first time, robustness under general $\ell_p$-constrained poisoning adversaries under bagging with additive Laplace, Gaussian, and Uniform noises.