Universal Multi-Party Poisoning Attacks

Authors: Saeed Mahloujifar, Mohammad Mahmoody, Ameer Mohammed
Published: 2018-09-10 | Updated: 2021-11-10

Source: https://arxiv.org/abs/1809.03474

PDF: https://arxiv.org/pdf/1809.03474

AIにより推定されたラベル

ポイズニング マルチパーティ攻撃 敵対的攻撃

※ こちらのラベルはAIによって自動的に追加されました。そのため、正確でないことがあります。
詳細は文献データベースについてをご覧ください。

Abstract

In this work, we demonstrate universal multi-party poisoning attacks that adapt and apply to any multi-party learning process with arbitrary interaction pattern between the parties. More generally, we introduce and study (k, p)-poisoning attacks in which an adversary controls k ∈ [m] of the parties, and for each corrupted party P_i, the adversary submits some poisoned data 𝒯′_i on behalf of P_i that is still “(1 − p)-close” to the correct data 𝒯_i (e.g., 1 − p fraction of 𝒯′_i is still honestly generated). We prove that for any “bad” property B of the final trained hypothesis h (e.g., h failing on a particular test example or having “large” risk) that has an arbitrarily small constant probability of happening without the attack, there always is a (k, p)-poisoning attack that increases the probability of B from μ to by μ^{1 − p ⋅ k/m} = μ + Ω(p ⋅ k/m). Our attack only uses clean labels, and it is online. More generally, we prove that for any bounded function f(x₁, …, x_n) ∈ [0, 1] defined over an n-step random process X = (x₁, …, x_n), an adversary who can override each of the n blocks with even dependent probability p can increase the expected output by at least Ω(p ⋅ Var[f(x)]).