Adversarial Regression with Multiple Learners Liang Tong ∗ 1 Sixie Yu ∗ 1 Scott Alfeld 2 Yevgeniy Vorobeychik 1 1 Electrical Engineering and Computer Science Vanderbilt University 2 Computer Science Amherst College ICML 2018 ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 1 / 21
Problem Setting ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 2 / 21
Motivation Adversaries can change features at test time to cause incorrect predictions. i.e., change features of a house (i.e., square feet, #rooms) to fool online real-estate evaluation system, or make invisible changes to pictures to fool classifier. ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 3 / 21
Motivation Adversaries can change features at test time to cause incorrect predictions. i.e., change features of a house (i.e., square feet, #rooms) to fool online real-estate evaluation system, or make invisible changes to pictures to fool classifier. Previous investigations of this problem pit a single learner against an adversary. [ Bruckner11 , Dalvi04 , li2014feature , zhou2012 ] ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 3 / 21
Motivation Adversaries can change features at test time to cause incorrect predictions. i.e., change features of a house (i.e., square feet, #rooms) to fool online real-estate evaluation system, or make invisible changes to pictures to fool classifier. Previous investigations of this problem pit a single learner against an adversary. [ Bruckner11 , Dalvi04 , li2014feature , zhou2012 ] But an adversary’s decision is usually aimed at a collection of learners. i.e., an adversary crafts generic malwares and disseminate them widely. ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 3 / 21
Motivation Adversaries can change features at test time to cause incorrect predictions. i.e., change features of a house (i.e., square feet, #rooms) to fool online real-estate evaluation system, or make invisible changes to pictures to fool classifier. Previous investigations of this problem pit a single learner against an adversary. [ Bruckner11 , Dalvi04 , li2014feature , zhou2012 ] But an adversary’s decision is usually aimed at a collection of learners. i.e., an adversary crafts generic malwares and disseminate them widely. The learners all make autonomous decisions about how to detect malicious content. ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 3 / 21
Table of Contents Learner Model 1 Attacker Model 2 Multi-Learner Stackelberg Game (MLSG) 3 Existence and Uniqueness of the Equilibrium 4 Computing the MLNE 5 Robustness analysis 6 References 7 ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 4 / 21
Learner Model ( X , y ): training dataset from an unknown distribution D . X = [ x 1 , ..., x m ] ⊤ and y = [ y 1 , y 2 , ..., y m ] ⊤ : x j the j th instance and y j its corresponding response variable. ′ (a modification of D ) Test data is drawn from a distribution D manipulated by the attacker. ′ ( D ) with probability β (1 − β ). An instance from D The action of the i th learner is to learn the parameters of the linear regression model: θ i , which results in ˆ y i = X θ i . The expected cost function of the i th learner: ′ ) = β E ( X ′ , y ) ∼D ′ [ ℓ ( X ′ θ i , y )] + (1 − β ) E ( X , y ) ∼D [ ℓ ( X θ i , y )] c i ( θ i , D (1) y − y || 2 where ℓ (ˆ y , y ) = || ˆ 2 . ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 5 / 21
Table of Contents Learner Model 1 Attacker Model 2 Multi-Learner Stackelberg Game (MLSG) 3 Existence and Uniqueness of the Equilibrium 4 Computing the MLNE 5 Robustness analysis 6 References 7 ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 6 / 21
Attacker Model ′ , y ), Every instance ( x , y ) is maliciously modified by the attacker to ( x with probability β . Assume the attacker has an instance-specific target z ( x ). ′ close to z ( x ). y = θ ⊤ The objective of the attacker: ˆ i x y − z || 2 The attacker’s objective is measured by: ℓ (ˆ y , z ) = || ˆ 2 . ′ incurs costs: R ( X ′ − X || 2 ′ , X ) = || X Transforming X to X F . The expected cost function of the attacker: n � ′ ) = ′ θ i , z ) + λ R ( X ′ , X ) c a ( { θ i } n i =1 , X ℓ ( X (2) i =1 ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 7 / 21
Table of Contents Learner Model 1 Attacker Model 2 Multi-Learner Stackelberg Game (MLSG) 3 Existence and Uniqueness of the Equilibrium 4 Computing the MLNE 5 Robustness analysis 6 References 7 ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 8 / 21
Multi-Learner Stackelberg Game (MLSG) The MLSG has two stages, which proceeds as follow: In the first stage the learners simultaneously learn their model parameters { θ i } n i =1 . In the second stage, after observing the learners’ decision , the attacker constructs its optimal attack (manipulating X ). Assumptions The learners have complete information about β , λ , and z . Each learner has the same action space Θ ⊆ R d × 1 , which is nonempty, compact, and convex. The columns of the test data X are linearly independent. ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 9 / 21
Multi-Learner Stackelberg Game (MLSG) Definition (Multi-Learner Stackelberg Equilibrium (MLSE)) An action profile ( { θ ∗ i } n i =1 , X ∗ ) is an MLSE if it satisfies θ ∗ c i ( θ i , X ∗ ( θ )) , ∀ i ∈ N i = arg min θ i ∈ Θ (3) ′ ) . X ∗ ( θ ) = arg min c a ( { θ i } n i =1 , X s.t. X ′ ∈ R m × d where θ = { θ i } n i =1 constitutes the joint actions of the learners. MLSE is a blend between a Nash equilibrium (among all learners) and a Stackelberg equilibrium (between the learners and the attacker). ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 10 / 21
Multi-Learner Stackelberg Game (MLSG) Lemma (Best Response of the Attacker) Given { θ i } n i =1 , the best response of the attacker is n n � � X ∗ = ( λ X + z i ) − 1 . θ ⊤ θ i θ ⊤ i )( λ I + (4) i =1 i =1 X ∗ has a closed form, as a function of { θ i } n i =1 . With this lemma, the learners’ cost functions become: c i ( θ i , θ − i ) = βℓ ( X ∗ ( θ i , θ − i ) θ i , y ) + (1 − β ) ℓ ( X θ i , y ) . (5) X ∗ ( θ i , θ − i ) MLSG = = = = = = ⇒ Multi-Learner Nash Game (MLNG) MLNG is a game among the learners. ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 11 / 21
Table of Contents Learner Model 1 Attacker Model 2 Multi-Learner Stackelberg Game (MLSG) 3 Existence and Uniqueness of the Equilibrium 4 Computing the MLNE 5 Robustness analysis 6 References 7 ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 12 / 21
Existence and Uniqueness of the Equilibrium We approximate the MLNG by deriving upper bounds on the learners’ cost functions. The approximated game is denoted by: �N , Θ , ( � c i ) � . Theorem (Existence of Nash Equilibrium) �N , Θ , ( � c i ) � is a symmetric game and it has at least one symmetric equilibrium. Theorem (Uniqueness of Nash Equilibrium) �N , Θ , ( � c i ) � has an unique Nash equilibrium, and this unique NE is symmetric. The equilibrium of �N , Θ , ( � c i ) � is defined as: Multi-Learner Nash Equilibrium (MLNE) ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 13 / 21
Table of Contents Learner Model 1 Attacker Model 2 Multi-Learner Stackelberg Game (MLSG) 3 Existence and Uniqueness of the Equilibrium 4 Computing the MLNE 5 Robustness analysis 6 References 7 ( Electrical Engineering and Computer Science Vanderbilt University, Computer Science Amherst College ) Adversarial Regression with Multiple Learners ICML 2018 14 / 21
Recommend
More recommend
