More Like this

1. Learning to Defend by Learning to Attack

   Jiang, Haoming; Chen, Zhehui; Shi, Yuyang; Dai, Bo; Zhao, Tuo. (April 2021, International Conference on Artificial Intelligence and Statistics)
2. Learning to Attack Distributionally Robust Federated Learning

   Shen, Wen; Li, Henger; Zheng, Zizhan (December 2020, NeurIPS-20 Workshop on Scalability, Privacy, and Security in Federated Learning (SpicyFL))
3. Robust learning under clean-label attack

   Blum, A.; Hanneke, S.; Qian, J.; Shao, H. (January 2021, Conference on Learning Theory)

   Belkin, M.; Kpotufe, S. (Ed.)

   We study the problem of robust learning under clean-label data-poisoning attacks, where the at-tacker injects (an arbitrary set of) correctly-labeled examples to the training set to fool the algorithm into making mistakes on specific test instances at test time. The learning goal is to minimize the attackable rate (the probability mass of attackable test instances), which is more difficult than optimal PAC learning. As we show, any robust algorithm with diminishing attackable rate can achieve the optimal dependence on ε in its PAC sample complexity, i.e., O(1/ε). On the other hand, the attackable rate might be large even for some optimal PAC learners, e.g., SVM for linear classifiers. Furthermore, we show that the class of linear hypotheses is not robustly learnable when the data distribution has zero margin and is robustly learnable in the case of positive margin but requires sample complexity exponential in the dimension. For a general hypothesis class with bounded VC dimension, if the attacker is limited to add at most t >0 poison examples, the optimal robust learning sample complexity grows almost linearly with t. 

   more » « less
4. Optimal Attack and Defense for Reinforcement Learning

   https://doi.org/10.1609/aaai.v38i13.29346  

   McMahan, Jeremy; Wu, Young; Zhu, Xiaojin; Xie, Qiaomin (March 2024, Proceedings of the AAAI Conference on Artificial Intelligence)

   To ensure the usefulness of Reinforcement Learning (RL) in real systems, it is crucial to ensure they are robust to noise and adversarial attacks. In adversarial RL, an external attacker has the power to manipulate the victim agent's interaction with the environment. We study the full class of online manipulation attacks, which include (i) state attacks, (ii) observation attacks (which are a generalization of perceived-state attacks), (iii) action attacks, and (iv) reward attacks. We show the attacker's problem of designing a stealthy attack that maximizes its own expected reward, which often corresponds to minimizing the victim's value, is captured by a Markov Decision Process (MDP) that we call a meta-MDP since it is not the true environment but a higher level environment induced by the attacked interaction. We show that the attacker can derive optimal attacks by planning in polynomial time or learning with polynomial sample complexity using standard RL techniques. We argue that the optimal defense policy for the victim can be computed as the solution to a stochastic Stackelberg game, which can be further simplified into a partially-observable turn-based stochastic game (POTBSG). Neither the attacker nor the victim would benefit from deviating from their respective optimal policies, thus such solutions are truly robust. Although the defense problem is NP-hard, we show that optimal Markovian defenses can be computed (learned) in polynomial time (sample complexity) in many scenarios. 

   more » « less
5. Detection of Ransomware Attack Using Deep Learning

   https://doi.org/10.1109/DSC61021.2023.10354186  

   Jemal, Muna; Lo, Dan Chia-Tien (November 2023, IEEE)