[论文解读] Strong Black-box Adversarial Attacks on Unsupervised Machine Learning Models

Anshuman Chhabra, Abhishek Roy+1 more|arXiv (Cornell University)|Jan 28, 2019

Adversarial Robustness in Machine Learning参考文献 13被引用 5

一句话总结

本文提出一种针对无监督机器学习模型（特别是聚类算法）的强效迭代黑盒对抗攻击，通过生成扰动使任何聚类结果均被误导，无论使用何种算法。该攻击在真实世界数据集上对四种聚类算法均表现出高度可迁移性，揭示了无监督模型在对抗性操纵下的关键脆弱性。

ABSTRACT

Machine Learning (ML) and Deep Learning (DL) models have achieved state-of-the-art performance on multiple learning tasks, from vision to natural language modelling. With the growing adoption of ML and DL to many areas of computer science, recent research has also started focusing on the security properties of these models. There has been a lot of work undertaken to understand if (deep) neural network architectures are resilient to black-box adversarial attacks which craft perturbed input samples that fool the classifier without knowing the architecture used. Recent work has also focused on the transferability of adversarial attacks and found that adversarial attacks are generally easily transferable between models, datasets, and techniques. However, such attacks and their analysis have not been covered from the perspective of unsupervised machine learning algorithms. In this paper, we seek to bridge this gap through multiple contributions. We first provide a strong (iterative) black-box adversarial attack that can craft adversarial samples which will be incorrectly clustered irrespective of the choice of clustering algorithm. We choose 4 prominent clustering algorithms, and a real-world dataset to show the working of the proposed adversarial algorithm. Using these clustering algorithms we also carry out a simple study of cross-technique adversarial attack transferability.

研究动机与目标

• 探究无监督机器学习模型（特别是聚类算法）对黑盒对抗攻击的脆弱性。
• 开发一种稳健的迭代黑盒对抗攻击，生成对多种聚类算法均有效的扰动。
• 评估对抗攻击在不同聚类技术及数据集间的可迁移性。
• 证明对抗样本可始终误导聚类结果，无论底层算法选择如何。

提出的方法

• 该攻击采用迭代优化过程，生成最大化聚类结果误分类的对抗扰动。
• 其在黑盒设置下运行，无需访问模型架构或训练数据。
• 该方法通过操纵输入特征，使样本被错误地分配至不正确的聚类，从而针对聚类目标实施攻击。
• 使用四种主流聚类算法——K-Means、DBSCAN、层次聚类（Agglomerative Clustering）和谱聚类（Spectral Clustering）——验证攻击的有效性。
• 在真实世界数据集上评估该攻击，以证明其实际可行性与鲁棒性。
• 通过测量对抗样本在不同聚类技术中的成功率来评估可迁移性。

实验结果

研究问题

• RQ1 在无法访问模型内部结构的情况下，黑盒对抗攻击是否能有效误导无监督聚类模型？
• RQ2 所提出的迭代攻击在多种聚类算法上的有效性如何？
• RQ3 对抗样本在不同聚类技术之间的可迁移性达到何种程度？
• RQ4 当聚类算法改变时，该攻击是否仍保持有效性，无论算法本身的固有特性如何？

主要发现

• 所提出的黑盒对抗攻击在真实世界数据集上成功误导了所有四种测试的聚类算法，表现出高度有效性。
• 该攻击在不同聚类技术间保持强劲性能，表明算法间具有高度可迁移性。
• 该方法生成的对抗样本始终导致错误聚类，无论使用何种聚类算法。
• 攻击的迭代特性使输入特征的精确操控成为可能，从而实现目标聚类错误。