有这样的假朋友，谁能注意到错误？
With False Friends Like These, Who Can Notice Mistakes?
摘要：
在机器学习中，由显式对手制作的对抗性示例引起了人们的极大关注。然而，潜在的假朋友所带来的安全风险在很大程度上被忽视了。在本文中，我们揭示了虚伪的例子的威胁-输入最初被错误分类，但被虚假的朋友干扰，以迫使正确的预测。虽然这种扰动的例子似乎是无害的，但我们第一次指出，它们可能被恶意地用来掩盖不合格的错误（即，不像要求的那样好）模型。一旦部署人员相信了这种虚伪的性能，并将“表现良好”的模型应用到实际应用中，即使在良性环境中也可能发生意外的故障。更严重的是，这种安全风险似乎无处不在：我们发现许多类型的不合格模型很容易受到多个数据集上的虚伪示例的影响。此外，我们提供了第一次尝试，以描述的威胁与度量称为虚伪的风险，并试图规避它通过几个对策。结果表明，对策的有效性，而风险仍然是不可忽视的，即使在自适应鲁棒训练。
英文摘要：
Adversarial examples crafted by an explicit adversary have attracted significant attention in machine learning. However, the security risk posed by a potential false friend has been largely overlooked. In this paper, we unveil the threat of hypocritical examples -- inputs that are originally misclassified yet perturbed by a false friend to force correct predictions. While such perturbed examples seem harmless, we point out for the first time that they could be maliciously used to conceal the mistakes of a substandard (i.e., not as good as required) model during an evaluation. Once a deployer trusts the hypocritical performance and applies the "well-performed" model in real-world applications, unexpected failures may happen even in benign environments. More seriously, this security risk seems to be pervasive: we find that many types of substandard models are vulnerable to hypocritical examples across multiple datasets. Furthermore, we provide the first attempt to characterize the threat with a metric called hypocritical risk and try to circumvent it via several countermeasures. Results demonstrate the effectiveness of the countermeasures, while the risk remains non-negligible even after adaptive robust training.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
