arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2107.03022cs.LG
收藏

由噪声损失函数重构测试标签

Reconstructing Test Labels from Noisy Loss Functions

Amazon(亚马逊)

Abhinav Aggarwal, Shiva Prasad Kasiviswanathan, Zekun Xu, Oluwaseyi Feyisetan, Nathanael Teissier

摘要:

机器学习分类器依赖于损失函数进行性能评估,通常是在私有(隐藏)数据集上。在最近的一系列研究中,标签推理被引入作为仅从在所选预测向量处评估的(可能扰动的)交叉熵损失函数值重建该私有数据集的地面真值标签的问题(没有对隐藏数据集的任何其他访问)。在本文中,我们正式研究的必要条件和充分条件下,标签推断是可能的\emph{any}(噪声)损失函数值。使用工具,从分析数论,我们表明,广泛的一类常用的损失函数,包括一般Bregman分歧为基础的损失和多类交叉熵与常见的激活函数,如sigmoid和softmax,它是可能的设计标签推理攻击,即使成功的任意噪声水平,并只使用一个单一的查询从对手。我们正式研究了标签推理的计算复杂性,并表明,虽然在一般情况下,为这些攻击设计对抗性预测向量是co-NP-hard的,但一旦我们拥有这些向量,攻击也可以通过对任何神经网络模型的轻量级增强来进行,使它们看起来是良性的,难以检测。本文中的观察提供了对现代机器学习固有漏洞的更深入理解,并可用于设计未来值得信赖的机器学习。

英文摘要:

Machine learning classifiers rely on loss functions for performance evaluation, often on a private (hidden) dataset. In a recent line of research, label inference was introduced as the problem of reconstructing the ground truth labels of this private dataset from just the (possibly perturbed) cross-entropy loss function values evaluated at chosen prediction vectors (without any other access to the hidden dataset). In this paper, we formally study the necessary and sufficient conditions under which label inference is possible from \emph{any} (noisy) loss function value. Using tools from analytical number theory, we show that a broad class of commonly used loss functions, including general Bregman divergence-based losses and multiclass cross-entropy with common activation functions like sigmoid and softmax, it is possible to design label inference attacks that succeed even for arbitrary noise levels and using only a single query from the adversary. We formally study the computational complexity of label inference and show that while in general, designing adversarial prediction vectors for these attacks is co-NP-hard, once we have these vectors, the attacks can also be carried out through a lightweight augmentation to any neural network model, making them look benign and hard to detect. The observations in this paper provide a deeper understanding of the vulnerabilities inherent in modern machine learning and could be used for designing future trustworthy ML.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑