通过数据删除与复制对贝叶斯推断进行投毒
Poisoning Bayesian Inference via Data Deletion and Replication
AI总结：
本文提出通过策略性删除和复制观测数据来攻击通用贝叶斯推断的白盒投毒方法，能够将后验导向目标分布并实现仅破坏特定推断的外科手术式投毒。
摘要：
对抗性机器学习（AML）领域的研究表明，统计模型容易受到恶意篡改数据的影响。然而，尽管贝叶斯机器学习模型取得了进展，大多数AML研究仍集中在经典技术上。因此，我们专注于将白盒模型投毒范式扩展到攻击通用贝叶斯推断，突出其在对抗环境中的脆弱性。我们开发了一套攻击方法，允许攻击者通过策略性地删除和复制真实观测数据，将贝叶斯后验分布导向目标分布，即使只能获得后验的采样访问权限。我们证明了这些算法的解析性质，并在合成场景和真实世界场景中对其性能进行了实证检验。攻击者只需付出相对较少的努力，就能实质性地改变贝叶斯模型的信念，并且通过接受更多风险，可以将这些信念塑造成自己期望的形态。通过精心构造对抗性后验，可以实现外科手术式的投毒，使得只有目标推断被破坏，而其他推断受到最小程度的干扰。
英文摘要：
Research in adversarial machine learning (AML) has shown that statistical models are vulnerable to maliciously altered data. However, despite advances in Bayesian machine learning models, most AML research remains concentrated on classical techniques. Therefore, we focus on extending the white-box model poisoning paradigm to attack generic Bayesian inference, highlighting its vulnerability in adversarial contexts. A suite of attacks are developed that allow an attacker to steer the Bayesian posterior toward a target distribution through the strategic deletion and replication of true observations, even when only sampling access to the posterior is available. Analytic properties of these algorithms are proven and their performance is empirically examined in both synthetic and real-world scenarios. With relatively little effort, the attacker is able to substantively alter the Bayesian's beliefs and, by accepting more risk, they can mold these beliefs to their will. By carefully constructing the adversarial posterior, surgical poisoning is achieved such that only targeted inferences are corrupted and others are minimally disturbed.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
