arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2602.01658cs.LGcs.AI
收藏

高维离线Bandits的高效对抗攻击

Efficient Adversarial Attacks on High-dimensional Offline Bandits

Department of Computer Engineering, Sharif University of Technology(技术学院计算机工程系)

Seyed Mohammad Hadi Hosseini, Amir Najafi, Mahdieh Soleymani Baghshah

AI总结:

研究离线bandit训练在奖励模型被对抗扰动时的脆弱性,提出高维威胁模型,证明维度增加时攻击所需扰动范数减小,实验验证了针对性攻击的高成功率。

摘要:

Bandit算法最近成为评估机器学习模型(包括生成图像模型和大语言模型)的强大工具,通过高效识别表现最佳的候选者而无需详尽比较。这些方法通常依赖于奖励模型(常在Hugging Face等平台上以公共权重发布)向bandit提供反馈。在线评估昂贵且需要重复试验,而使用记录数据的离线评估已成为有吸引力的替代方案。然而,离线bandit评估的对抗鲁棒性在很大程度上尚未被探索,特别是当攻击者在bandit训练之前扰动奖励模型(而非训练数据)时。在这项工作中,我们通过理论和实证研究离线bandit训练对奖励模型对抗操纵的脆弱性来填补这一空白。我们引入了一种新颖的威胁模型,其中攻击者利用高维环境中的离线数据劫持bandit的行为。从线性奖励函数开始,扩展到非线性模型如ReLU神经网络,我们研究了用于生成模型评估的两个Hugging Face评估器上的攻击:一个测量美学质量,另一个评估组合对齐。我们的结果表明,即使对奖励模型权重进行微小、不可察觉的扰动,也能显著改变bandit的行为。从理论角度来看,我们证明了一个显著的高维效应:随着输入维度的增加,成功攻击所需的扰动范数减小,使得现代应用如图像评估尤其脆弱。大量实验证实,简单的随机扰动无效,而精心设计的针对性攻击实现了近乎完美的攻击成功率。

英文摘要:

Bandit algorithms have recently emerged as a powerful tool for evaluating machine learning models, including generative image models and large language models, by efficiently identifying top-performing candidates without exhaustive comparisons. These methods typically rely on a reward model, often distributed with public weights on platforms such as Hugging Face, to provide feedback to the bandit. While online evaluation is expensive and requires repeated trials, offline evaluation with logged data has become an attractive alternative. However, the adversarial robustness of offline bandit evaluation remains largely unexplored, particularly when an attacker perturbs the reward model (rather than the training data) prior to bandit training. In this work, we fill this gap by investigating, both theoretically and empirically, the vulnerability of offline bandit training to adversarial manipulations of the reward model. We introduce a novel threat model in which an attacker exploits offline data in high-dimensional settings to hijack the bandit's behavior. Starting with linear reward functions and extending to nonlinear models such as ReLU neural networks, we study attacks on two Hugging Face evaluators used for generative model assessment: one measuring aesthetic quality and the other assessing compositional alignment. Our results show that even small, imperceptible perturbations to the reward model's weights can drastically alter the bandit's behavior. From a theoretical perspective, we prove a striking high-dimensional effect: as input dimensionality increases, the perturbation norm required for a successful attack decreases, making modern applications such as image evaluation especially vulnerable. Extensive experiments confirm that naive random perturbations are ineffective, whereas carefully targeted perturbations achieve near-perfect attack success rates ...

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑