7. Adversarial Learning Introduction

• random search -> poor

• evolutionary algos -> works

• backprop -> performant

  • needs differentiable f!!!

• if it is continuous

• and for all x

  • limes from right = limes from left…

• find theta ( parameters of NN)

• so that

• average loss (1/N) over all training dataset instances

• is minimized

• compute the gradient over the N training samples

• yields a dim(theta) dimensional gradient vector ([dL/ dT1, dL/dT2, …, dL/dTn])

• points in direction of largest increase of 1/N SUM loss

• -> find parameters via iterative update

• new weights

• =

• old weights

• -

• learning rate

• *

• gradient

• randomly from normal distribution

• find some delta such that

• f(x + delat) != y

• -> find deviation to the input so that it is classified incorrectly

• delta is small

  • ||d||_2 < epsilon

• x+d does not exceed feature domain

  • e.g. x+d element [0,1] for images…

• targeted attack

  • have f

  • classify x+d as not y

  • but some specific other class y’

• untargeted attack

  • have f

  • classify x+d as not y

  • but some arbitrary other class

• find delta that minimizes

• loss of diverted input (x+d) w.r.t. target class

• +

• size of diversion ||d||_2 times trade-off factor lambda

• maximize the loss for diverted input (x+d) w.r.t. correct class

  • -> here, we minimize the negative log likelihood!!!

• also considering the size of delta (with tradeoff factor lambda)

targeted:

untargeted:

• no, not necessarily-> can also use some other function..

• merge x+d simply into x

• use the same for targeted and untargeted

  • when the context is clear…

  • y’, y -> y

-> Gradient descent with d initialized as 0-vector

• use gradient w.r.t x

• -> how must x (the input) change so that the attacker loss is minimized… meaning:

  • targeted -> minimize loss w.r.t. target class

  • untargeted -> minimize negative loss w.r.t. actual class -> maximize error classifying as correct class…

• if negative -> increase x to minimize loss

• if positive -> decrease x to minimize loss

• both deep and shallow susceptible

• the larger the weight decay lambda -> the larger the average required distortion

  • possible defense

  • but: trade off between accuracy and robustness…

• adversarial examples transfer between models

• white box attack…