Adversarial Label Flips Attack on Support Vector Machines

Transcription

1 Adversarial Label Flips Attack on Support Vector Machines Han Xiao, Huang Xiao, Claudia Eckert Institute of Informatics TU München August 26, 2012

2 Overview 1 Causative Attack 2 Problem Formulation 3 Label Flip Attack on SVMs 4 Experiment 5 Summary H.Xiao (TUM) Attack on SVM August 26, / 18

3 Learner meets evil teachers What if haters dominate? Are they going to subvert the learning algorithm? And to what extent? H.Xiao (TUM) Attack on SVM August 26, / 18

4 Learner meets evil teachers What if haters dominate? Are they going to subvert the learning algorithm? And to what extent? H.Xiao (TUM) Attack on SVM August 26, / 18

5 Motivation Problem How to induce adversarial label noise to the training data so that the classification algorithm will have maximal error rate? Motivation crowd labeled training data contains adversarial noise previous work assume that labels missing at random, or follow some distributions little is known on adversarial label noise improve the robustness of learner H.Xiao (TUM) Attack on SVM August 26, / 18

6 Motivation Problem How to induce adversarial label noise to the training data so that the classification algorithm will have maximal error rate? Motivation crowd labeled training data contains adversarial noise previous work assume that labels missing at random, or follow some distributions little is known on adversarial label noise improve the robustness of learner H.Xiao (TUM) Attack on SVM August 26, / 18

7 Notations Input space: X R D Response space: Y := { 1,1} Instance: x X is a D-dimensional vector Hypothesis space: H Classification hypothesis: f H, f : X R Negative set (begnin): X := {x X sign(f(x)) = 1} Positive set (malicious): X + := {x X sign(f(x)) = +1} Loss function: V : Y Y R 0+ H.Xiao (TUM) Attack on SVM August 26, / 18

8 Notations Input space: X R D Response space: Y := { 1,1} Instance: x X is a D-dimensional vector Hypothesis space: H Classification hypothesis: f H, f : X R Negative set (begnin): X := {x X sign(f(x)) = 1} Positive set (malicious): X + := {x X sign(f(x)) = +1} Loss function: V : Y Y R 0+ H.Xiao (TUM) Attack on SVM August 26, / 18

9 Notations Input space: X R D Response space: Y := { 1,1} Instance: x X is a D-dimensional vector Hypothesis space: H Classification hypothesis: f H, f : X R Negative set (begnin): X := {x X sign(f(x)) = 1} Positive set (malicious): X + := {x X sign(f(x)) = +1} Loss function: V : Y Y R 0+ H.Xiao (TUM) Attack on SVM August 26, / 18

10 Notations Input space: X R D Response space: Y := { 1,1} Instance: x X is a D-dimensional vector Hypothesis space: H Classification hypothesis: f H, f : X R Negative set (begnin): X := {x X sign(f(x)) = 1} Positive set (malicious): X + := {x X sign(f(x)) = +1} Loss function: V : Y Y R 0+ H.Xiao (TUM) Attack on SVM August 26, / 18

11 Classification Algorithm Tikhonov Regularization Problem Problem Given a training set S := {(x i,y i ) x i X, y i Y} n. Find the classifier f S H that performs best on some test set T. Solving Tikhonov regularization problem f S := argmin f γ n V (y i,f(x i ))+ f 2 H, where γ R 0+ is a fixed parameter for quantifying the trade off. H.Xiao (TUM) Attack on SVM August 26, / 18

12 Label Flips Attack Given a training set, the adversary contaminates the training data through flipping labels. Adversarial Label Flip Attack Find a combination of label flips under a given budget so that a classifier trained on such data will have maximal classification error on some test data. H.Xiao (TUM) Attack on SVM August 26, / 18

13 A Bilevel Formulation Training set: S := {(x i,y i ) x i X, y i Y} n Indicator: z i {0,1},i = 1,...,n Tainted label: y i := y i(1 2z i ) so that if z i = 1 then y i = y i (i.e. flipped), otherwise y i = y i Tainted training set: S := {(x i,y i )} Flipping cost: c i R 0+ Finding the optimal label flips Given S, a test set T and a budget C, solve max V (y,f S (x)), z (x,y) T s.t. f S argmin f γ n V ( y i,f(x i ) ) + f 2 H, n c i z i C, z i {0,1}. H.Xiao (TUM) Attack on SVM August 26, / 18

14 A Bilevel Formulation Training set: S := {(x i,y i ) x i X, y i Y} n Indicator: z i {0,1},i = 1,...,n Tainted label: y i := y i(1 2z i ) so that if z i = 1 then y i = y i (i.e. flipped), otherwise y i = y i Tainted training set: S := {(x i,y i )} Flipping cost: c i R 0+ Finding the optimal label flips Given S, a test set T and a budget C, solve max V (y,f S (x)), z (x,y) T s.t. f S argmin f γ n V ( y i,f(x i ) ) + f 2 H, n c i z i C, z i {0,1}. H.Xiao (TUM) Attack on SVM August 26, / 18

15 A Bilevel Formulation Training set: S := {(x i,y i ) x i X, y i Y} n Indicator: z i {0,1},i = 1,...,n Tainted label: y i := y i(1 2z i ) so that if z i = 1 then y i = y i (i.e. flipped), otherwise y i = y i Tainted training set: S := {(x i,y i )} Flipping cost: c i R 0+ Finding the optimal label flips Given S, a test set T and a budget C, solve max V (y,f S (x)), z (x,y) T s.t. f S argmin f γ n V ( y i,f(x i ) ) + f 2 H, n c i z i C, z i {0,1}. H.Xiao (TUM) Attack on SVM August 26, / 18

16 A Bilevel Formulation Training set: S := {(x i,y i ) x i X, y i Y} n Indicator: z i {0,1},i = 1,...,n Tainted label: y i := y i(1 2z i ) so that if z i = 1 then y i = y i (i.e. flipped), otherwise y i = y i Tainted training set: S := {(x i,y i )} Flipping cost: c i R 0+ Finding the optimal label flips Given S, a test set T and a budget C, solve max V (y,f S (x)), z (x,y) T s.t. f S argmin f γ n V ( y i,f(x i ) ) + f 2 H, n c i z i C, z i {0,1}. H.Xiao (TUM) Attack on SVM August 26, / 18

17 Relaxing the Problem Difficulties even a linear bilevel problem can be hard exhaustive search on all combinations is prohibitive Idea Combining these two conflict objective functions into one. H.Xiao (TUM) Attack on SVM August 26, / 18

18 A Relaxed Formulation Define an auxiliary function A and B be two sets of labeled instances, define g(b,f A ) := γ V (y,f A (x)) (x,y) B Finding the near-optimal label flips: }{{} trained on A measured on B min g(s,f S ) g(s,f S ), z n s.t. c i z i C, z i {0,1}. + f A 2 H H.Xiao (TUM) Attack on SVM August 26, / 18

19 A Relaxed Formulation Refine the objective function 1 Construct a new set U := {(x i,y i )} 2n as follows (x i,y i ) S, i = 1,...,n, x i := x i n, i = n+1,...,2n, y i := y i n i = n+1,...,2n. 2 Introduce q i {0,1},i = 1,...,2n for each element in U, where q i = 1 if (x i,y i ) S. 3 Replace S by U in g(s,f S ) g(s,f S ), we obtain min q,f s.t. γ 2n 2n i=n+1 q i [V (y i,f(x i )) V (y i,f S (x i ))]+ f 2 H, c i q i C, q i +q i+n = 1, i = 1,...,n. q i {0,1}, i = 1,...,2n. H.Xiao (TUM) Attack on SVM August 26, / 18

20 A Relaxed Formulation Refine the objective function 1 Construct a new set U := {(x i,y i )} 2n as follows (x i,y i ) S, i = 1,...,n, x i := x i n, i = n+1,...,2n, y i := y i n i = n+1,...,2n. 2 Introduce q i {0,1},i = 1,...,2n for each element in U, where q i = 1 if (x i,y i ) S. 3 Replace S by U in g(s,f S ) g(s,f S ), we obtain min q,f s.t. γ 2n 2n i=n+1 q i [V (y i,f(x i )) V (y i,f S (x i ))]+ f 2 H, c i q i C, q i +q i+n = 1, i = 1,...,n. q i {0,1}, i = 1,...,2n. H.Xiao (TUM) Attack on SVM August 26, / 18

21 A Relaxed Formulation Refine the objective function 1 Construct a new set U := {(x i,y i )} 2n as follows (x i,y i ) S, i = 1,...,n, x i := x i n, i = n+1,...,2n, y i := y i n i = n+1,...,2n. 2 Introduce q i {0,1},i = 1,...,2n for each element in U, where q i = 1 if (x i,y i ) S. 3 Replace S by U in g(s,f S ) g(s,f S ), we obtain min q,f s.t. γ 2n 2n i=n+1 q i [V (y i,f(x i )) V (y i,f S (x i ))]+ f 2 H, c i q i C, q i +q i+n = 1, i = 1,...,n. q i {0,1}, i = 1,...,2n. H.Xiao (TUM) Attack on SVM August 26, / 18

22 Label Flip Attack on SVMs SVM can be formulated as Tikhonov regularization problem n γ ξ i w 2 min w,ξ,b s.t. y i (w x i +b) 1 ξ i, ξ i 0, i = 1,...,n, where ξ i is the hinge loss of (x i,y i ) resulting from f S. Denote ǫ i the hinge loss of (x i,y i ) resulting from the tainted classifier f S min q,w,ǫ,b γ 2n q i (ǫ i ξ i )+ 1 2 w 2 s.t. y i (w x i +b) 1 ǫ i, ǫ i 0, i = 1,...,2n, 2n c i q i C, i=n+1 q i +q i+n = 1, i = 1,...,n, q i {0,1}, i = 1,...,2n. H.Xiao (TUM) Attack on SVM August 26, / 18

23 Label Flip Attack on SVMs SVM can be formulated as Tikhonov regularization problem n γ ξ i w 2 min w,ξ,b s.t. y i (w x i +b) 1 ξ i, ξ i 0, i = 1,...,n, where ξ i is the hinge loss of (x i,y i ) resulting from f S. Denote ǫ i the hinge loss of (x i,y i ) resulting from the tainted classifier f S min q,w,ǫ,b γ 2n q i (ǫ i ξ i )+ 1 2 w 2 s.t. y i (w x i +b) 1 ǫ i, ǫ i 0, i = 1,...,2n, 2n c i q i C, i=n+1 q i +q i+n = 1, i = 1,...,n, q i {0,1}, i = 1,...,2n. H.Xiao (TUM) Attack on SVM August 26, / 18

24 Label Flip Attack on SVMs Alternately solving QP and LP min w,ǫ,b γ 2n q i ǫ i w 2 (1) s.t. y i (w x i +b) 1 ǫ i, ǫ i 0, i = 1,...,2n. min q s.t. γ 2n 2n i=n+1 q i (ǫ i ξ i ) (2) c i q i C, q i +q i+n = 1, i = 1,...,n, 0 q i 1, i = 1,...,2n. H.Xiao (TUM) Attack on SVM August 26, / 18

25 Experiment Design Adversarial cost c i := 1 for all labels Original training and test sets are balanced Train SVM (LIBSVM) on the tainted training set Worst performance is % error rate (i.e. random guess) Baselines Random introducing label noise from nonadversarial perspective Nearest a thoughtless labeler fails to distinguish instances on the border Furthest malicious labeler deliberately gives wrong instances H.Xiao (TUM) Attack on SVM August 26, / 18

26 Experiment Design Adversarial cost c i := 1 for all labels Original training and test sets are balanced Train SVM (LIBSVM) on the tainted training set Worst performance is % error rate (i.e. random guess) Baselines Random introducing label noise from nonadversarial perspective Nearest a thoughtless labeler fails to distinguish instances on the border Furthest malicious labeler deliberately gives wrong instances H.Xiao (TUM) Attack on SVM August 26, / 18

27 Results on Synthetic Data Train: 100, flip:20, test 800 (a) Synthetic data (b) No Flips (c) Random (d) Nearst (e) Furthest (f) ALFA Linear pattern Linear SVM 1.8% 1.9% 6.9% 9.5% 21.8% RBF SVM 3.2% 4.0% 3.5% 26.5% 32.4% Parabolic pattern Linear SVM 23.5% 28.8% 29.2%.5% 48.0% RBF SVM 5.1% 9.4% 10.1% 12.9%.8% H.Xiao (TUM) Attack on SVM August 26, / 18

28 Results on 10 Data Sets Train: 200, flip:1,...,60, test 800. ( : linear, : RBF) Rand Nearest Furthest ALFA 60 a9a 60 acoustic 55 connect 4 55 covtype dna gisette 60 ijcnn1 70 letter 60 seismic 60 satimage a9a 60 acoustic 55 connect 4 55 covtype dna gisette ijcnn1 70 letter 60 seismic 60 satimage H.Xiao (TUM) Attack on SVM August 26, / 18

29 Required Cost for % Error Rate Data sets Rand. Near. Furt. ALFA Rand. Near. Furt. ALFA Rand. Near. Furt. ALFA SVM with linear kernel a9a acoustic connect covtype dna gisette ijcnn letter seismic satimage SVM with RBF kernel a9a acoustic connect covtype dna gisette ijcnn letter seismic satimage H.Xiao (TUM) Attack on SVM August 26, / 18

30 Summary 1 a framework for adversarial label flips attack 2 more aggressive than random noise and other baselines 3 also effective on robust label-noise SVM (Battista B. etc., ACML 11) 4 can be extended to regression, active learning scenarios H.Xiao (TUM) Attack on SVM August 26, / 18