CIF: Small: Adversarially Robust Statistical Inference

University Of California-Davis, Davis CA

Investigators

Abstract

With machine learning and statistical inference algorithms increasingly used in safety-critical and security-related applications, there arises a pressing need to study the robustness of these algorithms in adversarial environments. The large existing body of work on robust statistical inference mainly addresses issues such as outliers or model uncertainties. However, in many recent data analytical applications (including safety-critical applications), one faces situations which are more severe than those addressed thus far. One such scenario occurs when an adversary can observe the whole data stream, and then devise its attack vector to modify all entries in the data set so as to inflict maximum inference errors. The existence of such powerful adversaries calls for new models and methodologies to carry out adversary-robust inference. The successful development of these models and methodologies will expand scenarios where machine learning algorithms can be safely applied, and thus expand the application of machine learning into safety-critical domains. This project will support educational activities to attract members from underrepresented groups into research. In this project, the investigator will address robust inference in the presence of powerful adversaries. In particular, after the data points are generated, the adversary can observe the whole dataset, and then modify all data points with the hope of inflicting maximum inference errors. This project aims to answer the following questions: 1) What is the attacker's optimal attack strategy in choosing the attack vectors?; 2) What are the possible impacts of these attacks?; and 3) How should inference algorithms be designed to minimize the impact of an attack? These questions will be addressed through two related thrusts. In Thrust 1, the fundamental limits of adversarially-robust inference algorithms will be characterized; this include characterizing the optimal attack strategy and its impacts on the inference performance. The investigator will then seek to identify inference algorithms that minimize the corresponding impact. In Thrust 2, the adversarial robustness of practical inference algorithms will be studied. In practice, many inference problems are formulated as optimization problems, which are then solved using various optimization algorithms. The implementation of these optimization algorithms are often distributed in nature, and this introduces several new threats that will be addressed in this thrust. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.