The paper gives closed-form optimal data-poisoning attacks on PCA, showing the worst-case subspace rotation depends only on the k-th and (k+1)-th singular values and the attacker's energy budget.
On the Adversarial Robustness of Multivariate Robust Estimation
1 Pith paper cite this work. Polarity classification is still indexing.
1
Pith paper citing it
abstract
In this paper, we investigate the adversarial robustness of multivariate $M$-Estimators. In the considered model, after observing the whole dataset, an adversary can modify all data points with the goal of maximizing inference errors. We use adversarial influence function (AIF) to measure the asymptotic rate at which the adversary can change the inference result. We first characterize the adversary's optimal modification strategy and its corresponding AIF. From the defender's perspective, we would like to design an estimator that has a small AIF. For the case of joint location and scale estimation problem, we characterize the optimal $M$-estimator that has the smallest AIF. We further identify a tradeoff between robustness against adversarial modifications and robustness against outliers, and derive the optimal $M$-estimator that achieves the best tradeoff.
fields
eess.SP 1years
2019 1verdicts
CONDITIONAL 1representative citing papers
citing papers explorer
-
On the Adversarial Robustness of Subspace Learning
The paper gives closed-form optimal data-poisoning attacks on PCA, showing the worst-case subspace rotation depends only on the k-th and (k+1)-th singular values and the attacker's energy budget.