标题： 正则化可以缓解中毒攻击：基于多目标双层优化的新分析 显示英文标题

标题： Regularisation Can Mitigate Poisoning Attacks: A Novel Analysis Based on Multiobjective Bilevel Optimisation

摘要： 机器学习（ML）算法容易受到中毒攻击，其中一部分训练数据被篡改以故意降低算法的性能。 最优中毒攻击可以被表述为双层优化问题，有助于在最坏情况下评估学习算法的鲁棒性。 然而，目前针对具有超参数的算法的攻击通常假设这些超参数保持不变，忽略了攻击对其的影响。 我们表明，这种方法会导致对算法鲁棒性的过于悲观的看法。 我们提出了一种新的最优攻击公式，通过将攻击建模为多目标双层优化问题，考虑攻击对超参数的影响。 我们将这种新的攻击公式应用于使用$L_2$正则化的机器学习分类器，并表明，与之前报道的结果相反，$L_2$正则化增强了学习算法的稳定性并有助于缓解攻击。 我们在不同数据集上的实证评估证实了先前策略的局限性，证明了使用$L_2$正则化来减弱中毒攻击影响的好处，并展示了正则化超参数如何随着中毒点的比例增加而增加。 显示英文摘要

摘要： Machine Learning (ML) algorithms are vulnerable to poisoning attacks, where a fraction of the training data is manipulated to deliberately degrade the algorithms' performance. Optimal poisoning attacks, which can be formulated as bilevel optimisation problems, help to assess the robustness of learning algorithms in worst-case scenarios. However, current attacks against algorithms with hyperparameters typically assume that these hyperparameters remain constant ignoring the effect the attack has on them. We show that this approach leads to an overly pessimistic view of the robustness of the algorithms. We propose a novel optimal attack formulation that considers the effect of the attack on the hyperparameters by modelling the attack as a multiobjective bilevel optimisation problem. We apply this novel attack formulation to ML classifiers using $L_2$ regularisation and show that, in contrast to results previously reported, $L_2$ regularisation enhances the stability of the learning algorithms and helps to mitigate the attacks. Our empirical evaluation on different datasets confirms the limitations of previous strategies, evidences the benefits of using $L_2$ regularisation to dampen the effect of poisoning attacks and shows how the regularisation hyperparameter increases with the fraction of poisoning points.