Hard Work Does Not Always Pay Off: Poisoning Attacks on Neural Architecture Search

Fuente: arXiv

Saved in:

Bibliographic Details
Main Authors:	Coalson, Zachary, Wang, Huazheng, Wu, Qingyun, Hong, Sanghyun
Format:	Preprint
Published:	2024
Subjects:	Machine Learning Cryptography and Security
Online Access:	Acceder al recurso
Tags:	Add Tag No Tags, Be the first to tag this record!

_version_	1866918240157958144
author	Coalson, Zachary Wang, Huazheng Wu, Qingyun Hong, Sanghyun
author_facet	Coalson, Zachary Wang, Huazheng Wu, Qingyun Hong, Sanghyun
contents	We study the robustness of data-centric methods to find neural network architectures, known as neural architecture search (NAS), against data poisoning. To audit this robustness, we design a poisoning framework that enables the systematic evaluation of the ability of NAS to produce architectures under data corruption. Our framework examines four off-the-shelf NAS algorithms, representing different approaches to architecture discovery, against four data poisoning attacks, including one we tailor specifically for NAS. In our evaluation with the CIFAR-10 and CIFAR-100 benchmarks, we show that NAS is \emph{seemingly} robust to data poisoning, showing marginal accuracy drops even under large poisoning budgets. However, we demonstrate that when considering NAS algorithms designed to achieve a few percentage points of accuracy gain, this expected improvement can be substantially diminished under data poisoning. We also show that the reduction varies across NAS algorithms and analyze the factors contributing to their robustness. Our findings are: (1) Training-based NAS algorithms are the least robust due to their reliance on data. (2) Training-free NAS approaches are the most robust but produce architectures that perform similarly to random selections from the search space. (3) NAS algorithms can produce architectures with improved accuracy, even when using out-of-distribution data like MNIST. We lastly discuss potential countermeasures. Our code is available at: https://github.com/ztcoalson/NAS-Robustness-to-Data-Poisoning
format	Preprint
id	arxiv_https___arxiv_org_abs_2405_06073
institution	arXiv
publishDate	2024
record_format	arxiv
spellingShingle	Hard Work Does Not Always Pay Off: Poisoning Attacks on Neural Architecture Search Coalson, Zachary Wang, Huazheng Wu, Qingyun Hong, Sanghyun Machine Learning Cryptography and Security We study the robustness of data-centric methods to find neural network architectures, known as neural architecture search (NAS), against data poisoning. To audit this robustness, we design a poisoning framework that enables the systematic evaluation of the ability of NAS to produce architectures under data corruption. Our framework examines four off-the-shelf NAS algorithms, representing different approaches to architecture discovery, against four data poisoning attacks, including one we tailor specifically for NAS. In our evaluation with the CIFAR-10 and CIFAR-100 benchmarks, we show that NAS is \emph{seemingly} robust to data poisoning, showing marginal accuracy drops even under large poisoning budgets. However, we demonstrate that when considering NAS algorithms designed to achieve a few percentage points of accuracy gain, this expected improvement can be substantially diminished under data poisoning. We also show that the reduction varies across NAS algorithms and analyze the factors contributing to their robustness. Our findings are: (1) Training-based NAS algorithms are the least robust due to their reliance on data. (2) Training-free NAS approaches are the most robust but produce architectures that perform similarly to random selections from the search space. (3) NAS algorithms can produce architectures with improved accuracy, even when using out-of-distribution data like MNIST. We lastly discuss potential countermeasures. Our code is available at: https://github.com/ztcoalson/NAS-Robustness-to-Data-Poisoning
title	Hard Work Does Not Always Pay Off: Poisoning Attacks on Neural Architecture Search
topic	Machine Learning Cryptography and Security
url	https://arxiv.org/abs/2405.06073