Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

The poison of dimensionality

Lê-Nguyên Hoang

TL;DR

It is essentially proved that linear and logistic regressions with H^2/P^2 parameters are subject to arbitrary model manipulation by poisoners, where H and P are the numbers of honestly labeled and poisoned data points used for training.

Abstract

This paper advances the understanding of how the size of a machine learning model affects its vulnerability to poisoning, despite state-of-the-art defenses. Given isotropic random honest feature vectors and the geometric median (or clipped mean) as the robust gradient aggregator rule, we essentially prove that, perhaps surprisingly, linear and logistic regressions with $D \geq 169 H^2/P^2$ parameters are subject to arbitrary model manipulation by poisoners, where $H$ and $P$ are the numbers of honestly labeled and poisoned data points used for training. Our experiments go on exposing a fundamental tradeoff between augmenting model expressivity and increasing the poisoners' attack surface, on both synthetic data, and on MNIST & FashionMNIST data for linear classifiers with random features. We also discuss potential implications for source-based learning and neural nets.

The poison of dimensionality

TL;DR

It is essentially proved that linear and logistic regressions with H^2/P^2 parameters are subject to arbitrary model manipulation by poisoners, where H and P are the numbers of honestly labeled and poisoned data points used for training.

Abstract

This paper advances the understanding of how the size of a machine learning model affects its vulnerability to poisoning, despite state-of-the-art defenses. Given isotropic random honest feature vectors and the geometric median (or clipped mean) as the robust gradient aggregator rule, we essentially prove that, perhaps surprisingly, linear and logistic regressions with parameters are subject to arbitrary model manipulation by poisoners, where and are the numbers of honestly labeled and poisoned data points used for training. Our experiments go on exposing a fundamental tradeoff between augmenting model expressivity and increasing the poisoners' attack surface, on both synthetic data, and on MNIST & FashionMNIST data for linear classifiers with random features. We also discuss potential implications for source-based learning and neural nets.
Paper Structure (59 sections, 36 theorems, 46 equations, 3 figures)

This paper contains 59 sections, 36 theorems, 46 equations, 3 figures.

Table of Contents

  1. Introduction
  2. Contributions.
  3. Literature review.
  4. Structure.
  5. Setting
  6. Linear regression (without noise).
  7. Logistic regression.
  8. Poisoning attacks
  9. Securing learning with the geometric median or clipped mean
  10. Main result
  11. Five remarks on the main theorem
  12. High probability.
  13. The overparameterized regime.
  14. Independence to signal-to-noise ratio.
  15. The attack.
  16. ...and 44 more sections

Key Result

Lemma 1

Consider linear or logistic regression. For any $\alpha \in \mathbb R^D$ and $g \in \mathbb R^D$, there exists $(x, y) \in \mathbb R^D \times \mathbb Y$ such that $\nabla \ell (\alpha | x, y) = g$.

Figures (3)

  • Figure 1: In high dimension, correct gradients fail to point in the right direction, which makes poisoning vastly more devastating,.
  • Figure 2: Statistical errors under poisoning, for varying model sizes $d$ and number $P$ of poisons.
  • Figure 3: Cross-entropy of a random feature linear classifier on MNIST (left) and FashionMNIST (right), trained using gradient descent with trimmed mean on the training sets, and evaluated on the validation sets, as a function of the number of parameters of these models.

Theorems & Definitions (78)

  • Lemma 1: Gradient inversion
  • proof
  • Proposition 1: Arbitrary model manipulation by a single poisoner
  • proof
  • Definition 1
  • Definition 2
  • Definition 3
  • Theorem 1
  • Proposition 2
  • proof : Proof sketch
  • ...and 68 more