Han Xiao - Adversarial and and Robust Machine Learning

Han Xiao - Adversarial and and Robust Machine Learning

Talk by Han Xiao (http://home.in.tum.de/~xiaoh/) at the first meetup of Munich Data Geeks (http://www.meetup.com/Munich-Datageeks)
Date: 2013.07.02

3c3f3f18c25ea5283640ebd23553e7c6?s=128

MunichDataGeeks

July 02, 2013
Tweet

Transcript

  1. Technische Universit¨ at M¨ unchen Adversarial and Robust Machine Learning

    Han Xiao Department of Informatics Technische Universit¨ at M¨ unchen xiaoh@in.tum.de July 2, 2013
  2. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Outline 1 Examples 2 Adversarial and Robust Learning Attack Defense 3 Other Work 4 Take Home Messages
  3. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Outline 1 Examples 2 Adversarial and Robust Learning Attack Defense 3 Other Work 4 Take Home Messages
  4. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Spam Filtering Three steps of machine learning: representation→ optimization → evaluation
  5. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Spam Disguise Adding noise to the junk mail
  6. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Spam Disguise Introducing feature noise
  7. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Exploratory Attack: Spam Disguise in Practice Question Given a spam, how do you disguise it to evade from being detected? How? • Create dummy@gmail.com • Generate disguised spams and send to dummy@gmail.com • Select the most desired modification from the inbox.
  8. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Exploratory Attack: Spam Disguise in Practice Question Given a spam, how do you disguise it to evade from being detected? How? • Create dummy@gmail.com • Generate disguised spams and send to dummy@gmail.com • Select the most desired modification from the inbox. Questions: • What is the “most desired” mail? • How to generate efficiently?
  9. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Training Data from Online Services Users may vary in expertise, dedication and motivation
  10. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Training Data from Online Services Users may vary in expertise, dedication and motivation
  11. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Training Data from Online Services Users may vary in expertise, dedication and motivation What if haters dominate? Are they going to subvert the learning algorithm? How to recover the unbiased labels/ratings?
  12. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Causative Attack: Poisoning the Spam Filter Introducing label noise to training data
  13. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Outline 1 Examples 2 Adversarial and Robust Learning Attack Defense 3 Other Work 4 Take Home Messages
  14. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Modeling the Adversary Adversarial settings The adversary manipulates instances to mislead the decision of the classifier in their favor. Exploratory attack • in the test phrase; • disguise a malicious instance to evade from being detected; • e.g. disguise a spam, mutate a virus.
  15. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Modeling the Adversary Adversarial settings The adversary manipulates instances to mislead the decision of the classifier in their favor. Exploratory attack • in the test phrase; • disguise a malicious instance to evade from being detected; • e.g. disguise a spam, mutate a virus. Causative attack • in the training phrase; • manipulate the training set to subvert the learning process; • e.g. poisoning the spam filter, unfair rating on SNS.
  16. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Why Adversarial Learning is Interesting? (1) Because social network and crowdsourcing platform (e.g. Amazon mechanical turk) are popular.
  17. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Why Adversarial Learning is Interesting? (1) Because social network and crowdsourcing platform (e.g. Amazon mechanical turk) are popular. (2) Know your enemies and yourself, you will not be imperiled in a hundred battles. –Sun Tzu, The Art of War, 544 BC
  18. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Why Adversarial Learning is Interesting? (1) Because social network and crowdsourcing platform (e.g. Amazon mechanical turk) are popular. (2) Know your enemies and yourself, you will not be imperiled in a hundred battles. –Sun Tzu, The Art of War, 544 BC Secure learning The ultimate goal is to develop robust learning algorithms, which are resilient to the adversarial noise.
  19. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Research Directions Optimal attack strategies knowing the worst-case performance • Exploratory Attack • Causative Attack Robust learning algorithms improving the worst-case performance • Learning from crowds
  20. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Binary Classification Formalize the problem in math Term Notation Real world Input space X ⊆ RD All possible mails Response space Y := {−1, 1} All possible labels Instance x ∈ X, i.e. a D-dimensional vector A mail
  21. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Binary Classification Formalize the problem in math Term Notation Real world Input space X ⊆ RD All possible mails Response space Y := {−1, 1} All possible labels Instance x ∈ X, i.e. a D-dimensional vector A mail Hypothesis space H All possible filters Classifier f : X → Y, f ∈ H A filter
  22. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Binary Classification Formalize the problem in math Term Notation Real world Input space X ⊆ RD All possible mails Response space Y := {−1, 1} All possible labels Instance x ∈ X, i.e. a D-dimensional vector A mail Hypothesis space H All possible filters Classifier f : X → Y, f ∈ H A filter Positive set X+ := {x ∈ X | f(x) = +1} All possible spams Negative set X− := {x ∈ X | f(x) = −1} All possible legit mails
  23. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Binary Classification Formalize the problem in math Term Notation Real world Input space X ⊆ RD All possible mails Response space Y := {−1, 1} All possible labels Instance x ∈ X, i.e. a D-dimensional vector A mail Hypothesis space H All possible filters Classifier f : X → Y, f ∈ H A filter Positive set X+ := {x ∈ X | f(x) = +1} All possible spams Negative set X− := {x ∈ X | f(x) = −1} All possible legit mails Loss function V : Y × Y → R0+ Cost of misclassification
  24. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Training the Classifier Solving an optimization problem Classification Given a training set S := {(xi, yi ) | xi ∈ X, yi ∈ Y}n i=1 . Find the classifier fS ∈ H that performs best on some test set T. Solving an optimization problem: fS := arg min f γ n i=1 V (yi, f(xi )) + f 2 H , where γ ∈ R0+ is a fixed parameter for quantifying the trade off.
  25. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Spam Disguise Problem formulation Disguise a spam from being detected by a filter. Be efficient. Problem Formulation Given • a trained classifier f; • a positive (malicious) instance xA ∈ X+; • a random negative (benign) instance x− ∈ X−. Find an instance x∗ ∈ X− f such that • x∗ should be similar to xA; • issuing as few queries to f as possible. Han, Thomas, Claudia. Evasion Attack of Multi-Class Linear Classifiers PAKDD 2012 16 of 46
  26. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Assumptions Assumption Real world Know the dimension of X Know how many features Attack a fixed f Spam filter is not updated Observe f(x) by a membership query Observe the label of a sent mail Design a cost function Know the cost of misclassification Han, Thomas, Claudia. Evasion Attack of Multi-Class Linear Classifiers PAKDD 2012 17 of 46
  27. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Exploratory Attack as ℓp -norm Minimization Exploratory Attack Given xA, f, and a cost function g : X × X → R0+ , solve min x g(x, xA) subject to x ∈ X−, where X− is specified by the membership oracle f. For example, g(x, xA) := x − xA ℓ1 Han, Thomas, Claudia. Evasion Attack of Multi-Class Linear Classifiers PAKDD 2012 18 of 46
  28. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Illustration of the Problem g(x) := x − xA ℓ1 X+ f X− f xA x− Han, Thomas, Claudia. Evasion Attack of Multi-Class Linear Classifiers PAKDD 2012 19 of 46
  29. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Illustration of the Problem g(x) := x − xA ℓ1 X+ f X− f xA x− ⊗ x∗ Han, Thomas, Claudia. Evasion Attack of Multi-Class Linear Classifiers PAKDD 2012 19 of 46
  30. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Face Camouflage Considering a suspect tries to disguise herself as innocent. Han, Thomas, Claudia. Evasion Attack of Multi-Class Linear Classifiers PAKDD 2012 20 of 46
  31. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Label Flips Attack Given a training set, the adversary contaminates the training data through flipping labels. Han, Huang, Claudia. Adversarial Label Flips Attack on Support Vector Machines ECAI 2012 21 of 46
  32. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Adversarial Label Flips Attack Adversarial Label Flip Attack Find a combination of label flips under a given budget so that a classifier trained on such data will have maximal classification error on some test data. Han, Huang, Claudia. Adversarial Label Flips Attack on Support Vector Machines ECAI 2012 22 of 46
  33. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Adversarial Label Flips Attack Adversarial Label Flip Attack Find a combination of label flips under a given budget so that a classifier trained on such data will have maximal classification error on some test data. Training set: S := {(xi, yi ) | xi ∈ X, yi ∈ Y}n i=1 ; Indicator: zi ∈ {0: normal, 1: flipped}, i = 1, . . . , n; Flipping cost: ci ∈ R0+, i = 1, . . . , n; Han, Huang, Claudia. Adversarial Label Flips Attack on Support Vector Machines ECAI 2012 22 of 46
  34. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Adversarial Label Flips Attack Adversarial Label Flip Attack Find a combination of label flips under a given budget so that a classifier trained on such data will have maximal classification error on some test data. Training set: S := {(xi, yi ) | xi ∈ X, yi ∈ Y}n i=1 ; Indicator: zi ∈ {0: normal, 1: flipped}, i = 1, . . . , n; Flipping cost: ci ∈ R0+, i = 1, . . . , n; Tainted label: y′ i := yi (1 − 2zi ); Tainted training set: S′ := {(xi, y′ i )}. Han, Huang, Claudia. Adversarial Label Flips Attack on Support Vector Machines ECAI 2012 22 of 46
  35. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages A Bilevel Formulation Finding the optimal label flips Given S, a test set T and a budget C, solve max z (x,y)∈T V (y, fS′ (x)) , s.t. fS′ ∈ arg min f γ n i=1 V y′ i , f(xi ) + f 2 H , n i=1 cizi ≤ C, zi ∈ {0, 1}. Han, Huang, Claudia. Adversarial Label Flips Attack on Support Vector Machines ECAI 2012 23 of 46
  36. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages A Bilevel Formulation Finding the optimal label flips Given S, a test set T and a budget C, solve max z (x,y)∈T V (y, fS′ (x)) , s.t. fS′ ∈ arg min f γ n i=1 V y′ i , f(xi ) + f 2 H , n i=1 cizi ≤ C, zi ∈ {0, 1}. Defender Han, Huang, Claudia. Adversarial Label Flips Attack on Support Vector Machines ECAI 2012
  37. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages A Bilevel Formulation Finding the optimal label flips Given S, a test set T and a budget C, solve max z (x,y)∈T V (y, fS′ (x)) , s.t. fS′ ∈ arg min f γ n i=1 V y′ i , f(xi ) + f 2 H , n i=1 cizi ≤ C, zi ∈ {0, 1}. Defender Attacker Han, Huang, Claudia. Adversarial Label Flips Attack on Support Vector Machines ECAI 2012 23 of 46
  38. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Label Flips Attack Against SVM Train: 100, flip:20, test 800 (a) Synthetic data Linear pattern (b) No Flips 1.8% Linear SVM (c) Random 1.9% (d) Nearst 6.9% (e) Furthest 9.5% (f) ALFA 21.8% 3.2% RBF−SVM 4.0% 3.5% 26.5% 32.4% Parabolic pattern 23.5% Linear SVM 28.8% 29.2% 40.5% 48.0% 5.1% RBF−SVM 9.4% 10.1% 12.9% 40.8% Han, Huang, Claudia. Adversarial Label Flips Attack on Support Vector Machines ECAI 2012 24 of 46
  39. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages An Endless Game between Adversary and Defender Escher. Drawing Hands 1948 25 of 46
  40. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Detecting Exploratory Attack Convergence pattern 50 100 150 200 250 300 350 400 450 500 550 Original Disguised Initial Time Start Dim 1 Dim 2 malcious benign Han, Thomas, Claudia. Evasion Attack of Multi-Class Linear Classifiers PAKDD 2012 26 of 46
  41. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Subjective opinions from crowds Learning objective assessment from subjective opinions Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 27 of 46
  42. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Subjective opinions from crowds Learning objective assessment from subjective opinions Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 27 of 46
  43. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Subjective opinions from crowds Learning objective assessment from subjective opinions Fair rating (Groundtruth)? Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 27 of 46
  44. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Subjective opinions from crowds Learning objective assessment from subjective opinions Fair rating (Groundtruth)? What’s wrong with “majority vote” and “take average”? They completely ignore the individual expertise and may fail in the settings with non-Gaussian or adversarial noise! Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 27 of 46
  45. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Unreliable readings from sensors 237◦ 229◦ 240◦ 236◦ −13◦ Groundtruth? Questions 1. How to integrate readings from multiple sensors? 2. How accurate is each sensor? Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 28 of 46
  46. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Learning from Multiple Observers Problems • How to learn a regression function to predict the ground truth precluding the prior knowledge of observers? • How to estimate the expertise of each observer without knowing the ground truth? Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 29 of 46
  47. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Intuition behind Leveraging the neighborhood information Instance space X x2 x1 x3 Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 30 of 46
  48. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Intuition behind Leveraging the neighborhood information Instance space X x2 x1 x3 f(x1 ) f(x2 ) f(x3 ) Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 30 of 46
  49. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Intuition behind Leveraging the neighborhood information Instance space X x2 x1 x3 f(x1 ) f(x2 ) f(x3 ) Groundtruth space Z z1 z2 z3 (Latent) Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 30 of 46
  50. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Intuition behind Leveraging the neighborhood information Instance space X x2 x1 x3 f(x1 ) f(x2 ) f(x3 ) Groundtruth space Z z1 z2 z3 (Latent) g1 (z3 ) g1 (z2 ) gM (z3 ) gM (z1 ) gM (z2 ) Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 30 of 46
  51. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Intuition behind Leveraging the neighborhood information Instance space X x2 x1 x3 f(x1 ) f(x2 ) f(x3 ) Groundtruth space Z z1 z2 z3 (Latent) g1 (z3 ) g1 (z2 ) gM (z3 ) gM (z1 ) gM (z2 ) y1,1 y2,1 y3,1 Response space Y 1st Observer y1,M y2,M y3,M Response space Y Mth Observer Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 30 of 46
  52. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Nonparametric probabilistic model xn yn,m zn M N p(Y, Z, X) = p(Z | X)p(Y | Z, X)p(X). Gaussian process: a less-parametric approach for modeling a function. Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 31 of 46
  53. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Nonparametric probabilistic model xn yn,m zn M N p(Y, Z, X) = p(Z | X)p(Y | Z, X)p(X). Gaussian process: a less-parametric approach for modeling a function. Maximizing the posterior, which gives log p(Z, Θ | Y, X) = log p(Y | Z, X, Θ)+log p(Z | X, Θ)+constant. Deriving the gradient w.r.t. z, κ, φ, η, respectively. Feed the gradients to L-BFGS method for finding the stationary point. Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 31 of 46
  54. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages 1-D example Groundtruth function: f(t) = 10 sin(6t) sin( t 2 ), 0 1 2 3 4 5 6 0 0.5 1 Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 32 of 46
  55. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages 1-D example Groundtruth function: f(t) = 10 sin(6t) sin( t 2 ), Randomly sample responses at t ∈ [0, 6] from four sensors. 0 1 2 3 4 5 6 0 0.5 1 0 0.5 1 0 0.5 1 Ground truth Ob.1 resp. Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 32 of 46
  56. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages 1-D example Groundtruth function: f(t) = 10 sin(6t) sin( t 2 ), Randomly sample responses at t ∈ [0, 6] from four sensors. 0 1 2 3 4 5 6 0 0.5 1 0 0.5 1 0 0.5 1 Ground truth Ob.1 resp. 0 0.5 1 0 0.5 1 Ground truth Ob.2 resp. Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 32 of 46
  57. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages 1-D example Groundtruth function: f(t) = 10 sin(6t) sin( t 2 ), Randomly sample responses at t ∈ [0, 6] from four sensors. 0 1 2 3 4 5 6 0 0.5 1 0 0.5 1 0 0.5 1 Ground truth Ob.1 resp. 0 0.5 1 0 0.5 1 Ground truth Ob.2 resp. 0 0.5 1 0 0.5 1 Ground truth Ob.3 resp. Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 32 of 46
  58. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages 1-D example Groundtruth function: f(t) = 10 sin(6t) sin( t 2 ), Randomly sample responses at t ∈ [0, 6] from four sensors. 0 1 2 3 4 5 6 0 0.5 1 0 0.5 1 0 0.5 1 Ground truth Ob.1 resp. 0 0.5 1 0 0.5 1 Ground truth Ob.2 resp. 0 0.5 1 0 0.5 1 Ground truth Ob.3 resp. 0 0.5 1 0 0.5 1 Ground truth Ob.4 resp. Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 32 of 46
  59. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages 1-D example Groundtruth function: f(t) = 10 sin(6t) sin( t 2 ), Randomly sample responses at t ∈ [0, 6] from four sensors. 0 1 2 3 4 5 6 0 0.5 1 0 0.5 1 0 0.5 1 Ground truth Ob.1 resp. 0 0.5 1 0 0.5 1 Ground truth Ob.2 resp. 0 0.5 1 0 0.5 1 Ground truth Ob.3 resp. 0 0.5 1 0 0.5 1 Ground truth Ob.4 resp. Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 32 of 46
  60. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages 1-D example What do we know? Only the readings from each sensor 0 1 2 3 4 5 6 0 0.5 1 Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 33 of 46
  61. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages 1-D example What do we want to know? 1. Groundtruth function, i.e. f(t). 2. Response function of each sensor. 0 1 2 3 4 5 6 0 0.5 1 0 0.5 1 0 0.5 1 Ground truth Ob.1 resp. 0 0.5 1 0 0.5 1 Ground truth Ob.2 resp. 0 0.5 1 0 0.5 1 Ground truth Ob.4 resp. 0 0.5 1 0 0.5 1 Ground truth Ob.3 resp. Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 33 of 46
  62. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Synthetic data set Recover f(t) = 10 sin(6t) sin( t 2 ) and g1 , g2 , g3 , g4 . 0 1 2 3 4 5 6 0 0.5 1 a 0 0.5 1 0 0.5 1 Ob.1 resp. (a) 0 0.5 1 0 0.5 1 Ob.2 resp. 0 0.5 1 0 0.5 1 Ob.3 resp. Ground truth 0 0.5 1 0 0.5 1 Ground truth Ob.4 resp. Ground truth Ob.1 Ob.2 Ob.3 Ob.4 Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 34 of 46
  63. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Synthetic data set Recover f(t) = 10 sin(6t) sin( t 2 ) and g1 , g2 , g3 , g4 . 0 1 2 3 4 5 6 0 0.5 1 a 0 0.5 1 0 0.5 1 Ob.1 resp. (a) 0 0.5 1 0 0.5 1 Ob.2 resp. 0 0.5 1 0 0.5 1 Ob.3 resp. Ground truth 0 0.5 1 0 0.5 1 Ground truth Ob.4 resp. Ground truth Ob.1 Ob.2 Ob.3 Ob.4 0 2 4 6 MANE:0.38, PCC:0.00 0 2 4 6 0 0.5 1 MANE:0.29, PCC:0.50 0 2 4 6 0 0.5 1 MANE:0.13, PCC:0.73 (d) LOB (b) SVR−AVG (c) GPR−AVG Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 34 of 46
  64. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Synthetic data set Recover f(t) = 10 sin(6t) sin( t 2 ) and g1 , g2 , g3 , g4 . 0 1 2 3 4 5 6 0 0.5 1 a 0 0.5 1 0 0.5 1 Ob.1 resp. (a) 0 0.5 1 0 0.5 1 Ob.2 resp. 0 0.5 1 0 0.5 1 Ob.3 resp. Ground truth 0 0.5 1 0 0.5 1 Ground truth Ob.4 resp. Ground truth Ob.1 Ob.2 Ob.3 Ob.4 0 1 2 3 4 5 6 0 0.5 1 MANE:0.09, PCC:0.89 (e) 0 0.5 1 0 0.5 1 Ob.1 resp. 0 0.5 1 0 0.5 1 Ob.2 resp. 0 0.5 1 0 0.5 1 Ground truth Ob.4 resp. 0 0.5 1 0 0.5 1 Ground truth Ob.3 resp. NLOB Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 34 of 46
  65. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages TUM1002 photo rating data set Contributed by Huang http://ml.sec.in.tum.de/opars Huang, Han, Claudia. OPARS: Objective Photo Aesthetics Ranking System (demo paper). ECIR 2013 Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 35 of 46
  66. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Sparse rating matrix from 34 users 50 100 150 200 250 300 350 400 5 10 15 20 25 30 −1 0 1 2 3 4 5 Impressive Poor Missing Value Photos Missing Ratings Users Huang, Han, Claudia. OPARS: Objective Photo Aesthetics Ranking System (demo paper). ECIR 2013 Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 36 of 46
  67. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Results Top-5 and bottom-5 ranked photos 5.00 4.86 4.79 4.65 4.60 0.84 0.83 0.64 0.44 0.00 5.00 4.97 4.55 4.18 4.10 0.27 0.25 0.22 0.14 0.00 5.00 3.77 3.66 3.55 3.48 0.29 0.29 0.29 0.12 0.00 5.00 4.45 3.75 3.75 3.56 0.21 0.19 0.18 0.07 0.00 GPR−AVG Raykar LOB NLOB Top−5 Bottom−5 Huang, Han, Claudia. OPARS: Objective Photo Aesthetics Ranking System (demo paper). ECIR 2013 Han, Huang, Claudia. Learning from Multiple Observers with Unknown Expertise PAKDD 2013 Meyyar. Leveraging the Wisdom of Crowds for Reputation Management Master’s thesis 37 of 46
  68. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Outline 1 Examples 2 Adversarial and Robust Learning Attack Defense 3 Other Work 4 Take Home Messages
  69. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Scalable Online Learning Algorithms Incrementally finding a good enough solution as fast as possible −1.5 −1 −0.5 0.5 1 1.5 −1 −0.5 0.5 1 1.5 2 <0.000000s: execve 0.000512s: brk 0.000757s: mmap 0.001707s: stat 0.002275s: stat 0.002679s: stat 0.003077s: stat 0.003498s: stat 0.003811s: stat 0.003999s: stat 0.004030s: open 0.004053s: fstat 0.004077s: mmap 0.004100s: close 0.004147s: open 0.004170s: read 0.004198s: fstat 0.004224s: mmap 0.004245s: mprotect 0.004268s: mmap 0.004298s: mmap 0.004322s: close 0.004531s: open 0.004555s: read 0.004579s: fstat 0.004605s: mmap 0.004628s: mmap 0.004648s: mprotect 0.004670s: mmap 0.004696s: close 0.004908s: open 0.004932s: read 0.004956s: fstat 0.004982s: mmap 0.005002s: mprotect 0.005024s: mmap 0.005050s: close 0.005258s: open 0.005282s: read 0.005305s: fstat 0.005330s: mmap 0.005351s: mprotect 0.005372s: mmap 0.005397s: mmap 0.005421s: close 0.006004s: open 0.006052s: read 0.006102s: fstat 0.006153s: mmap 0.006203s: mmap 0.006244s: mprotect 0.006292s: mmap 0.006344s: close 0.006756s: open 0.006801s: read 0.006847s: fstat 0.006919s: mmap 0.006968s: mprotect 0.007018s: mmap 0.007073s: mmap 0.007125s: close 0.007584s: open 0.007635s: read 0.007686s: fstat 0.007743s: mmap 0.007786s: mprotect 0.007834s: mmap 0.007890s: close 0.007940s: mmap 0.008013s: mmap 0.008063s: arch_prctl 0.008209s: mprotect 0.008262s: mprotect 0.008319s: mprotect 0.008371s: mprotect 0.008420s: mprotect 0.008467s: mprotect 0.008522s: mprotect 0.008573s: mprotect 0.008622s: mprotect 0.008665s: munmap 0.008719s: set_tid_address 0.008760s: set_robust_list 0.008857s: rt_sigaction 0.008920s: rt_sigaction 0.008973s: rt_sigprocmask 0.009023s: getrlimit 0.009179s: statfs 0.009301s: brk 0.009342s: brk 0.009396s: open 0.009463s: fstat 0.009586s: mmap 0.009669s: read 0.009775s: read 0.009847s: close 0.009903s: munmap 0.009993s: open 0.010039s: fstat 0.010091s: mmap 0.010134s: close 0.010222s: ioctl 0.010301s: ioctl 0.010388s: openat 0.010450s: getdents 0.010822s: getdents 0.010871s: close 0.011114s: fstat 0.011179s: mmap 0.011241s: write 0.011308s: write 0.011366s: write 0.011423s: write 0.011479s: write 0.011537s: write 0.011595s: write 0.011654s: write 0.011710s: write 0.011765s: write 0.011821s: write 0.011877s: write 0.011933s: write 0.011989s: write 0.012044s: write 0.012112s: close 0.012151s: munmap 0.012203s: close >0.012269s: exit_group • Han, Claudia. Lazy Gaussian Process Committee for Real-Time Online Regression. AAAI 2013. • Han, Claudia. Efficient Online Sequence Prediction with Side Information. Submitted to ICDM 2013.
  70. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Ubiquitous Anomaly Detection • Huang Xiao. Indicative Support Vector Clustering with Its Application in Anomaly Detection. • Chih-Ta Lin. Behavior Based Malware Detection, 2013. • Sami Ghawi. Spatio-Temporal Anomaly detection for Tracking Mobile Devices. Master’s thesis, 2013. • Siddhant Goel. Utilizing Crowd Intelligence for Online Detection of Emotional Distress. Master’s thesis, 2013. • Fernando Hernandez Montoya. Predicting Malicious Linking Behavior on a Microblogging Service. Master’s thesis, 2012.
  71. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Group • Prof. Claudia Eckert • Huang Xiao (Ph.D. student) • Han Xiao (Ph.D. student) • Chih-Ta Lin (visitor) • Sami Ghawi (Master student) • Meyyar Palaniappan (graduated) • Fernando Hernandez Montoya (graduated) • Siddhant Goel (graduated)
  72. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages Outline 1 Examples 2 Adversarial and Robust Learning Attack Defense 3 Other Work 4 Take Home Messages
  73. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages
  74. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages
  75. Outline Examples Adversarial and Robust Learning Other Work Take Home

    Messages
  76. Technische Universit¨ at M¨ unchen Q&A http://home.in.tum.de/~xiaoh