機械学習とセキュリティ

機械学習モデルへの攻撃とその対策についての概要

Transcript

1. ػցֶशͱηΩϡϦςΟ ๭௨৴ࣄۀձࣾ ΄͛΄͛։ൃ෦ ઀఺2#
   !TFUUFO@2# %BUB
   4DJFODF
   $BGÉ!৽॓
2. ػցֶशºηΩϡϦςΟ Ø %PT߈ܸΛػցֶशͰݕ஌ Ø Ϛϧ΢ΣΞΛػցֶशͰݕ஌ ػցֶशΛηΩϡϦςΟʹԠ༻ ػցֶशϞσϧࣗମͷηΩϡϦςΟ ػցֶशͰߏஙͨ͠ϞσϧʢػցֶशϞσϧʣΛ૊ΈࠐΜͩγεςϜͰ͸ ैདྷͷγεςϜͱ͸ҟͳͬͨݻ༗ͷ߈ܸ͕ͳ͞ΕΔϦεΫ͕༗Δ ͦͷͨΊɼػցֶशϞσϧಛ༗ͷηΩϡϦςΟରࡦ͕ඞཁ 2
3.    "EWFSTBSJBM
   "UUBDL ϞσϧΛὃ͢߈ܸ .PEFM
   &YUSBDUJPO ϞσϧΛ౪Ή߈ܸ .PEFM
   *OWFSTJPO ֶशσʔλʹؔ͢Δ৘ใΛ෮ݩ͢Δ߈ܸ
5. "EWFSTBSJBM
   "UUBDL ܇࿅͞ΕͨػցֶशϞσϧΛὃ͢߈ܸ ݩͷը૾ ఢରతઁಈ "EWFSTBSJBM
   &YBNQMF ʢςφΨβϧʣ (PPEGFMMPX FU
   BM
    ΑΓҾ༻ 5
6. ఢରతઁಈΛݟ͚ͭΔͨΊʹ͸ argmin " , s.t. + ≠ argmin " , s.t. + = # ಛఆͷΫϥεʹޡ෼ྨͤ͞Δ͜ͱΛ໨తͱͨ͠ "EWFSTBSJBM
   "UUBDL ޡ෼ྨͤ͞ΔΫϥε͸ࢦఆͤͣ ͱʹ͔͘Ͳ͔͜ͷΫϥεʹޡ෼ྨͤ͞Δ͜ͱΛ ໨తͱͨ͠"EWFSTBSJBM
   "UUBDL 6
7. ୅දతͳ"EWFSTBSJBM
   "UUBDL
   (PPEGFMMPX FU
   BM
    !"# = + sign ∇ ℓ , /PUBUJPO ɿઁಈڧ౓ʢͲΕ͙Β͍ઁಈΛڧ͘༩͑Δ͔Λද͢ʣ ℓɿଛࣦؔ਺ 3FNBSL '(4.͸Ұ౓ͷޯ഑্ঢͰ࠷దԽΛऴྃ͢Δ͕ɼ͜ΕΛෳ਺ճʹ֦ுͨ͠ͷ͕#*.Ͱɼ CBMMʹऩ·ΔΑ͏ͳ੍໿ͷ΋ͱͰޯ഑্ঢΛ܁Γฦ͢ɽ '(4.΋#*.΋! ϊϧϜͰͷઁಈΛੜ੒͓ͯ͠Γɼ%FFQGPPM͸͜ͷϊϧϜΛ" ʹɼ $8͸# ʹͨ͠΋ͷͱݟΔ͜ͱ͕Ͱ͖Δɽ 7
8. 8IJUF#PY
   4FUUJOHʹ͓͚Δఢରతઁಈͷݟ͚ͭํ '(4.
   BUUBDL
   (PPEGFMMPX FU
   BM
    #*.
   ,VSBLJO FU
   BM
    BUUBDL
   .*'(4.
   %POH
   FU
   BM
    %FFQGPPM .PPTBWJ%F[GPPMJ FU
   BM
    /FXUPO'PPM +BOH
   FU
   BM
    +4."
   1BQFSOPU FU
   BM
    (SBEJFOU #BTFE 0CKFDUJWF 'VODUJPO #BTFE $8
   $BSMJOJ FU
   BM
    &"%
   $IFO
   FU
   BM
    0QU.BSHJO 8BSSFO
   FU
   BM
    ˞8IJUF#PY
   4FUUJOHɿଛࣦؔ਺ͷޯ഑͕ܭࢉͰ͖ͨΓɼϞσϧͷDPOGJEFODF
   TDPSFΛ஌Δ͜ͱ͕Ͱ͖Δઃఆ 8
9. "EWFSTBSJBM
   "UUBDL΁ͷରࡦɿ"EWFSTBSJBM
   5SBJOJOH Ϟσϧͷֶश࣌ʹBEWFSTBSJBM
   FYBNQMFTͰl༧๷઀छz͓͚ͯ͠͹ BEWFSTBSJBM
   FYBNQMFTʹର͢Δϩόετੑ΋্͕ΔΜ͡Όͳ͍͔ʁ 9 ℓ!"# , () ≔ ℓ !"#, !"# + 1 − ℓ , *EFB 3FTVMU n ࣮ࡍʹBEWFSTBSJBM
   FYBNQMFTʹର͢Δϩόετੑ͸޲্͢Δ ҰํͰʜ n ֶशʹཁ͢Δ͕࣌ؒ૿͑Δ n "EWFSTBSJBM
   FYBNQMFT΁ͷϩόετੑ͸BEWFSTBSJBM
   FYBNQMFTͷ࡞Γํʹґଘ͢Δ n ѱҙͷͳ͍ϊΠζ͕৐ͬͨը૾Λ͏·͘෼ྨͰ͖ͳ͘ͳΔ ͱ͍ͬͨ໰୊΋ൃੜ͢Δ
10.    "EWFSTBSJBM
    "UUBDL ϞσϧΛὃ͢߈ܸ .PEFM
    &YUSBDUJPO ϞσϧΛ౪Ή߈ܸ .PEFM
    *OWFSTJPO ֶशσʔλʹؔ͢Δ৘ใΛ෮ݩ͢Δ߈ܸ
11. .PEFM
    &YUSBDUJPOɿϞσϧΛ౪Ή & "SDIJUFDUVSF %FDJTJPO
    #PVOEBSZ 'VODUJPOBMJUZ ϨΠϠʔͷ਺΍χϡʔϩϯͷ਺ ͞Βʹ׆ੑԽؔ਺ͳͲͷ Ϟσϧͷߏ଄Λ౪ΉλΠϓ ϞσϧͷܾఆڥքΛ ౪ΉλΠϓ ϞσϧʹΑΔ ೖྗͱग़ྗͷରԠؔ܎Λ ౪ΉλΠϓ 11
12. .PEFM
    &YUSBDUJPOͷओཁͳΞϓϩʔν $ , $ $%& ' : ℝ( → ֶश ), ) )%& * +: ℝ( → ֶश 0SJHJOBM
    .PEFM 4VCTUJUVUF
    .PEFM "1*ʹΑͬͯฦ͞ΕΔ Λ໨తม਺ͱͯ͠ར༻͢Δ͜ͱͰ୅ཧϞσϧΛߏங͢Δɽ ୅දతͳݚڀͱͯ͠$PSSFJB4JMWB
    FU
    BM  ΍0SFLPOEZ FU
    BM  ͕ڍ͛ΒΕΔɽ 12
13. 4VCTUJUVUF
    .PEFMʹؔ͢Δ߈๷ %FGFODF 0GGFODF "1*ୟ͚Δճ਺Λ੍ݶ গͳ͍Ԡ౴ճ਺Ͱ΋ 4VCTUJUVUF
    .PEFMΛߏங͢Δํ๏͕ఏҊ͞ΕΔ 0SFLPOEZ FU
    BM  3PTFOCFSH
    FU
    BM  13
14.    "EWFSTBSJBM
    "UUBDL ϞσϧΛὃ͢߈ܸ .PEFM
    &YUSBDUJPO ϞσϧΛ౪Ή߈ܸ .PEFM
    *OWFSTJPO ֶशσʔλʹؔ͢Δ৘ใΛ෮ݩ͢Δ߈ܸ
15. ʢ޿ٛͷʣ.PEFM
    *OWFSTJPO
    "UUBDL ֶशσʔλʹؔ͢Δ৘ใΛ෮ݩ͢Δ߈ܸ 1SPQFSUZ
    *OGFSFODF
    "UUBDL .PEFM
    *OWFSTJPO
    "UUBDL ద౰ͳ ͕Ϟσϧͷֶशσʔληοτʹؚ·Ε͍ͯΔ͔ʁ Λ໌Β͔ʹ͢Δ߈ܸ ֶशσʔληοτʹؔ͢Δੑ࣭Λਪଌ͢Δ߈ܸ FH
    ൅͕௕͍ਓ΍υϨεΛண͍ͯΔਓ͕ ੑผ෼ྨͷϞσϧͷֶशσʔλʹؚ·Ε͍ͯΔ͔ʁ ֶशσʔλΛ෮ݩ͢Δ߈ܸ ˞.PEFM
    *OWFSTJPO
    "UUBDLʹ.FNCFSTIJQ
    *OGFSFODF΍1SPQFSUZ
    *OGFSFODFΛؚΊΔ͔ʹ͸ॾઆ͋Γ 15
16. ("/Λ༻͍ͨ.PEFM
    *OWFSTJPO
    ,VTBOP FU
    BM
     ิॿσʔληοτ ) , )%& * , , ∼$$( ℱ′ ֶशσʔληοτ $ , $ $%& ' , ∼$$( ℱ ΫΤϦ & ,, … * , Ԡ౴ (& ,), … * , (FOFSBUPS
    Ͱ ℱ ʢͬΆ͍΋ͷʣΛۙࣅ αϯϓϦϯά (FOFSBUPS
    ͔Β ֶशσʔλͬΆ͍΋ͷΛੜ੒ 16
17. σʔλͷҰ෦͔Β࢒Γͷ෦෼Λ෮ݩ ֶशσʔλ ∈ ℝ( ͔ΒҰ෦ͷಛ௃ྔ͚ͩΛൈ͖ग़ͯ͠ ࡞੒ͨ͠ϕΫτϧ " ∈ ℝ-, < ͔Β ࢒Γͷಛ௃ྔΛ෮ݩ͢Δ ࿦จͰ͸ " ͸࿙Ӯͯ͠΋໰୊ͳ͍ηϯγςΟϒͰͳ͍ಛ௃ྔͰ ࢒Γͷಛ௃ྔ͸ηϯγςΟϒͳಛ௃ྔͩͱ૝ఆ͍ͯ͠Δ ("/Λ༻͍ͨ.PEFM
    *OWFSTJPO
    ;IBO
    FU
    BM  17
18. ͍΍ɼϜζ͘Ͷʜʁ ./*45Λֶशσʔλͱͨ͠෼ྨϞσϧʹରͯ͠.PEFM *OWFSTJPO
    "UUBDLΛߦͬͨ݁Ռ ิॿσʔλ͸खॻ͖จࣈͷ਺ࣈͱΞϧϑΝϕοτ ࣮ࡍʹ෮ݩͯ͠Έͨ݁Ռ 18
20. ػցֶशϞσϧ΁ͷ߈ܸʹؔ͢Δݚڀ ΍ͬͺΓ"EWFSTBSJBM
    "UUBDL͕μϯτπͳײ͡ ݚڀ͞ΕͯΔײ ֶशσʔλΛ͢΂ͯ෮ݩ͢ΔλΠϓͷ.PEFM
    *OWFSTJPO
    "UUBDL͕Ұ൪೉ͦ͠͏ ʢ࣮ࡍʹ೉͔ͬͨ͠ʣ ߈ܸͷ೉͠͞ n "EWFSTBSJBM
    "UUBDL͸σʔλ͕ߴ࣍ݩʹͳΔͱෆՄආతʹੜ͡ΔͨΊ ຊ࣭తʹରࡦ͕ࠔ೉ʁ n .PEFM
    &YUSBDUJPO
    "UUBDL͸ΫΤϦ੍ݶ͕༗ޮʹࢥ͑Δ͕ ΫΤϦ੍ݶͷ΋ͱͰ΋͋Δఔ౓ͷϞσϧෳ੡͕ग़དྷ͓ͯΓ ࠓޙͷಈ޲ʹ஫໨ ରࡦͷ೉͠͞ 20
21. 3FGFSFODF (PPEGFMMPX
    *
    +
    4IMFOT
    +
    
    4[FHFEZ
    $
     
    &YQMBJOJOH
    BOE
    IBSOFTTJOH
    BEWFSTBSJBM
    FYBNQMFT BS9JW QSFQSJOU
    BS9JW ,VSBLJO
    "
    (PPEGFMMPX
    *
    
    #FOHJP
    4
     
    "EWFSTBSJBM
    FYBNQMFT
    JO
    UIF
    QIZTJDBM
    XPSME BS9JW QSFQSJOU
    BS9JW %POH
    :
    -JBP
    '
    1BOH
    5
    4V
    )
    ;IV
    +
    )V
    9
    
    -J
    +
     
    #PPTUJOH
    BEWFSTBSJBM
    BUUBDLT
    XJUI
    NPNFOUVN
    *O 1SPDFFEJOHT
    PG
    UIF
    *&&&
    DPOGFSFODF
    PO
    DPNQVUFS
    WJTJPO
    BOE
    QBUUFSO
    SFDPHOJUJPO QQ
      .PPTBWJ%F[GPPMJ
    4
    .
    'BX[J
    "
    
    'SPTTBSE
    1
     
    %FFQGPPM
    B
    TJNQMF
    BOE
    BDDVSBUF
    NFUIPE
    UP
    GPPM
    EFFQ
    OFVSBM
    OFUXPSLT
    *O 1SPDFFEJOHT
    PG
    UIF
    *&&&
    DPOGFSFODF
    PO
    DPNQVUFS
    WJTJPO
    BOE
    QBUUFSO
    SFDPHOJUJPO QQ
       +BOH
    6
    8V
    9
    
    +IB
    4
    
    %FDFNCFS 
    0CKFDUJWF
    NFUSJDT
    BOE
    HSBEJFOU
    EFTDFOU
    BMHPSJUINT
    GPS
    BEWFSTBSJBM
    FYBNQMFT
    JO
    NBDIJOF
    MFBSOJOH
    *O 1SPDFFEJOHT
    PG
    UIF
    SE
    "OOVBM
    $PNQVUFS
    4FDVSJUZ
    "QQMJDBUJPOT
    $POGFSFODF QQ
      1BQFSOPU
    /
    .D%BOJFM
    1
    +IB
    4
    'SFESJLTPO
    .
    $FMJL
    ;
    #
    
    4XBNJ
    "
    
    .BSDI 
    5IF
    MJNJUBUJPOT
    PG
    EFFQ
    MFBSOJOH
    JO
    BEWFSTBSJBM
    TFUUJOHT
    *O 
    *&&&
    &VSPQFBO
    TZNQPTJVN
    PO
    TFDVSJUZ
    BOE
    QSJWBDZ
    &VSP41 QQ
     
    *&&& $BSMJOJ
    /
    
    8BHOFS
    %
    
    .BZ 
    5PXBSET
    FWBMVBUJOH
    UIF
    SPCVTUOFTT
    PG
    OFVSBM
    OFUXPSLT
    *O 
    JFFF TZNQPTJVN
    PO
    TFDVSJUZ
    BOE
    QSJWBDZ
    TQ QQ
     
    *&&& $IFO
    1
    :
    4IBSNB
    :
    ;IBOH
    )
    :J
    +
    
    )TJFI
    $
    +
    
    "QSJM 
    &BE
    FMBTUJDOFU
    BUUBDLT
    UP
    EFFQ
    OFVSBM
    OFUXPSLT
    WJB
    BEWFSTBSJBM
    FYBNQMFT
    *O 5IJSUZTFDPOE
    """*
    DPOGFSFODF
    PO
    BSUJGJDJBM
    JOUFMMJHFODF 21
22. 3FGFSFODF 8BSSFO
    )
    #P
    - %BXO
    4
    
    %FDJTJPO
    #PVOEBSZ
    "OBMZTJT
    PG
    "EWFSTBSJBM
    &YBNQMFT
    *OUFSOBUJPOBM
    $POGFSFODF
    PG
    -FBSOJOH
    3FQSFTFOUBUJPOT $PSSFJB4JMWB
    +
    3
    #FSSJFM
    3
    '
    #BEVF
    $
    EF
    4PV[B
    "
    '
    
    0MJWFJSB4BOUPT
    5
    
    +VMZ 
    $PQZDBU
    DOO
    4UFBMJOH
    LOPXMFEHF
    CZ
    QFSTVBEJOH
    DPOGFTTJPO
    XJUI
    SBOEPN
    OPOMBCFMFE
    EBUB
    *O 
    *OUFSOBUJPOBM
    +PJOU
    $POGFSFODF
    PO
    /FVSBM
    /FUXPSLT
    *+$// QQ
     
    *&&& 0SFLPOEZ
    5
    4DIJFMF
    #
    
    'SJU[
    .
     
    ,OPDLPGG
    OFUT
    4UFBMJOH
    GVODUJPOBMJUZ
    PG
    CMBDLCPY
    NPEFMT
    *O 1SPDFFEJOHT
    PG
    UIF
    *&&&
    $POGFSFODF
    PO
    $PNQVUFS
    7JTJPO
    BOE
    1BUUFSO
    3FDPHOJUJPO QQ
      3PTFOCFSH
    *
    4IBCUBJ
    "
    3PLBDI
    -
    
    &MPWJDJ
    :
    
    4FQUFNCFS 
    (FOFSJD
    CMBDLCPY
    FOEUPFOE
    BUUBDL
    BHBJOTU
    TUBUF
    PG
    UIF
    BSU
    "1*
    DBMM
    CBTFE
    NBMXBSF
    DMBTTJGJFST
    *O *OUFSOBUJPOBM
    4ZNQPTJVN
    PO
    3FTFBSDI
    JO
    "UUBDLT
    *OUSVTJPOT
    BOE
    %FGFOTFT QQ
     
    4QSJOHFS
    $IBN ,VTBOP
    ,
    
    4BLVNB
    +
     
    $MBTTJGJFSUP(FOFSBUPS
    "UUBDL
    &TUJNBUJPO
    PG
    5SBJOJOH
    %BUB
    %JTUSJCVUJPO
    GSPN
    $MBTTJGJFS ;IBOH
    :
    +JB
    3
    1FJ
    )
    8BOH
    8
    -J
    #
    
    4POH
    %
     
    5IF
    TFDSFU
    SFWFBMFS
    HFOFSBUJWF
    NPEFMJOWFSTJPO
    BUUBDLT
    BHBJOTU
    EFFQ
    OFVSBM
    OFUXPSLT
    *O 1SPDFFEJOHT
    PG
    UIF
    *&&&$7'
    $POGFSFODF
    PO
    $PNQVUFS
    7JTJPO
    BOE
    1BUUFSO
    3FDPHOJUJPO QQ
      22