Title: Robust Nonparametric Regression under Poisoning Attack
Venue: NeurIPS 2023
Accepted: no
Keywords: Poisoning attack

adversarial machine learning
Abstract: This paper studies robust nonparametric regression, in which an adversarial attacker can modify the values of up to $q$ samples from a training dataset of size $N$. Our initial solution is an M-estimator based on Huber loss minimization. Compared with simple kernel regression, i.e. the Nadaraya-Watson estimator, this method can significantly weaken the impact of malicious samples on the regression performance. We provide the convergence rate as well as the corresponding minimax lower bound. The result shows that, with proper bandwidth selection, $\ell_\infty$ error is minimax optimal. The $\ell_2$ error is optimal if $q\lesssim \sqrt{N/\ln^2 N}$, but is suboptimal with larger $q$. The reason is that this estimator is vulnerable if there are many attacked samples concentrating in a small region. To address this issue, we propose a correction method by projecting the initial estimate to the space of Lipschitz functions. The final estimate is nearly minimax optimal for arbitrary $q$, up to a $\ln N$ factor.

1

Abstract

This paper studies robust nonparametric regression, in which an adversarial attacker can modify the values of up to q samples from a training dataset of size N . Our initial solution is an M-estimator based on Huber loss minimization. Compared with simple kernel regression, i.e. the Nadaraya-Watson estimator, this method can significantly weaken the impact of malicious samples on the regression per- formance. We provide the convergence rate as well as the corresponding minimax lower bound. The result shows that, with proper bandwidth selection, ℓ ∞ error is minimax optimal. The ℓ 2 error is optimal if q ≲ √ N/ ln 2 N , but is suboptimal with larger q . The reason is that this estimator is vulnerable if there are many attacked samples concentrating in a small region. To address this issue, we propose a correction method by projecting the initial estimate to the space of Lipschitz functions. The final estimate is nearly minimax optimal for arbitrary q , up to a ln N factor.

1 Introduction

In the era of big data, it is common for some samples to be corrupted due to various reasons, such 15

as transmission errors, system malfunctions, malicious attacks, etc. The values of these samples 16

17

may be altered in any way, rendering many traditional machine learning techniques less effective.

18

Consequently, evaluating the effects of these corrupted samples, and making corresponding robust

strategies, have become critical tasks in the research community [1-10]. 19

Among all types of data contamination, adversarial attack is of particular interest in recent years 20

[11-17], in which there exists a malicious adversary who aims at deteriorating our model performance. 21

With this goal, the attacker alters the values of some samples using a carefully designed strategy. 22

23

Compared with other types of undesired samples, such as accidental errors or noise, adversarial

24

25

26

27

28

29

30

31

samples are more challenging to deal with, since their values are altered deliberately instead of

randomly.

Therefore, any learning models that can withstand adversarial attacks should also be resilient to other corruptions.

Adversarial attack can be divided into to damage the model, and

poisoning attack evasion attack

[11-13], which manipulates training samples

[14-17], which modifies test samples to generate wrong

predictions. We focus on poisoning attack here. For classification problems, the labels can only

be altered within several discrete values, thus the impact of poisoning samples is relatively limited

[11, 18, 19]. However, regression problems are crucially different, since the response variable is

continuous and can be altered arbitrarily far away from its ground truth. Without proper handling, 32

even if only a tiny fraction of training samples are attacked, the model performance may drastically 33

deteriorate. Therefore, for regression problems, defense strategies against poisoning attack are 34

crucially needed. 35

Despite many previous works toward robust regression problems, most of them focus on parametric 36 models [13, 20-22]. For example, there are several robust techniques for linear models, such as 37 M-estimation [23], least median of squares [24], least trimmed squares [25], etc. However, for 38 nonparametric methods such as kernel [26] and k nearest neighbor estimator, defense strategies 39 against poisoning attack still need further exploration [27]. Actually, designing robust techniques is 40 indeed more challenging for nonparametric methods than parametric one. For parametric models, 41 the parameters are estimated using full dataset, while nonparametric methods have to rely on local 42 training data around the query point. Even if the ratio of attacked samples among the whole dataset is 43 small, the local anomaly ratio in the neighborhood of the query point can be large. As a result, the 44 estimated function value at such query point can be totally wrong. Despite such difficulty, in many 45 real scenarios, due to problem complexity or lack of prior knowledge, parametric models are not 46 always available. Therefore, we hope to explore effective schemes to overcome the robustness issue 47 of nonparametric regression. 48

49

50

51

In this paper, we provide a theoretical study about robust nonparametric regression problem under poisoning attack. In particular, we hope to investigate the theoretical limit of this problem, and design a method to achieve this limit. With this goal, we make the following contributions:

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

Firstly, we propose and analyze an estimator that minimizes a weighted Huber loss, which can be viewed as a combination of ℓ 1 and ℓ 2 loss functions, and thus achieves a tradeoff between consistency and adversarial robustness. It was originally proposed in [28], but to the best of our knowledge, it was not analyzed under adversarial setting. We show the convergence rate of both ℓ 2 and ℓ ∞ risk, under the assumption that the function to estimate is Lipschitz continuous, and the noise is sub-exponential. An interesting finding is that if q ≲ √ N/ ln 2 N , in which q is the maximum number of attacked samples, then the convergence rate is not affected by adversarial samples, i.e. the influence of poisoning samples on the overall risk is only up to a constant factor.

Secondly, we provide an information theoretic minimax lower bound, which indicates the underlying limit one can achieve, with respect to q and N . The minimax lower bound without adversarial samples can be derived using standard information theoretic methods [29]. Under adversarial attack, the estimation problem is harder, thus the lower bound in [29] may not be tight enough. We design some new techniques to derive a tighter one. The result shows that the initial estimator has optimal ℓ ∞ risk. If q ≲ √ N/ ln 2 N , then ℓ 2 risk is also minimax optimal. Nevertheless, for larger q , the ℓ 2 risk is not optimal, indicating that this estimator is still not perfect. We then provide an intuitive explanation of the suboptimality. Instead of attacking some randomly selected training samples, the best strategy for the attacker is to focus their attack within a small region. With this strategy, majority of training samples are altered here, resulting in wrong estimates. A simple remedy is to increase the kernel bandwidth to improve robustness. Nevertheless, this will introduce additional bias in other regions. It turns out that ℓ ∞ risk can be made optimal by adjusting the bandwidth, while ℓ 2 risk is always suboptimal. Actually, the drawback of the initial estimator is that it does not make full use of the continuity of regression function, and thus unable to correct the estimation.

Finally, motivated by the issues of the initial method mentioned above, we propose a corrected estimator. If the attack focuses on a small region, although the initial estimate fails here, the output elsewhere is still reliable. With the assumption that the underlying function is continuous, the value at such region can be inferred using the surrounding values. With such intuition, we propose a nonlinear filtering method, which makes minimal adjustment to the estimated function in ℓ 1 sense, to make it Lipschitz continuous. The corrected estimate is then proved to be nearly minimax optimal up to only a ln N factor.

The remainder of this paper is organized as follows. In section 2, we provide the problem statement as well as the initial estimator by Huber loss minimization.

The upper bound and the minimax lower bound are shown in section 3. In section 4, we elaborate the corrected estimator, as well as

related theoretical analysis. Numerical simulation results are shown in section 5. Finally, we discuss limitations and provide concluding remarks in section 6 and 7, respectively.

2 The Initial Estimator

Suppose X 1 , . . . , X N ∈ R d be N independently and identically distributed training samples, gen87 erated from a common probability density function (pdf) f . For each sample X i , we can receive a 88

corresponding label Y i : 89

101

102

103

113

114

is the Huber cost function.

Here we have introduced two new parameters, namely, M and T . With M → ∞ and T → ∞ , 115 function ϕ becomes simple square loss, and it is straightforward to show that the resulting estimator 116 (5) reduces to the Nadaraya-Watson estimator(4). M is a constant hyperparameter that does not 117 change with sample size N . By restricting | s | ≤ M , we avoid the estimated value from being too 118 large. It would be better if M is larger than the upper bound of | η ( x ) | , so that the estimation is 119 not truncated too much. T balances accuracy and robustness. Smaller T ensures robustness while 120 sacrificing consistency, and vice versa. To achieve better tradeoff, T need to increase with the training 121 sample size N . The best rate of the growth of T with respect to N depends on the strength of the tail 122 of the noise distribution. In our theoretical analysis, we will show that under sub-exponential noise, 123 T ∼ ln N is optimal. 124

in which η : R d → R is the unknown underlying function that we would like to estimate. W i is the 90 noise variable. For i = 1 , . . . , N , W i are independent, with zero mean and finite variance. B is the 91 set of indices of attacked samples. ⋆ means some value determined by the attacker. For each normal 92 sample X i , the received label is Y i = η ( X i ) + W i . However, if a sample is attacked, then Y i can be 93 arbitrary value determined by the attacker. The attacker can manipulate up to q samples, thus |B| ≤ q . 94

95

96

97

98

99

Our goal is opposite to the attacker. We hope to find an estimate

ˆ

η

that is as close to

η

as possible, while the attacker aims at reducing the estimation accuracy using a carefully designed attack strategy.

We consider white-box setting here, in which the attacker has complete access to the ground truth

X

i

and

W

i

for all

i

∈ {

1

, . . . , N

}

η

,

, as well as our estimation algorithm. Under this setting, we hope to design a robust regression method that resists to any attack strategies.

The quality of estimation is evaluated using ℓ 2 and ℓ ∞ loss, which is defined as 100

in which A denotes the attack strategy, X denotes a random test sample that follows a distribution with pdf f . Our analysis can be easily generated to ℓ p loss with arbitrary p .

The kernel regression, also called the Nadaraya-Watson estimator [26,30] is

in which K is the Kernel function, h is the bandwidth that will decrease with the increase of sample 104 size N . ˆ η 0 ( x ) can be viewed as a weighted average of the labels around x . Without adversarial 105 attack, such estimator converges to η [31]. However, (4) fails even if a tiny fraction of samples are 106 attacked. The attacked labels can just set to be sufficiently large. As a result, ˆ η 0 ( x ) could be far away 107 from its truth. 108

Now we build the estimator based on Huber loss minimization. Similar method was proposed in [28], 109 but to the best of our knowledge, the performance under adversarial setting has not been analyzed. 110 We elaborate this method for completeness and notation consistency. We use ˆ η 0 to denote the new 111 estimator, which is designed as following: 112

in which tie breaks arbitrarily if the minimum is not unique, and

We would like to remark that apart from Huber loss minimization, there are other robust mean 125 estimation methods, such as median-of-means (MoM) [32,33] and trimmed means [34,35]. However, 126 it is not efficient to generalize these methods to nonparametric regression. For MoM, with up to q 127 corrupted samples, it divides the data into at least 2 q +1 groups and then calculate the median of the 128 means of values in each group. Under the regression setting, since the distribution of attacked samples 129 is unknown, we have to divide the data into 2 q +1 groups within the neighborhood of each query 130 point. As a result, the accuracy with N training samples with q contaminated is only comparable 131 to those with N/ (2 q +1) clean samples, indicating that the MoM method is ineffective. Trimmed 132 means method has similar problems. The threshold of the trimmed mean need to be set uniformly 133 among the whole support, while the adversarial attack may focus on a small region. As a result, 134 the parameter can not be tuned optimal everywhere. The nonconsistency at attacked region and the 135 inefficiency at relatively cleaner regions are two problems that can not be avoided simultaneously. 136 Consequently, these alternative approaches are less effective than the M-estimator based on Huber 137 loss minimization. 138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

Finally, we comment on the computation of the estimator (5). Note that ϕ is convex, therefore the minimization problem in (5) can be solved by gradient descent. The derivative of ϕ is

Based on (5) and (7), s can be updated using binary search. Denote ϵ as the required precision, then the number of iterations for binary search should be O (ln( M/ϵ )) . Therefore, the computational complexity is higher than kernel regression up to a ln( M/ϵ ) factor.

3 Theoretical Analysis

This section proposes the theoretical analysis of the initial estimator (5) under adversarial setting. To begin with, we make some assumptions about the problem.

Assumption 1. (Problem Assumption) there exists a compact set X and several constants L , γ , f m , f M , D , α , σ , such that the pdf f is supported at X , and

(a) (Lipschitz continuity) For any x 1 , x 2 ∈ X , | η ( x 1 ) -η ( x 2 ) | ≤ L || x 1 -x 2 || ;

(b) (Bounded f and η ) For all x ∈ X , f m ≤ f ( x ) ≤ f M and | η ( x ) | ≤ M , in which M is the parameter used in (5) ;

(c) (Corner shape restriction) For all r < D , V ( B ( x , r ) ∩X ) ≥ αv d r d , in which B ( x , r ) is the ball centering at x with radius r , v d is the volume of d dimensional unit ball, which depends on the norm we use;

(d) (Sub-exponential noise) The noise W i is subexponential with parameter σ ,

(a) is a common assumption for smoothness. (b) assumes that the pdf is bounded from both below and above. (c) prevents the shape of the corner of the support from being too sharp. Without assumption (c), the samples around the corner may not be enough, and the attacker can just attack the corner of the support. (d) requires that the noise is sub-exponential. If the noise assumption is weaker, e.g. only requiring the bounded moments of W i up to some order, then the noise can be disperse. In this case, it will be harder to distinguish adversarial samples from clean samples. More discussions are provided in section 6.

We then make some restrictions on the kernel function K .

Assumption 2. (Kernel Assumption) the kernel need to satisfy: (a) ∫ K ( u ) du = 1 ; (b) K ( u ) = 0 , ∀|| u || > 1 ; (c) c K ≤ K ( u ) ≤ C K for two constants c K and C K .

(a) is actually not necessary, since from (5), the estimated value will not change if the kernel function is multiplied by a constant factor. This assumption is only for convenience of proof. (b) and (c)

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

actually requires that the kernel need to be somewhat close to the uniform function in the unit ball. Intuitively, if the attacker wants to modify the estimate at some x , the best way is to change the response of sample i with large K (( X i -x ) /h ) , in order to make strong impact on ˆ η ( x ) . To defend against such attack, the upper bound of K should not be too large. Besides, to ensure that clean samples dominate corrupted samples everywhere, the effect of each clean sample on the estimation should not be too small, thus K also need to be bounded from below in its support.

Furthermore, recall that (5) has three parameters, i.e. h , T and M . We assume that these three parameters satisfy the following conditions.

Assumption 3. (Parameter Assumption) h , T , M need to satisfy (a) h > ln 2 N/N ; (b) T ≥ 4 Lh + 16 σ ln N ; (c) M > sup x ∈X | η ( x ) | .

(a) ensures that the number of samples whose distance to x less than h is not too small. Actually, for a better tradeoff between bias and variance, h need to grow much faster than ln 2 N/N . (b) requires that T ∼ ln N . Actually, the optimal growth rate of T depends on the distribution of noise. Recall that in Assumption 1(d), we assume that the distribution of noise is sub-exponential. If we use sub-Gaussian assumption instead, then it is enough for T ∼ √ ln N . If the noise is further assumed to be bounded, then T can just be set to constant. (c) prevents the estimate from being truncated too much.

The upper bound of ℓ 2 error is derived under these assumptions. Denote a ≲ b if a ≤ Cb for some constant C that depends only on L, M, γ, f m , f M , D, α, σ, c K , C K .

Theorem 1. Under Assumption 1, 2 and 3,

The detailed proof of Theorem 1 is shown in section 2 in the supplementary material. From the proof, it can also be observed that the effect of adversarial samples is higher when they concentrate at a small region instead of distributing uniformly over the whole support. Denote B h ( x ) as the ball centering at x with radius h . Even if q/N is small, the proportion of attacked samples within B ( x , h ) for some x may be large, which may result in large error at x .

The next theorem shows the bound of ℓ ∞ error:

Theorem 2. Under Assumption 1, 2, 3, if K ( u ) is monotonic decreasing with respect to ∥ u ∥ , then

The proof is in section 3 in the supplementary material. We then show the minimax lower bound, which indicates the information theoretic limit of the adversarial nonparametric regression problem. In general, it is impossible to design an estimator with convergence rate faster than the following bound.

Theorem 3. Let F be the collection of f, η, P N that satisfy Assumption 1, in which P N is the distribution of the noise W 1 , . . . , W N . Then

and 201

The proof is shown in section 4 in the supplementary material. In the right hand side of (11) and (12), 202 N -2 / ( d +2) is the standard minimax lower bound for nonparametric estimation [29], which holds 203 even if there are no adversarial samples. In the supplementary material, we only prove the lower 204 bound with the first term in the right hand side of (11). 205

Compare Theorem 1, 2 and Theorem 3, we have the following findings. We claim that the upper and 206 lower bound nearly match, if these two bounds match up to a polynomial of ln N : 207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

From (10) and (12), with h ∼ max { ( q/N ) 1 / ( d +1) , N -1 / ( d +2) } and T ∼ ln N , the upper and minimax lower bound of ℓ ∞ error nearly match.

If q ≲ √ N/ ln 2 N , from (9) and (11), let h ∼ N -2 d +2 , the upper and minimax lower bound of ℓ 2 match. In fact, in this case, the convergence rate of (5) is the same as ordinary kernel regression without adversarial samples, i.e. h 2 +1 / ( Nh d ) . With optimal selection of h , the rate becomes N -2 / ( d +2) , which is just the standard rate for nonparametric statistics [29,38].

The ℓ 2 upper and lower bound no longer match if q ≳ √ N/ ln 2 N . In this case, the optimal h in (9) is h ∼ ( q ln N/N ) 2 / ( d +2) , and resulting ℓ 2 error is R 2 ≲ ( q ln N/N ) 4 / ( d +2) , higher than the lower bound in (11).

This result indicates that the initial estimator (5) is optimal under ℓ ∞ , or under ℓ 2 with small q . However, under large number of adversarial samples, the ℓ 2 error becomes suboptimal.

Now we provide an intuitive understanding of the suboptimality of ℓ 2 risk with large q using a simple one dimensional example shown in Figure 1, with N = 10000 , h = 0 . 05 , M = 3 , f ( x ) = 1 for x ∈ (0 , 1) , η ( x ) = sin(2 πx ) , and the noise follows standard normal distribution N (0 , 1) . For each x , denote q h ( x ) , n h ( x ) as the number of attacked samples and total samples within ( x -h, x + h ) , respectively. For robust mean estimation problems, the breakdown point is 1 / 2 [39], which also holds locally for nonparametric regression problem. Hence, if q h ( x ) /n h ( x ) > 1 / 2 , the estimator will collapse and return erroneous values even if we use Huber cost. In (a), q = 500 , among which 250 attacked samples are around x = 0 . 25 , while others are around x = 0 . 75 . In this case, q h ( x ) /n h ( x ) < 1 / 2 over the whole support. The curve of estimated function is shown in Fig 1(b). The estimate with (5) is significantly better than kernel regression. Then we increase q to 2000 . In this case, q h ( x ) /n h ( x ) > 1 / 2 around 0 . 25 and 0 . 75 (Fig 1(c)), thus the estimate fails. The estimated function curve shows an undesirable spike (Fig 1(d)).

0.0

0.2

0.4

0.6

0.8

1.0

10

5

0

5

10

Normal samples

attacked samples

0.0

0.2

0.4

0.6

0.8

1.0

3

2

1

0

1

2

3

Ground truth

Kernel regression

Initial estimate

Corrected estimate

0.0

0.2

0.4

0.6

0.8

1.0

10

5

0

5

10

15

Normal samples

attacked samples

0.0

0.2

0.4

0.6

0.8

1.0

3

2

1

0

1

2

3

Ground truth

Kernel regression

Initial estimate

Corrected estimate

Figure 1: A simple example with q = 500 and q = 2000 . In (a) and (c), red dots are attacked samples, while blue dots are normal samples. In (b) and (d), four curves correspond to ground truth η , the result of kernel regression, initial estimate and corrected estimate, respectively. With q = 500 , the initial estimate (5) works well. However, with q = 2000 , the initial estimate fails, while the corrected regression works well.

The above example shows that the best strategy for attacker is to focus on altering values at a small region. In this case, the local ratio of attacked samples surpasses the breakdown point, resulting in a wrong estimate. With such strategy and sufficient q , the initial estimator (5) fails to be optimal. Actually, (5) does not make full use of the continuity property of regression function η , and thus unable to detect and remove the spikes. A simple remedy is to increase h so that q h ( x ) /n h ( x ) becomes smaller. However, this solution will introduce additional bias. In the next section, we design a corrected estimator to improve (5), which will close the gap between upper and minimax lower bound with q ≳ √ N/ ln 2 N .

4 Corrected Regression

In this section we propose and analyze a correction method to the initial estimator (5).

As has been discussed in section 3, the drawback of the initial estimator is that the continuity property of η is not used. Consequently, an intuitive solution is to filter out the spike, and estimate η here using

243

244

245

246

247

248

249

250

251

252

253

254

255

256

values in surrounding locations. Linear filter does not work here since the profile of the regression estimate will be blurred. Therefore, we propose a nonlinear filter as following. It conducts minimum correction (in ℓ 1 sense) to the initial result ˆ η 0 , while ensuring that the corrected estimate is Lipschitz. Formally, given the initial estimate ˆ η 0 ( x ) , our method solves the following optimization problem

In section 5 in the supplementary material, we prove that the solution to the optimization problem (13) is unique.

(13) can be viewed as the projection of the output of initial estimator (5) into the space of Lipschitz function. Here we would like to explain intuitively why we use ℓ 1 distance instead of other metrics in (13). Using the example in Fig.1(d) again, it can be observed that at the position of such spikes, | η ( x ) -g ( x ) | can be large. Other metrics such as ℓ 2 distance impose large costs here, thus somewhat prevents the removal of spikes. Hence ℓ 1 distance is preferred.

The estimation error of the corrected regression can be bounded by the following theorem.

Theorem 4. (1) Under the same conditions as Theorem 1,

(2) Under the same conditions as Theorem 2, 257

The proof is shown in section 6 in the supplementary material. Compared with Theorem 3, with T ∼ ln N and a proper h , the upper and lower bound nearly match.

Now we discuss the practical implementation. (13) can not be calculated directly for a continuous function. Therefore, we find a approximate numerical solution instead. The detail of practical implementation is shown in section 1 in the supplementary material.

5 Numerical Examples

In this section we show some numerical experiments. In particular, we show the curve of the growth of mean square error over the attacked sample size q .

For each case, we generate N = 10000 training samples, with each sample follows uniform distribution in [0 , 1] d . The kernel function is

We compare the performance of kernel regression, the median-of-means method, initial estimate, and the corrected estimation under multiple attack strategies. For kernel regression, the output is max(min(ˆ η NW , M ) , -M ) , in which ˆ η NW is the simple kernel regression defined in (4). We truncate the result into [ -M,M ] for a fair comparison with robust estimators. For the median-of-means method, we divide the training samples into 20 groups randomly, and then conduct kernel regression for each group and then find the median, i.e.

For the initial estimator (5), the parameters are T = 1 and M = 3 . The corrected estimate uses (3) in the supplementary material. For d = 1 , the grid count is m = 50 . For d = 2 , m 1 = m 2 = 20 . Consider that the optimal bandwidth need to increase with the dimension, in (4), the bandwidths of all these four methods are set to be h = 0 . 03 for one dimensional distribution, and h = 0 . 1 for two dimensional case.

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

The attack strategies are designed as following. Let q = 500 k for k = 0 , 1 , . . . , 10 . 279

in which

280

281

282

283

284

285

286

287

288

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

Definition 1. There are three strategies, namely, random attack, one directional attack, and concentrated attack, which are defined as following:

(1) Random Attack. The attacker randomly select q samples among the training data to attack. The value of each attacked sample is -10 or 10 with equal probability;

(2) One directional Attack. The attacker randomly select q samples among the training data to attack. The value of all attacked samples are 10 ;

(3) Concentrated Attack. The attacker pick two random locations c 1 , c 2 that are uniformly distributed in [0 , 1] d . For ⌊ q/ 2 ⌋ samples that are closest to c 1 , modify their values to 10 . For ⌊ q/ 2 ⌋ samples that are closest to c 2 , modify their values to -10 .

0

1000

2000

3000

4000

5000

q

0.1

0.2

0.3

0.4

0.5

Root MSE

MoM

initial

corrected

0

1000

2000

3000

4000

5000

q

0.0

0.5

1.0

1.5

2.0

2.5

3.0

Root MSE

MoM

initial

corrected

0

1000

2000

3000

4000

5000

q

0.0

0.2

0.4

0.6

0.8

1.0

1.2

1.4

1.6

Root MSE

MoM

initial

corrected

0

1000

2000

3000

4000

5000

q

0.2

0.4

0.6

0.8

1.0

1.2

Supremum Error

MoM

initial

corrected

0

1000

2000

3000

4000

5000

q

0.0

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

Supremum Error

MoM

initial

corrected

0

1000

2000

3000

4000

5000

q

0.5

1.0

1.5

2.0

Supremum Error

MoM

initial

corrected

(d)

ℓ

∞

error, random attack.

(e)

ℓ

∞

error, one directional attack.

(f)

ℓ

∞

error, concentrated attack.

For one dimensional distribution, let the ground truth be 289

For two dimensional distribution,

The noise follows standard Gaussian distribution N (0 , 1) . The performances are evaluated using square root of ℓ 2 error, as well as ℓ ∞ error. The results are shown in Figure 2 and 3 for one and two dimensional distributions, respectively. In these figures, each point is the average over 1000 independent trials.

Figure 2 and 3 show that the simple kernel regression (blue dotted line) fails under poisoning attack. The ℓ 2 and ℓ ∞ error grows fast with the increase of q . Besides, traditional median-of-means does not improve over kernel regression. Moreover, the initial estimator (5) (orange dash-dot line) shows significantly better performance than kernel estimator under random and one directional attack, as are shown in Fig.2 and 3, (a), (b), (d), (e). However, if the attacked samples concentrate around some centers, then the initial estimator fails. Compared with kernel regression, there is some but limited improvement for (5). Finally, the corrected estimator (red solid line) performs well under all attack strategies. Under random attack, the corrected estimator performs nearly the same as initial one. For one directional attack, the corrected estimator performs better than the initial one with large q . Under concentrated attack, the correction shows significant improvement. These results are consistent with our theoretical analysis.

306

307

308

0

1000

2000

3000

4000

5000

q

0.1

0.2

0.3

0.4

0.5

0.6

0.7

Root MSE

MoM

initial

corrected

(a) Squared root of ℓ 2 error, random attack. (b) Squared root of ℓ 2 error, one di- rectional attack. (c) Squared root of ℓ 2 error, concen- trated attack.

0

1000

2000

3000

4000

5000

q

0.0

0.5

1.0

1.5

2.0

2.5

3.0

Root MSE

MoM

initial

corrected

0

1000

2000

3000

4000

5000

q

0.25

0.50

0.75

1.00

1.25

1.50

1.75

2.00

2.25

Root MSE

MoM

initial

corrected

0

1000

2000

3000

4000

5000

q

0.50

0.75

1.00

1.25

1.50

1.75

2.00

2.25

Supremum Error

MoM

initial

corrected

0

1000

2000

3000

4000

5000

q

1

2

3

4

5

Supremum Error

MoM

initial

corrected

0

1000

2000

3000

4000

5000

q

1

2

3

4

Supremum Error

MoM

initial

corrected

(d)

ℓ

∞

error, random attack.

(e)

ℓ

∞

error, one directional attack.

(f)

ℓ

∞

error, concentrated attack.

6 Limitations

The major limitation is that for high dimensional feature distributions, the corrected estimator can be computationally expensive, since the number of grids grows exponentially with the dimensionality.

Moreover, our theoretical results rely on Assumption 1. Nevertheless, it is not hard to generalize 309 these assumptions. For (a), we can use a local polynomial method to improve the convergence rate if 310 η satisfies higher order of smoothness. (b) limits the feature distribution. Actually, our analysis can 311 be extended to heavy tail cases, in which the bandwidth can be made adaptive, such as [36,37]. In 312 order to achieve better tradeoff between bias and variance, in the regions with high pdf, bandwidth 313 h need to be smaller, and vice versa. Currently, we only focus on distributions without tails. (d) 314 requires that the noise is sub-exponential. Such restriction can also be extended to the case in which 315 the noise is only assumed to have bounded moments. In this case, we can let T grow faster with N . 316 Despite that we are convinced that all these assumptions can be extended with some modification, the 317 current results focus on a simpler situation. 318

319

7 Conclusion

In this paper, we have provided a theoretical analysis of robust nonparametric regression problem 320 under adversarial attack. In particular, we have derived the convergence rate of an M-estimator 321 based on Huber loss minimization. We have also derived the information theoretic minimax lower 322 bound, which is the underlying limit of robust nonparametric regression. The result shows that the 323 initial estimator has minimax optimal ℓ ∞ risk. With q ≲ √ N/ ln 2 N , in which q is the number 324 of adversarial samples, ℓ 2 risk is also optimal. However, for large q , the initial estimator becomes 325 suboptimal. In particular, if the attacker focus their attack around some centers, then the resulting 326 estimate shows some undesirable spikes at these centers. Actually, the drawback of initial estimator is 327 that it does not make full use of the continuity of regression function, and hence unable to detect spikes 328 and correct the estimate. Motivated by such discussion, we have proposed a correction technique, 329 which is a nonlinear filter that projects the estimated function into the space of Lipschitz functions. 330 Our theoretical analysis shows that the corrected estimator is minimax optimal even for large q . 331

333

References

Natarajan, N., I. S. Dhillon, P. K. Ravikumar, et al. Learning with noisy labels. In Advances in 334 Neural Information Processing Systems , vol. 26. 2013. 335

Van Rooyen, B., R. C. Williamson. A theory of learning with corrupted labels. J. Mach. Learn. 336 Res. , 18(1):8501-8550, 2017. 337

Jiang, L., Z. Zhou, T. Leung, et al. Mentornet: Learning data-driven curriculum for very deep 338 neural networks on corrupted labels. In International conference on machine learning , pages 339 2304-2313. PMLR, 2018. 340

Liu, T., D. Tao. Classification with noisy labels by importance reweighting. IEEE Transactions 341 on pattern analysis and machine intelligence , 38(3):447-461, 2015. 342

Gao, W., B.-B. Yang, Z.-H. Zhou. On the resistance of nearest neighbor to random noisy labels. 343 arXiv preprint arXiv:1607.07526 , 2016. 344

Menon, A., B. Van Rooyen, C. S. Ong, et al. Learning from corrupted binary labels via 345 class-probability estimation. In International conference on machine learning , pages 125-134. 346 PMLR, 2015. 347

348

349

350

Patrini, G., F. Nielsen, R. Nock, et al. Loss factorization, weakly supervised learning and label noise robustness. In International Conference on Machine Learning , pages 708-717. PMLR, 2016.

351

352

353

354

355

356

357

Van Rooyen, B., A. Menon, R. C. Williamson. Learning with symmetric label noise: The importance of being unhinged. In Advances in Neural Information Processing Systems , vol. 28. 2015.

Wang, R., T. Liu, D. Tao. Multiclass learning with partially corrupted labels. IEEE transactions on neural networks and learning systems , 29(6):2568-2580, 2017.

Reeve, H., A. Kabán. Fast rates for a knn classifier robust to unknown asymmetric label noise. In International Conference on Machine Learning , pages 5401-5409. PMLR, 2019.

Biggio, B., B. Nelson, P. Laskov. Poisoning attacks against support vector machines. In 358 International Conference on Machine Learning . 2012. 359

Xiao, H., B. Biggio, G. Brown, et al. Is feature selection secure against training data poisoning? 360 In International Conference on Machine Learning , pages 1689-1698. PMLR, 2015. 361

362

363

364

Jagielski, M., A. Oprea, B. Biggio, et al. Manipulating machine learning: Poisoning attacks and countermeasures for regression learning. In 2018 IEEE symposium on security and privacy (SP) , pages 19-35. IEEE, 2018.

365

366

367

368

Szegedy, C., W. Zaremba, I. Sutskever, et al. Intriguing properties of neural networks. In International Conference on Learning Representations . 2014.

Goodfellow, I. J., J. Shlens, C. Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations . 2015.

Madry, A., A. Makelov, L. Schmidt, et al. Towards deep learning models resistant to adversarial 369 attacks. In International Conference on Learning Representations . 2018. 370

Mao, C., Z. Zhong, J. Yang, et al. Metric learning for adversarial robustness. In Advances in 371 Neural Information Processing Systems , vol. 32. 2019. 372

Steinhardt, J., P. W. W. Koh, P. S. Liang. Certified defenses for data poisoning attacks. In 373 Advances in Neural Information Processing Systems , vol. 30. 2017. 374

Koh, P. W., P. Liang. Understanding black-box predictions via influence functions. In Interna375 tional Conference on Machine Learning , pages 1885-1894. PMLR, 2017. 376

Ribeiro, A. H., T. B. Schön. Overparameterized linear regression under adversarial attacks. 377 IEEE Transactions on Signal Processing , 71:601-614, 2023. 378

Lecué, G., M. Lerasle. Robust machine learning by median-of-means: theory and practice. 379 Annals of Statistics , 2020. 380

Liu, C., B. Li, Y . V orobeychik, et al. Robust linear regression against training data poisoning. 381

In Proceedings of the 10th ACM workshop on artificial intelligence and security , pages 91-102. 382 2017. 383

Huber, P. J. Robust Statistics . John Wiley & Sons, 1981. 384

Rousseeuw, P. J. Least median of squares regression. Journal of the American statistical 385 association , 79(388):871-880, 1984. 386

Rousseeuw, P. J., A. M. Leroy. Robust regression and outlier detection . John wiley & sons, 387 2005. 388

Nadaraya, E. A. On estimating regression. Theory of Probability & Its Applications , 9(1):141389 142, 1964. 390

Salibian-Barrera, M. Robust nonparametric regression: review and practical considerations. 391 arXiv preprint arXiv:2211.08376 , 2022. 392

Hall, P., M. Jones. Adaptive m-estimation in nonparametric regression. Annals of Statistics , 393 pages 1712-1728, 1990. 394

Tsybakov, A. B. Introduction to Nonparametric Estimation . Springer Series in Statistics, 2009. 395

Watson, G. S. Smooth regression analysis. Sankhy¯ a: The Indian Journal of Statistics, Series A , 396 pages 359-372, 1964. 397

Devroye, L. P. The uniform convergence of the nadaraya-watson regression function estimate. 398 Canadian Journal of Statistics , 6(2):179-191, 1978. 399

Nemirovskij, A. S., D. B. Yudin. Problem complexity and method efficiency in optimization. 400 Wiley-Interscience Series in Discrete Mathematics , 1983. 401

Ben-Hamou, A., A. Guyader. Robust non-parametric regression via median-of-means. arXiv 402 preprint arXiv:2301.10498 , 2023. 403

Bickel, P. J. On some robust estimates of location. The Annals of Mathematical Statistics , pages 404 847-858, 1965. 405

Dhar, S., P. Jha, P. Rakshit. The trimmed mean in non-parametric regression function estimation. 406 Theory of Probability and Mathematical Statistics , 107:133-158, 2022. 407

Herrmann, E. Local bandwidth choice in kernel regression estimation. Journal of Computational 408 and Graphical Statistics , 6(1):35-54, 1997. 409

Zhao, P., L. Lai. Minimax rate optimal adaptive nearest neighbor classification and regression. 410 IEEE Transactions on Information Theory , 67(5):3155-3182, 2021. 411

Krzyzak, A. The rates of convergence of kernel regression estimates and classification rules. 412 IEEE Transactions on Information Theory , 32(5):668-679, 1986. 413

Andrews, D. F., F. R. Hampel. Robust estimates of location: Survey and advances , vol. 1280. 414

Princeton University Press, 2015. 415

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper studies robust nonparametric regression under poisoning attacks. The input is samples from some fixed distribution and the goal is to approximate some unknown function on the input space. It is assumed that the values observed in q of the samples are adversarial. In this setting, classical approaches such as k-NN estimators can fail. This is because a single adversarial sample can affect the prediction on many points. In order to avoid this issue, the paper proposes robust variants of nonparametric regression.\n\nThe first result is a bound on the convergence rate of an M-estimator based on Huber loss minimization: the initial estimator has minimal optimal ell_infinity risk. When the number of adversarial samples is not too big, the ell_2 risk is optimal.\n\nIt is also shown that the estimator can suffer when many of the adversarial samples are concentrated within a small region. In order to resolve this issue, the paper proposes a correction step that projects the estimator into the space of Lipschitz functions. Upper bounds on the rate of convergence of the corrected estimator are established. Numerical results show that both estimators outperform standard methods in a simple low-dimensional synthetic scenario.\n\nSTRENGTHS:\nNonparametric regression is a fundamental problem. The paper studies a natural adversarial setting where a small number of input samples are corrupted adversarially. This research direction can produce more robust useful data-analytic methods.\n\nThe upper and lower bounds match up to polylogarithmic factors when the number of adversarial samples is not too large.\n\nWEAKNESSES:\nThe experimental evaluation is very limited. This is unclear whether the proposed methods can lead to significant robustness improvements in real-world scenarios.\n\nNo runtime analysis is given for the corrected estimator. This is a continuous optimization problem, so it is not clear how easy it is to solve in practice, especially in high or moderately-high dimensions.\n\nQUESTIONS:\nAssumption 1, c: The quantifier for x is missing.\n\nIn line 253, I don't quite understand the justification for using ell_1 norm in the optimization problem. Since ell_2 imposes a larger cost in the error region, it would seem that this makes it easier to remove spikes.\n\nDefinition 1 (3): One of the two floors should be a ceiling.\n\nLIMITATIONS:\nThe authors have adequately addressed the limitations of their work.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nA robust version of the classic non-parametric problem is studied, when the training data is under an adversarial poisoning attack. The work is primarily theoretical, and makes assumptions on Lipschitzness and boundedness of the underlying function, boundedness of the data density, restrictions on sharpness of the data domain boundary, sub exponential noise. With some restrictions on the kernel, and appropriate parameters, upper bounds are shown on the $\\ell_2$ and $\\ell_\\infty$ loss for the robust regression fit using Huber loss minimization. Lower bounds are obtained under the same assumptions, which match asymptotically with the upper bounds for $\\ell_\\infty$ and a correction is presented to match the upper bound for $\\ell_2$ loss as well. Numerical simulations show usefulness of the algorithms on simulated one and two dimensional data.\n\nSTRENGTHS:\n1. The authors study robust nonparametric regression under poisoning attacks for smooth underlying functions under certain assumptions on the data and domain, under which asymptotically tight rates are obtained for $\\ell_\\infty$ loss by suitably parameterized Huber loss.\n2. A novel correction method is proposed for which tight rates are obtained for $\\ell_2$ loss as well. Together with above, the optimal algorithms under the given assumptions are obtained for both losses.\n3. Numerical simulations are performed to verify the theoretical results.\n\nWEAKNESSES:\n1. The assumption needed for proving the theoretical result, specifically assumption 1(b) is too strong. Effectively, it reduces the possible test distributions to \"near-uniform\" distributions since there is both an upper and a lower bound on the probability density function. This assumption is too strong to make the results useful in most practical situations.\n2. No insights is provided into the proofs of the theoretical results; in particular there are no proof sketches in the main body. This makes it challenging to understand the contributions, given the work is primarily theoretical.\n3. Experiments only involve very specific numerical simulations. How does the approach work on real regression datasets? The effect of changing the hyperparameters is not studied and how they are selected is not described.\n4. Huber loss is already known as a technique for robust nonparametric regression [1] and is not novel, the paper should mention that only the analysis under the present assumptions is new. The novel correction method is computationally intractable.\n\n[1] Maronna, R. A., Martin, R. D., Yohai, V. J., & Salibián-Barrera, M. (2019). Robust statistics: theory and methods (with R). John Wiley & Sons.\n\nQUESTIONS:\n1. What is the intuitive behind needing assumption (c)? Do sharp corners make the model more susceptible to attack by a poisoning adversary?\n2. Line 190-191 looks like notational overload for $h$?\n3. How do T/M/h settings in the numerical simulations compare to theory?\n\nLIMITATIONS:\nThe authors note several limitations of their work in a dedicated section.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors propose two new nonparametric regression methods that and study their resilience under poisoning attacks.  The baseline for comparing the performance of the proposed methods is kernel regression (aka Nadaraya-Watson estimator).  The proposed methods are two, since the initial idea that the authors have, turns out to be vulnerable to poisoning attacks that are concentrated in small regions and a large budget is spent there.  Hence, the authors arrive at a `corrected' estimator which behaves better and is closer to optimal behavior.\n\n\nAfter rebuttal:\n\nFor the largest part I believe that the authors have provided sufficient clarifications to various issues that were raised and moreover are willing to integrate comments and clarifications that came up during the discussion period in the final version of the manuscript. Therefore, I am increasing my score from reject to borderline accept; I am also increasing the soundness from fair to good as well as the presentation from poor to fair.\n\nSTRENGTHS:\n+ New methods for regression that are resilient to poisoning attacks.\n+ Both theoretical and practical results.\n\nWEAKNESSES:\n+ Missing a section with preliminaries or background knowledge, where notions and notation that the authors use in the paper is well-defined. For example, in the section for preliminaries you can give information such as:\n   - define loss functions, \n   - discuss kernel regression and separate the presentation from your initial estimator,\n   - discuss notions that you use when it is unclear what these things are; e.g., \"bandwidth\".\n   - define functions that you use without explanations at the moment; e.g., in (18) we see Clip and med; what are the arguments and what do these functions do?\n\n+ References not in alphabetical order.\n\n+ In line 52-54, you indicate that your approach is similar to a combination of an $\\ell_1$ and $\\ell_2$ loss functions. At that point in the text, I was expecting a comparison with \"elastic nets\"; you may want to consider adding a small comment, or consider rephrasing and avoid such expectations from the readers.\n\n+ The order by which some things are presented should probably change. For example, in lines 115-124, I think you need to give a slightly better explanation so that the reader can get better intuition, and moreover, this discussion should come up before you lay out the equations of the method that you propose.\n\n+ You cannot start sentences with as in lines 167 or 168. You could add a word like \"Part\" or \"Parts\" in the beginning and make it read more naturally even if it takes a bit more space.\n\n+ Larger font size in Figure 1 is expected.\n\n+ It would be nice to see some commentary on the bounds and argue how they compare against each other and potentially compared to other methods that you cite in the literature. \n\n+ In general, you have no comparison with parametric methods, either in theory, or in the experiments. Alternatively, provide an explanation as to why you don't have such comparisons.\n\n+ It is unfortunate and normally it should not be an issue, but the authors need help on writing a paper that has fewer spelling or expression mistakes. The additional problem here is that the authors also have a big appendix, which I suspect is written similarly along the main text. So, fixing the main text is not enough. The paper needs to be proofread by someone in its entirety, including the appendix of the authors.\n\nI think that you have a very interesting story to tell, but the paper needs restructuring and better presentation of what you have accomplished.\n\nQUESTIONS:\nQ1. In line 152, you define $D$ but this parameter does not show up anywhere.\n\nQ2. In line 243, what is a \"linear filter\"? \n\nQ3. In line 276, what do you mean by \"optimal bandwidth\"?\n\nQ4. In line 308, what do you mean by \"number of grids\"?\n\nQ5. What is $m$ in (18)?\n\nQ6. Why don't you have some comparisons with parametric methods?\n\nLIMITATIONS:\nN/A", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}

comments: SUMMARY:
This paper studies nonparametric regression, where an adversary can corrupt $q$ samples from the training set. The paper proposes robust estimators for this problem.

STRENGTHS:
The paper studied the Huber loss minimization approach under adversarial noise, giving theoretical upper bounds and lower bounds.

WEAKNESSES:
The organization could be improved, e.g. the last two paragraphs of section 3 could conceivably be placed elsewhere. 

Some aspects of this paper are not really my area, so I cannot provide many helpful comments.

QUESTIONS:
Equation 2 and 3, what is expectation taken over?

LIMITATIONS:
The author addressed limitations.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-06