Poisoning Bayesian Inference via Data Deletion and Replication
This work addresses the security of Bayesian machine learning models for practitioners in adversarial contexts, though it is incremental as it extends existing poisoning paradigms to Bayesian methods.
The paper tackles the vulnerability of Bayesian inference to adversarial attacks by developing methods that strategically delete and replicate true observations to steer the posterior toward a target distribution, achieving substantive belief alteration with relatively little effort and surgical precision in corrupting targeted inferences.
Research in adversarial machine learning (AML) has shown that statistical models are vulnerable to maliciously altered data. However, despite advances in Bayesian machine learning models, most AML research remains concentrated on classical techniques. Therefore, we focus on extending the white-box model poisoning paradigm to attack generic Bayesian inference, highlighting its vulnerability in adversarial contexts. A suite of attacks are developed that allow an attacker to steer the Bayesian posterior toward a target distribution through the strategic deletion and replication of true observations, even when only sampling access to the posterior is available. Analytic properties of these algorithms are proven and their performance is empirically examined in both synthetic and real-world scenarios. With relatively little effort, the attacker is able to substantively alter the Bayesian's beliefs and, by accepting more risk, they can mold these beliefs to their will. By carefully constructing the adversarial posterior, surgical poisoning is achieved such that only targeted inferences are corrupted and others are minimally disturbed.