Adversarial Attacks on Probabilistic Autoregressive Forecasting - PowerPoint PPT Presentation

ICML 2020 Raphaël Dang-Nhu Gagandeep Singh Pavol Bielik Martin Vechev Department of Computer Science, ETH Zürich dangnhur@ethz.ch 1 Adversarial Attacks on Probabilistic Autoregressive Forecasting Models

2 (i) Probabilistic forecasting model 1 Blundell et al., Weight Uncertainty in Neural Networks, ICML 2015 Monte-Carlo sampling • Complex resulting output distribution, approximated via • Multiple sources of noise: (i) each timestep, (ii) each weight 1 (ii) Bayesian neural network Neural architectures with stochastic behavior 1600 1400 1200 1000 800 600 400 −10 −5 0 5 10 15 20

2 (i) Probabilistic forecasting model 1 Blundell et al., Weight Uncertainty in Neural Networks, ICML 2015 Monte-Carlo sampling • Complex resulting output distribution, approximated via • Multiple sources of noise: (i) each timestep, (ii) each weight 1 (ii) Bayesian neural network Neural architectures with stochastic behavior 1600 1400 1200 1000 800 600 400 −10 −5 0 5 10 15 20

2 (i) Probabilistic forecasting model 1 Blundell et al., Weight Uncertainty in Neural Networks, ICML 2015 Monte-Carlo sampling • Complex resulting output distribution, approximated via • Multiple sources of noise: (i) each timestep, (ii) each weight 1 (ii) Bayesian neural network Neural architectures with stochastic behavior 1600 1400 1200 1000 800 600 400 −10 −5 0 5 10 15 20

2 (i) Probabilistic forecasting model 1 Blundell et al., Weight Uncertainty in Neural Networks, ICML 2015 Monte-Carlo sampling • Complex resulting output distribution, approximated via • Multiple sources of noise: (i) each timestep, (ii) each weight 1 (ii) Bayesian neural network Neural architectures with stochastic behavior 1600 1400 1200 1000 800 600 400 −10 −5 0 5 10 15 20

3 • Stochastic sequence model • Generates several prediction traces Handwriting generation WaveNet for raw audio Traditionally used as a generative model Focus of this work: probabilistic forecasting models 1600 1400 1200 1000 800 600 400 −10 −5 0 5 10 15 20

3 • Stochastic sequence model • Generates several prediction traces Handwriting generation WaveNet for raw audio Traditionally used as a generative model Focus of this work: probabilistic forecasting models 1600 1400 1200 1000 800 600 400 −10 −5 0 5 10 15 20

Integrated in Amazon Sagemaker (DeepAR architecture) • Allows to predict volatility of the time-series. • Useful with low signal-to-noise ratio. Key idea: use generated traces as Monte-Carlo samples to estimate the evolution of the time-series Stock prices Electricity consumption Business sales 2 Salinas et al., DeepAR: Probabilistic forecasting with autoregressive recurrent networks, International Journal of Forecasting, 2020 4 Probabilistic forecasting models for decision-making 2

• Allows to predict volatility of the time-series. • Useful with low signal-to-noise ratio. Key idea: use generated traces as Monte-Carlo samples to estimate the evolution of the time-series Stock prices Electricity consumption Business sales 2 Salinas et al., DeepAR: Probabilistic forecasting with autoregressive recurrent networks, International Journal of Forecasting, 2020 4 Probabilistic forecasting models for decision-making 2 Integrated in Amazon Sagemaker (DeepAR architecture)

We aim at providing an ofg-the-shelf methodology for these attacks • Adaptation of gradient-based adversarial attacks to these new attack objectives for stochastic models • Main technical aspect: developing estimators for propagating the objective gradient through the Monte-Carlo approximation 5 Contributions • New class of attack objectives based on output statistics

We aim at providing an ofg-the-shelf methodology for these attacks • Adaptation of gradient-based adversarial attacks to these new attack objectives for stochastic models • Main technical aspect: developing estimators for propagating the objective gradient through the Monte-Carlo approximation 5 Contributions • New class of attack objectives based on output statistics

We aim at providing an ofg-the-shelf methodology for these attacks • Adaptation of gradient-based adversarial attacks to these new attack objectives for stochastic models • Main technical aspect: developing estimators for propagating the objective gradient through the Monte-Carlo approximation 5 Contributions • New class of attack objectives based on output statistics

We aim at providing an ofg-the-shelf methodology for these attacks • Adaptation of gradient-based adversarial attacks to these new attack objectives for stochastic models • Main technical aspect: developing estimators for propagating the objective gradient through the Monte-Carlo approximation 5 Contributions • New class of attack objectives based on output statistics

• Adaptation of gradient-based adversarial attacks to these new attack objectives for stochastic models • Main technical aspect: developing estimators for propagating the objective gradient through the Monte-Carlo approximation 5 Contributions • New class of attack objectives based on output statistics We aim at providing an ofg-the-shelf methodology for these attacks

Class of attack objectives

Untargeted attacks on information divergence D with the original predicted distribution D q x q x Untargeted/Targeted attacks on the mean of the distribution distance q x y target 6 Stochastic model with input x , and output y ∼ q x ( · ) . Previously considered attack objectives:

Untargeted attacks on information divergence D with the original predicted distribution Untargeted/Targeted attacks on the mean of the distribution distance q x y target 6 Stochastic model with input x , and output y ∼ q x ( · ) . Previously considered attack objectives: max D ( q x + δ ∥ q x ) δ

Untargeted attacks on information divergence D with the original predicted distribution Untargeted/Targeted attacks on the mean of the distribution 6 Stochastic model with input x , and output y ∼ q x ( · ) . Previously considered attack objectives: max D ( q x + δ ∥ q x ) δ ( ) min E q x + δ [ y ] , target δ distance

Extensions: • Bayesian setting q x y z . This corresponds to minimizing distance q x y target • Generalization to simultaneous attack of several statistics. • Statistics depending on x . 7 Framework We perform a targeted attack on a statistic χ ( y ) of the output.

Extensions: • Bayesian setting q x y z . This corresponds to minimizing distance • Generalization to simultaneous attack of several statistics. • Statistics depending on x . 7 Framework We perform a targeted attack on a statistic χ ( y ) of the output. ( ) E q x + δ [ χ ( y )] , target

This corresponds to minimizing distance • Generalization to simultaneous attack of several statistics. • Statistics depending on x . 7 Framework We perform a targeted attack on a statistic χ ( y ) of the output. ( ) E q x + δ [ χ ( y )] , target Extensions: • Bayesian setting q x ( y | z ) .

average i y i 1 i y i i y i Limit sell order Our framework allows to specifically target one of these options threshold y h Barrier option threshold 8 Consider a stock with Asian call option 0 y h European call option Observation z y Name Motivation 1: option pricing in finance • past prices x = ( p 1 , . . . , p t − 1 ) • predicted future prices y = ( p t , . . . , p T ) .

8 Consider a stock with Our framework allows to specifically target one of these options y h Name Barrier option Observation z European call option Limit sell order Asian call option Motivation 1: option pricing in finance • past prices x = ( p 1 , . . . , p t − 1 ) • predicted future prices y = ( p t , . . . , p T ) . χ ( y ) max( 0 , y h ) average i ( y i ) [ ] max i y i ≥ threshold 1 max i y i ≥ threshold

8 Consider a stock with Our framework allows to specifically target one of these options y h Name Barrier option Observation z European call option Limit sell order Asian call option Motivation 1: option pricing in finance • past prices x = ( p 1 , . . . , p t − 1 ) • predicted future prices y = ( p t , . . . , p T ) . χ ( y ) max( 0 , y h ) average i ( y i ) [ ] max i y i ≥ threshold 1 max i y i ≥ threshold

uncertainty constraints for the adversarial example. q x y k . to detect adversarial examples. New attacks bypass these defenses by enforcing Our framework allows to express these constraints, with • The entropy q x q y x . • The distribution’s moments 9 Motivation 2: attacking model uncertainty Some defenses use prediction uncertainty

q x y k . to detect adversarial examples. New attacks bypass these defenses by enforcing Our framework allows to express these constraints, with • The entropy q x q y x . • The distribution’s moments 9 Motivation 2: attacking model uncertainty Some defenses use prediction uncertainty uncertainty constraints for the adversarial example.

to detect adversarial examples. New attacks bypass these defenses by enforcing Our framework allows to express these constraints, with 9 Motivation 2: attacking model uncertainty Some defenses use prediction uncertainty uncertainty constraints for the adversarial example. • The entropy E q x [ − log( q [ y | x ])] . • The distribution’s moments E q x [ y k ] .

Details about the estimators