Towards One Shot Search Space Poisoning in Neural Architecture Search

We evaluate the robustness of a Neural Architecture Search (NAS) algorithm known as Efficient NAS (ENAS) against data agnostic poisoning attacks on the original search space with carefully designed ineffective operations. We empirically demonstrate how our one shot search space poisoning approach exploits design flaws in the ENAS controller to degrade predictive performance on classification tasks. With just two poisoning operations injected into the search space, we inflate prediction error rates for child networks upto 90% on the CIFAR-10 dataset.


Introduction
The problem of finding optimal deep learning architectures has recently been automated by neural architecture search (NAS) algorithms. These algorithms continually sample operations from a predefined search space to construct neural networks to optimize a performance metric over time, eventually converging to better child architectures. This intuitive idea greatly reduces human intervention by restricting human bias in architecture engineering to just the selection of the predefined search space (Elsken et al. 2019). Although NAS has the potential to revolutionize architecture search across many applications, human selection of the search space remains a security risk that needs to be evaluated before NAS can be deployed in security-critical domains. While NAS has been studied to further develop more adversarially robust networks through addition of dense connections (Guo et al. 2020), little work has been done in the past to assess the adversarial robustness of NAS itself. Search phase analysis has shown that computationally efficient algorithms such as ENAS are worse at truly ranking child networks due to their reliance on weight sharing (Yu et al. 2019). Finally, most traditional poisoning attacks involve injecting mislabeled examples in the training data and have been executed against classical machine learning approaches (Schwarzschild et al. 2021). We validate these concerns by evaluating the robustness of one such NAS algorithm known as Efficient NAS (ENAS) (Pham et al. 2018) against data-agnostic search space poisoning (SSP) attacks on the CIFAR-10 dataset. Throughout this paper, we focus on the pre-optimized ENAS search spaceŜ = {Identity, 3x3 Separable Convolution, 5x5 Separable Convolution, Max Pooling (3x3), Average Pooling (3x3)} (Pham et al. 2018).

Search Space Poisoning (SSP)
The idea behind SSP, as shown in Figure 1, is to inject precisely designed multiset P of ineffective operations into the ENAS search space, making the search space S :=Ŝ ∪ P. Our approach exploits the core functionality of the ENAS controller to sample child networks from a large computational graph of operations by introducing highly ineffective local operations into the search space. On the attacker's behalf, this requires no a priori knowledge of the problem domain or dataset being used, making this new approach more favourable than traditional data poisoning attacks.

Multiple-Instance Poisoning
As a naïve strategy, we first propose multiple-instance poisoning which increases the likelihood of sampling bad operations by including duplicates of these bad operations in the search spaces. Through experimental results we discovered that biasing the search space this way resulted in final networks that are mostly comprised of these poor operations with error rates exceeding 80%. However, as shown in Figure 2, to perform well this approach requires overwhelming the original search space with up to 300 bad operations (50:1 ratio of bad operations per each good operation) which is unreasonable. The motivation then is to reduce the ratio of bad to good operations down to 1:1, or even lower, to make search space poisoning more feasible and effective.

Towards One Shot Poisoning
In an attempt to improve the attack, we further attempted to reduce the number of poisoning points to just 2 points by adding: (i) Dropout(p = 1) (ii) Stretched Conv(k = 3, padding, dilation = 50) to the original search space. Our rationale is that dropout operations with p = 1 would erase all information and produce catastrophic values such as 0 or not-a-number (NaN). The results were promising, with error rates shooting up to 90% very quickly during training as seen in Figure 3 and Table 1. An example final child network producing these high errors can be observed in Figure 4.   Figure 4: Network produced by ENAS after one shot poisoning with good operations highlighted in green and poisoning operations highlighted in red. Search space utilized is the same as shown in Table 1 with two poisoning points.

Conclusion
In this paper, we focused on examining the robustness of ENAS under our newly proposed SSP paradigm. Our carefully designed poisoning sets demonstrated the potential to make it incredibly easy for an attacker with no prior knowledge or access to the training data to still drastically impact the quality of child networks. Finally, our one-shot poisoning results reveal an opportunity for future work in neural architecture design, as well as challenges to surmount in using NAS for more adversarially robust architecture.

Supplementary Material
Search Space Poisoning (SSP)

Multiple-Instance Poisoning Attacks
Over the course of training, the LSTM controller paired with the RL search strategy in ENAS develops the ability to sample architectures with operations that most optimally reduce the validation error. We propose multiple-instance poisoning which essentially increases the likelihood of a poisonous operation o P being sampled from the poisoned search space S. This is achieved by increasing the frequency of sampling o P from S through the inclusion of multiple-instances of each o P from the poisoning multiset, so-called to allow for duplicate elements. An instance factor q ∈ N ≥1 represents instance multiplication of o P in the multiset q times. Henceforth, the probabilities of sampling oŜ ∈Ŝ and o P ∈ P, respectively, are, P r[oŜ] := 1 |S|+q|P| and P r[o P ] := q |S|+q|P| . From which, it is evident that under a multiple-instance poisoning framework, the probability of sampling poisoned operations is strictly greater than sampling operations inŜ; that is, P r[oŜ] < P r[o P ]. It is also important to note that our technique is not the typical image-agnostic perturbation/universal adversarial perturbation δ ∈ R d intended to fool the target neural network f on almost all the input images from the target distribution X. Finally, another challenge to overcome within our search space poisoning framework is to craft each o P ∈ P such that it counteracts the efficacy of the original operations oŜ ∈Ŝ, which we tackle in the next section.

Crafting Poisoning Sets with Operations
Identity Operation The simplest way to attack the functionality of ENAS is to inject non-operations within the original search space which keep the input and outputs intact. As a result, the controller will sample child models with layers representing computations which preserve the inputs, making the operation highly ineffective within a network architecture. This goal is achieved by the inexpensive identity operation which has no numerical effect on the inputs. It should also be noted that, the identity operation is not a skip connection. Therefore, we define our first poisoning set: P 1 := {Identity}.
Gaussian Noise Layer Typically used in signal processing, electronics and mitigating over-fitting as some form of random data augmentation. Gaussian noise is a type of statistical noise which is in the form of a Normal distribution (X ∼ N (µ, σ 2 )). In PyTorch/Keras, the Gaussian noise layer additively applies zero-centered Gaussian noise passing in the argument of relative standard deviation used to generate the noise. We hypothesize that including such layers with increasingly varied relative standard deviations such as σ = 10, can significantly impact the accuracy of the generated child models making our poisoning set P 2 := {Gaussian (σ = 10)}.
Dropout Layer While dropout layers have historically been shown to be useful in preventing neural networks from over-fitting (Srivastava et al. 2014), a high dropout rate can result in severe information loss leading to poor performance of the overall network. This is because given a dropout probability p ∈ [0, 1], dropout randomly zeroes out some values from the input to decorrelate neurons during training. We hypothesize that including such layers with high dropout probability, such as p = 1, has the potential to contaminate the search space with irreversible effects on the training dynamics of ENAS. Here, we define our poisoning set as P 3 := {Dropout (p = 1)}.
Transposed Convolutions As described earlier, amongst other useful operations the original ENAS search spaceŜ also contains 3x3 and 5x5 convolutional layers (separable). Intuitively, transposed convolutions upsample the input feature map. It is important to note that transposed convolutions do not perform like deconvolutional layers; they actually swap the forward and backward passes of a convolution. Transposed convolutions, also known as fractionally strided convolutions, stride over the output which is equivalent to a fractional stride over the input. We define our poisoning set: P 4 = {3x3 transposed convolution, 5x5 transposed convo-lution}.

Experiments
Experimental Setup To test the effectiveness of our proposed approach, we designed experiments based on previously described methods outlined in Table 1. Each experiment involved training ENAS on the CIFAR-10 dataset for 300 epochs. The results presented in this paper are the average of three runs per experiment.
For a baseline, we created an experiment with the original search spaceŜ (which was run three times). Because we wanted to evaluate the poisoning effectiveness of each operation independently, we created a group of four experiments for each poisoning set P i . We henceforth refer to these experiments as "Space ia" through "Space id". Following multiple-instance poisoning attacks, each experiment includes a poisoning multiset q(P i ) where |q(P i )| = 6, 36, 120, 300 for Space ia, Space ib, Space ic, Space id, respectively. Of note is that the instance-factor q is dependent on the experiment index and |P i |. For example: Space 1c/2c/3c has |P 1 | = |P 2 | = |P 3 | = 1, and q|P 1 | = q|P 2 | = q|P 3 | = 120, so q = 120; Space 4c has |P 4 | = 2 and q|P 4 | = 120, so q = 60; Space 5c/6c have |P 5 | = |P 6 | = 6 and q|P 5 | = q|P 6 | = 120, so q = 20.

Our Files
• The files in which these extended search spaces can be found are in enas poisoning/. • Initial experimental results can be found in ENAS-Experiments/results.