攻击记忆分数：用伪逆法让模型误判数据重要性
Efficiently Attacking Memorization Scores
- 用输入的伪逆构造对抗样本，黑盒攻击记忆分数
- 实验证明多种图像分类任务下分数可被精准操纵
- 揭示影响估计在高精度模型下天然脆弱，适合安全研究者
影响度量工具（如记忆分数）被广泛用于理解模型行为、归属训练数据和指导数据集清理。然而，在数据估值与负责任机器学习的应用中，一个关键问题浮现：这些分数是否可被恶意操控？本文系统研究了基于记忆的影响度量攻击可行性。我们发现，在模型准确率较高的情况下，生成高度记忆化样本相当于对敏感查询的攻击。所提出的攻击方法（计算输入的伪逆）仅需访问模型输出，计算开销小且实际可行。我们在多个图像分类任务中验证了该攻击，表明即使是最先进的代理指标也易受定向分数操纵。此外，我们提供了理论分析，揭示了在对抗扰动下记忆分数稳定性的条件，揭示影响估计的本质脆弱性。研究结果凸显了基于影响的归因机制的关键漏洞，提示亟需构建鲁棒防御。所有代码见：https://github.com/tuedo2/MemAttack
原文摘要 · Abstract (English)
Influence estimation tools -- such as memorization scores -- are widely used to understand model behavior, attribute training data, and inform dataset curation. However, recent applications in data valuation and responsible machine learning raise the question: can these scores themselves be adversarially manipulated? In this work, we present a systematic study of the feasibility of attacking memorization-based influence estimators. We characterize attacks for producing highly memorized samples as highly sensitive queries in the regime where a trained algorithm is accurate. Our attack (calculating the pseudoinverse of the input) is practical, requiring only black-box access to model outputs and incur modest computational overhead. We empirically validate our attack across a wide suite of image classification tasks, showing that even state-of-the-art proxies are vulnerable to targeted score manipulations. In addition, we provide a theoretical analysis of the stability of memorization scores under adversarial perturbations, revealing conditions under which influence estimates are inherently fragile. Our findings highlight critical vulnerabilities in influence-based attribution and suggest the need for robust defenses. All code can be found at https://github.com/tuedo2/MemAttack
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。