Deception by Omission: Using Adversarial Missingness to Poison Causal Structure Learning

TL;DR

This paper introduces a novel adversarial attack method that uses missing data to manipulate causal structure learning, demonstrating its effectiveness against existing algorithms.

Contribution

It presents a new attack approach based on data omission, with theoretical foundations and practical heuristics for Gaussian models, expanding the understanding of data poisoning in causal inference.

Findings

Adversarial missingness can effectively deceive causal structure learning algorithms.

The proposed methods are validated on real and synthetic datasets, showing high attack success.

Theoretical analysis supports the attack mechanisms for arbitrary SCMs.

Abstract

Inference of causal structures from observational data is a key component of causal machine learning; in practice, this data may be incompletely observed. Prior work has demonstrated that adversarial perturbations of completely observed training data may be used to force the learning of inaccurate causal structural models (SCMs). However, when the data can be audited for correctness (e.g., it is crytographically signed by its source), this adversarial mechanism is invalidated. This work introduces a novel attack methodology wherein the adversary deceptively omits a portion of the true training data to bias the learned causal structures in a desired manner. Theoretically sound attack mechanisms are derived for the case of arbitrary SCMs, and a sample-efficient learning-based heuristic is given for Gaussian SCMs. Experimental validation of these approaches on real and synthetic data sets demonstrates the effectiveness of adversarial missingness attacks at deceiving popular causal structure learning algorithms.