Hard Work Does Not Always Pay Off: Poisoning Attacks on Neural Architecture Search

TL;DR

This paper evaluates the robustness of neural architecture search (NAS) methods against data poisoning attacks, revealing varying levels of vulnerability and robustness among different NAS algorithms on benchmark datasets.

Contribution

The study introduces a systematic poisoning framework to assess NAS robustness and compares multiple NAS algorithms under data poisoning, highlighting their vulnerabilities and robustness factors.

Findings

Training-based NAS algorithms are least robust due to data reliance.

Training-free NAS approaches are most robust but less accurate.

NAS can still improve accuracy with out-of-distribution data under attack.

Abstract

We study the robustness of data-centric methods to find neural network architectures, known as neural architecture search (NAS), against data poisoning. To audit this robustness, we design a poisoning framework that enables the systematic evaluation of the ability of NAS to produce architectures under data corruption. Our framework examines four off-the-shelf NAS algorithms, representing different approaches to architecture discovery, against four data poisoning attacks, including one we tailor specifically for NAS. In our evaluation with the CIFAR-10 and CIFAR-100 benchmarks, we show that NAS is \emph{seemingly} robust to data poisoning, showing marginal accuracy drops even under large poisoning budgets. However, we demonstrate that when considering NAS algorithms designed to achieve a few percentage points of accuracy gain, this expected improvement can be substantially diminished under data poisoning. We also show that the reduction varies across NAS algorithms and analyze the factors contributing to their robustness. Our findings are: (1) Training-based NAS algorithms are the least robust due to their reliance on data. (2) Training-free NAS approaches are the most robust but produce architectures that perform similarly to random selections from the search space. (3) NAS algorithms can produce architectures with improved accuracy, even when using out-of-distribution data like MNIST. We lastly discuss potential countermeasures. Our code is available at: https://github.com/ztcoalson/NAS-Robustness-to-Data-Poisoning