Prior work found that superhuman Go AIs like KataGo can be defeated by simple
adversarial strategies. In this paper, we study if simple defenses can improve
KataGo's worst-case performance. We test three natural defenses: adversarial
training on hand-constructed positions, iterated adversarial training, and
changing the network architecture. We find that some of these defenses are able
to protect against previously discovered attacks. Unfortunately, we also find
that none of these defenses are able to withstand adaptive attacks. In
particular, we are able to train new adversaries that reliably defeat our
defended agents by causing them to blunder in ways humans would not. Our
results suggest that building robust AI systems is challenging even in narrow
domains such as Go. For interactive examples of attacks and a link to our
codebase, see this https URL

简单的防御策略无法阻止对超级人类级别的围棋 AI 的自适应攻击。

Go AI 的对抗性鲁棒性能否得以保证？

Can Go AIs be adversarially robust?

We present two categories of model-agnostic adversarial strategies that
reveal the weaknesses of several generative, task-oriented dialogue models:
Should-Not-Change strategies that evaluate over-sensitivity to small and
semantics-preserving edits, as well as Should-Change strategies that test if a
model is over-stable against subtle yet semantics-changing modifications. We
next perform adversarial training with each strategy, employing a max-margin
approach for negative generative examples. This not only makes the target
dialogue model more robust to the adversarial inputs, but also helps it perform
significantly better on the original inputs. Moreover, training on all
strategies combined achieves further improvements, achieving a new
state-of-the-art performance on the original task (also verified via human
evaluation). In addition to adversarial training, we also address the
robustness task at the model-level, by feeding it subword units as both inputs
and outputs, and show that the resulting model is equally competitive, requires
only 1/4 of the original vocabulary size, and is robust to one of the
adversarial strategies (to which the original model is vulnerable) even without
adversarial training.

研究通过使用两类针对生成式对话模型的模型无关对抗策略：不应更改策略和应更改策略以及对它们进行对抗训练，可以使目标对话模型更加稳健，提高其性能。同时，通过在模型层次上解决了鲁棒性问题，可以使模型在扩大的词汇表下变得更具竞争力，并且即使没有对抗训练，也可以对其中一种对抗性策略具有抵御能力。

对话模型的敌对过度敏感性和过度稳定性策略

Adversarial Over-Sensitivity and Over-Stability Strategies for Dialogue  Models

Election control considers the problem of an adversary who attempts to tamper
with a voting process, in order to either ensure that their favored candidate
wins (constructive control) or another candidate loses (destructive control).
As online social networks have become significant sources of information for
potential voters, a new tool in an attacker's arsenal is to effect control by
harnessing social influence, for example, by spreading fake news and other
forms of misinformation through online social media.
We consider the computational problem of election control via social
influence, studying the conditions under which finding good adversarial
strategies is computationally feasible. We consider two objectives for the
adversary in both the constructive and destructive control settings:
probability and margin of victory (POV and MOV, respectively). We present
several strong negative results, showing, for example, that the problem of
maximizing POV is inapproximable for any constant factor. On the other hand, we
present approximation algorithms which provide somewhat weaker approximation
guarantees, such as bicriteria approximations for the POV objective and
constant-factor approximations for MOV. Finally, we present mixed integer
programming formulations for these problems. Experimental results show that our
approximation algorithms often find near-optimal control strategies, indicating
that election control through social influence is a salient threat to election
integrity.

本文研究社交影响下的选举控制问题，分别从正向和反向两个目标出发，通过伪造新闻等方式影响投票结果，探讨计算可行性及算法解决方案。