We evaluate the robustness of a Neural Architecture Search (NAS) algorithm
known as Efficient NAS (ENAS) against data agnostic poisoning attacks on the
original search space with carefully designed ineffective operations. We
empirically demonstrate how our one shot search space poisoning approach
exploits design flaws in the ENAS controller to degrade predictive performance
on classification tasks. With just two poisoning operations injected into the
search space, we inflate prediction error rates for child networks upto 90% on
the CIFAR-10 dataset.

本文研究了神经架构搜索算法 Efficient NAS 对数据毒化攻击的鲁棒性，通过注入无效操作到搜索空间中，我们展示了一次性搜索空间毒化方法如何利用 ENAS 控制器中的设计缺陷，降低分类任务中预测性能，只需向搜索空间注入两个毒化操作即可使得子网络在 CIFAR-10 数据集上的预测错误率增加高达 90%。

神经架构搜索中的单次搜索空间污染

Towards One Shot Search Space Poisoning in Neural Architecture Search

Deep learning has proven to be a highly effective problem-solving tool for
object detection and image segmentation across various domains such as
healthcare and autonomous driving. At the heart of this performance lies neural
architecture design which relies heavily on domain knowledge and prior
experience on the researchers' behalf. More recently, this process of finding
the most optimal architectures, given an initial search space of possible
operations, was automated by Neural Architecture Search (NAS). In this paper,
we evaluate the robustness of one such algorithm known as Efficient NAS (ENAS)
against data agnostic poisoning attacks on the original search space with
carefully designed ineffective operations. By evaluating algorithm performance
on the CIFAR-10 dataset, we empirically demonstrate how our novel search space
poisoning (SSP) approach and multiple-instance poisoning attacks exploit design
flaws in the ENAS controller to result in inflated prediction error rates for
child networks. Our results provide insights into the challenges to surmount in
using NAS for more adversarially robust architecture search.

本文介绍如何使用神经结构搜索来生成深度学习中的最优结构，并通过实验发现数据注入攻击会导致算法效果下降，进而提出提高算法鲁棒性的挑战。