Gaussian processes (GP) are a widely-adopted tool used to sequentially
optimize black-box functions, where evaluations are costly and potentially
noisy. Recent works on GP bandits have proposed to move beyond random noise and
devise algorithms robust to adversarial attacks. This paper studies this
problem from the attacker's perspective, proposing various adversarial attack
methods with differing assumptions on the attacker's strength and prior
information. Our goal is to understand adversarial attacks on GP bandits from
theoretical and practical perspectives. We focus primarily on targeted attacks
on the popular GP-UCB algorithm and a related elimination-based algorithm,
based on adversarially perturbing the function $f$ to produce another function
$\tilde{f}$ whose optima are in some target region $\mathcal{R}_{\rm target}$.
Based on our theoretical analysis, we devise both white-box attacks (known $f$)
and black-box attacks (unknown $f$), with the former including a Subtraction
attack and Clipping attack, and the latter including an Aggressive subtraction
attack. We demonstrate that adversarial attacks on GP bandits can succeed in
forcing the algorithm towards $\mathcal{R}_{\rm target}$ even with a low attack
budget, and we test our attacks' effectiveness on a diverse range of objective
functions.

本文从攻击者的角度研究了在高代价和潜在噪音条件下使用 Gaussian processes 进行优化的问题，并提出了不同假设攻击者强度和先前信息的不同对策，通过对函数 $f$ 进行干扰而导致算法朝着目标区域移动。作者设计了白盒和黑盒攻击方法，并展示了这些攻击在低攻击预算下能够成功地将算法强制推向目标区域，并在各种客观函数上测试了攻击的有效性。