Authorship attribution has become increasingly accurate, posing a serious
privacy risk for programmers who wish to remain anonymous. In this paper, we
introduce SHIELD to examine the robustness of different code authorship
attribution approaches against adversarial code examples. We define four
attacks on attribution techniques, which include targeted and non-targeted
attacks, and realize them using adversarial code perturbation. We experiment
with a dataset of 200 programmers from the Google Code Jam competition to
validate our methods targeting six state-of-the-art authorship attribution
methods that adopt a variety of techniques for extracting authorship traits
from source-code, including RNN, CNN, and code stylometry. Our experiments
demonstrate the vulnerability of current authorship attribution methods against
adversarial attacks. For the non-targeted attack, our experiments demonstrate
the vulnerability of current authorship attribution methods against the attack
with an attack success rate exceeds 98.5\% accompanied by a degradation of the
identification confidence that exceeds 13\%. For the targeted attacks, we show
the possibility of impersonating a programmer using targeted-adversarial
perturbations with a success rate ranging from 66\% to 88\% for different
authorship attribution techniques under several adversarial scenarios.

本文介绍了 SHIELD，对六种当前最先进的作者归属方法进行攻击后的实验，通过在 Google Code Jam 竞赛中利用 200 个编程者数据集，从非有目标攻击和有目标攻击两个方向对不同的代码归属提取技术进行了实验，发现现有的作者归属方法对抗攻击的脆弱性，并对攻击成功率和身份识别信任度的影响进行了分析。

SHIELD: 阻止代码署名归属

SHIELD: Thwarting Code Authorship Attribution

Agents that operate in an unknown environment are bound to make mistakes
while learning, including, at least occasionally, some that lead to
catastrophic consequences. When humans make catastrophic mistakes, they are
expected to learn never to repeat them, such as a toddler who touches a hot
stove and immediately learns never to do so again. In this work we consider a
novel class of POMDPs, called POMDP with Catastrophic Actions (POMDP-CA) in
which pairs of states and actions are labeled as catastrophic. Agents that act
in a POMDP-CA do not have a priori knowledge about which (state, action) pairs
are catastrophic, thus they are sure to make mistakes when trying to learn any
meaningful policy. Rather, their aim is to maximize reward while never
repeating mistakes.
As a first step of avoiding mistake repetition, we leverage the concept of a
shield which prevents agents from executing specific actions from specific
states.
In particular, we store catastrophic mistakes (unsafe pairs of states and
actions) that agents make in a database. Agents are then forbidden to pick
actions that appear in the database. This approach is especially useful in a
continual learning setting, where groups of agents perform a variety of tasks
over time in the same underlying environment. In this setting, a task-agnostic
shield can be constructed in a way that stores mistakes made by any agent, such
that once one agent in a group makes a mistake the entire group learns to never
repeat that mistake. This paper introduces a variant of the PPO algorithm that
utilizes this shield, called ShieldPPO, and empirically evaluates it in a
controlled environment.
Results indicate that ShieldPPO outperforms PPO, as well as baseline methods
from the safe reinforcement learning literature, in a range of settings.

本文提出一种新型的部分可观测马尔可夫决策过程类别 -- 带有灾难性行动（POMDP-CA），通过引入一个叫做 shield 的概念，该方法可以避免智能体在学习时重复犯错、并在长期的、复杂的环境中实现习得控制策略的目标。

从灾难性行动效应中学习防护措施：不要重复同样的错误

Learning a Shield from Catastrophic Action Effects: Never Repeat the Same Mistake

In this appraisal paper, we evaluate the efficacy of SHIELD, a
compression-based defense framework for countering adversarial attacks on image
classification models, which was published at KDD 2018. Here, we consider
alternative threat models not studied in the original work, where we assume
that an adaptive adversary is aware of the ensemble defense approach, the
defensive pre-processing, and the architecture and weights of the models used
in the ensemble. We define scenarios with varying levels of threat and
empirically analyze the proposed defense by varying the degree of information
available to the attacker, spanning from a full white-box attack to the
gray-box threat model described in the original work. To evaluate the
robustness of the defense against an adaptive attacker, we consider the
targeted-attack success rate of the Projected Gradient Descent (PGD) attack,
which is a strong gradient-based adversarial attack proposed in adversarial
machine learning research. We also experiment with training the SHIELD ensemble
from scratch, which is different from re-training using a pre-trained model as
done in the original work. We find that the targeted PGD attack has a success
rate of 64.3% against the original SHIELD ensemble in the full white box
scenario, but this drops to 48.9% if the models used in the ensemble are
trained from scratch instead of being retrained. Our experiments further reveal
that an ensemble whose models are re-trained indeed have higher correlation in
the cosine similarity space, and models that are trained from scratch are less
vulnerable to targeted attacks in the white-box and gray-box scenarios.

本文评估用于对抗敌对攻击的压缩式防御框架 SHIELD 的效力，并在原有工作的基础上考虑了替代威胁模型，提出了具有不同危险程度的情况，并通过实验结果得出了在白盒和灰盒情景下训练模型的相关性与承受目标攻击成功率的相关性，证明了从零开始训练模型的更强鲁棒性。