Foundations — Data poisoning and backdoor attacks

6.4.11 · D1 · AI-ML › AI Safety & Alignment › Data poisoning and backdoor attacks

Is page par assume kiya gaya hai ki tumne parent note ki koi bhi notation pehle nahi dekhi. Hum har symbol ko ek picture se build karenge, tab formula mein use karenge. Upar se neeche padho — har idea uske upar wale idea pe lean karta hai.

---

1. "Example" kya hota hai? Pair $(\mathbf{x},y)$

Sab kuch ek single training example se shuru hota hai. Ek example ek sawaal aur uska jawaab ek saath jodd ke hota hai.

Picture dekho: input numbers ka ek bag hai, label usse chipka hua tag hai.

• Bold ka matlab hai "vector" ::: numbers ki ek list (saare pixels / features), ek number nahi
• $y$ ko kehte hain ::: label, wo sahi jawaab jo model ko produce karna sikhna chahiye

---

2. Subscript $i$ aur dataset — examples ginना

Ek example kaafi nahi hota. Model poori pile se seekhta hai.

• $n$ count karta hai ::: training examples ki total sankhya
• $i$ ek ::: counter / index hai jo ek particular example ko naam deta hai

---

3. Model $f_{\theta }$ — pattern-copying machine

Ab wo machine jo input leti hai aur jawaab guess karti hai.

• $\theta$ (theta) represent karta hai ::: model ke andar saare tunable numbers (weights)
• $f_{\theta }(\mathbf{x})$ ka matlab hai ::: model chalao, knobs $\theta$ par set hokar, input $\mathbf{x}$ par
• ${\theta }^{\ast }$ mein star ka matlab hai ::: training ke baad mile best / final knob values

---

4. Loss $\ell$ — "kitna galat" measure karna

Knobs sensibly ghumaane ke liye machine ko apni galtiyon ka score chahiye.

Meter dekho: jab guess truth se milti hai to needle $0$ par hoti hai; jitni door hogi utna zyaada upar jaayegi.

• Loss $\ell$ output karta hai ::: ek single number: ek guess kitni galat thi (0 = perfect)
• Wrongness meter kaun sa symbol hai — $f$, $\theta$, ya $\ell$? ::: $\ell$ (script-ell)

---

5. Empirical risk $\mathcal{L}(\theta )$ — poori pile par average wrongness

Ek example ki wrongness kaafi nahi; hum chahte hain machine average mein acchi ho.

Isko ek piece ek baar, left se right padhte hain:

1. $\mathcal{L}(\theta )$ — ek capital script-L: poori pile ki total wrongness, knob setting $\theta$ ka function. (Note: chhota $\ell$ = ek example, bada $\mathcal{L}$ = poori pile.)
2. $\sum _{i=1}^n$ — sum sign (Greek capital sigma). Matlab hai "daayein taraf ki cheez jodo, ek baar har $i$ ke liye $1$ se $n$ tak." Sum kyun? kyunki hum saare examples ki wrongness chahte hain, sirf ek ki nahi.
3. $\ell (f_{\theta }({\mathbf{x}}_i),y_i)$ — example $i$ par wrongness (Section 4 se).
4. $\frac{1}{n}$ — count se divide karo. Kyun? total ko average mein badalna, taaki 10 ki pile aur ek million ki pile comparable hon.

• $\sum$ (sigma) tumhe bolta hai ::: daayein taraf ki term ko jodo, ek baar har index value ke liye
• $n$ se divide kyun karte hain? ::: total wrongness ko average wrongness mein badalne ke liye
• $\arg {\min }_{\theta }$ return karta hai ::: wo $\theta$ ki value jo expression ko sabse chhota banati hai

---

6. Perturbation $\delta$ aur uski size $\Vert \delta {\Vert }_2$

Parent note inputs ke saath chhedchaad karta hai: ${\mathbf{x}}_p=\mathbf{x}+\delta$, with $\Vert \delta {\Vert }_2<ϵ$. Do naye symbols.

• $\delta$ hai ::: input mein add kiya ek chhota nudge jo use thoda badal deta hai
• $\Vert \delta {\Vert }_2<ϵ$ matlab hai ::: nudge ki total size ek tiny budget ke andar rehti hai (invisible rehti hai)

---

7. Trigger function $t$ aur map $\mathcal{X}$

Backdoor part ko ek aur cheez chahiye: trigger.

• $\mathcal{X}$ (script-X) hai ::: un saare possible inputs ka set jo model dekh sakta hai
• Plain $t(\mathbf{x})$ produce karta hai ::: input jisme secret trigger pattern stamp ho (ek function/action)
• Bold $\mathbf{t}$ hai ::: trigger pattern khud — ek picture/vector, $\mathbf{x}$ jaisa
• "$t:\mathcal{X}\to \mathcal{X}$" mein $A\to B$ matlab hai ::: type $A$ ki kuch cheez leta hai, type $B$ ki kuch cheez return karta hai

---

8. Target label $y_{\text{target}}$, counts $\#$, aur rates

Teen aakhri pieces: wo label jo attacker chahta hai, "count of" ka symbol, aur unse bane fractions.

Ab do rates, dono 0 aur 1 ke beech fractions (zyaadatar percent mein dikhaye jaate hain):

• $y_{\text{target}}$ hai ::: wo galat label jo attacker trigger present hone par chahta hai
• Symbol $\#$ matlab hai ::: "kitne" — ek plain count / tally
• ASR measure karta hai ::: un triggered inputs ka fraction jo attacker ke target class $y_{\text{target}}$ par jaate hain
• Blended trigger mein $\alpha \approx 0.1$ matlab hai ::: trigger picture $\mathbf{t}$ faintly mix ho raha hai (mostly original image)

---

Prerequisite map

$H$ ke left mein jo kuch bhi hai wo solid hona chahiye tab hi parent note samajh mein aayegi. Topic phir Robust Machine Learning, Certified Defenses, aur defence ideas jaise Differential Privacy, Explainable AI, AI Red Teaming, Federated Learning Security, aur Model Provenance and Supply Chain mein aage jaata hai.

---

Equipment checklist

Daayein side cover karo aur khud test karo. Agar koi bhi jawaab fuzzy lage, parent note kholne se pehle woh section dobara padho.

• Ek training example likha jaata hai ::: pair $(\mathbf{x},y)$ ke roop mein — input aur uska sahi label
• Bold $\mathbf{x}$ signal karta hai ::: ek vector — numbers ki poori list (saare features/pixels)
• ${\mathbf{x}}_i$ mein subscript ::: ek counter hai jo $i$-vaana example naam deta hai (power nahi)
• $n$ hai ::: training set mein kitne examples hain
• $f_{\theta }$ hai ::: model (machine) jiske knobs $\theta$ values par set hain
• $\theta$ (theta) hai ::: model ke andar tunable weights ka bag
• ${\theta }^{\ast }$ hai ::: training khatam hone ke baad final knob values
• $\ell$ (chhota ell) hai ::: loss — ek guess ki wrongness (0 = perfect)
• $\mathcal{L}(\theta )$ (bada L) hai ::: poori training pile par average loss
• ${\sum }_{i=1}^n$ tumhe bolta hai ::: term ko ek baar har $i$ ke liye 1 se $n$ tak jodo
• Risk mein $\frac{1}{n}$ ::: total ko average mein badalta hai
• $\arg {\min }_{\theta }$ return karta hai ::: $\theta$ ki woh value jo expression ko sabse chhota banati hai
• $\delta$ (delta) hai ::: ek input mein add kiya ek chhota nudge
• $\Vert \delta {\Vert }_2<ϵ$ matlab hai ::: nudge ki total length ek tiny budget ke andar rehti hai (invisible)
• $\mathcal{X}$ (script-X) hai ::: saare possible inputs ka set
• Plain $t(\mathbf{x})$ hai ::: input jisme secret trigger stamp ho (ek function/action)
• Bold $\mathbf{t}$ hai ::: trigger pattern khud, $\mathbf{x}$ jaisa ek picture/vector
• $y_{\text{target}}$ hai ::: wo galat label jo attacker trigger fire hone par chahta hai
• Symbol $\#$ matlab hai ::: "kitne" — ek plain count
• ASR hai ::: un triggered inputs ka fraction jo attacker ke target class par jaate hain
• Blended trigger mein $\alpha$ hai ::: mixing dial (0 = sirf original, 1 = sirf trigger)