Adversarial Attacks on Stochastic Bandits

Introduction

Designing trustworthy machine learning systems requires understanding how they may be attacked. There has been a surge of interest on adversarial attacks against supervised learning . In contrast, little is known on adversarial attacks against stochastic multi-armed bandits (MABs), a form of online learning with limited feedback. This is potentially hazardous since stochastic MABs are widely used in the industry to recommend news articles , display advertisements , improve search results , allocate medical treatment , and promote users’ well-being , among many others. Indeed, as we show, an adversarial attacker can modify the reward signal to manipulate the MAB for nefarious goals.

The assumption that Alice does not know $\{\mu_{i}\}$ is significant because otherwise Alice can perform the attack trivially. To see this, with the knowledge of $\{\mu_{i}\}$ Alice would be able to compute the truncated reward gap $\Delta^{\epsilon}_{i}=\max\{\mu_{i}-\mu_{K}+\epsilon,0\}\geq 0$ for all non-target arms $i\neq K$ for some small parameter $\epsilon>0$. Alice can perform the following oracle attack: in any round where a non-target arm $I_{t}\neq K$ is pulled, attack with $\alpha_{t}=\Delta^{\epsilon}_{I_{t}}$. This oracle attack transforms the original bandit problem into one where all non-target arms have expected reward less than $\mu_{K}$. It is well-known that if Bob runs a sublinear-regret algorithm (e.g., UCB ), almost all arm pulls will concentrate on the now-best target arm $K$ in the transformed bandit problem. Furthermore, Alice’s cumulative attack cost will be sublinear in time, because the total number of non-target arm pulls is sublinear in the transformed problem. In practice, however, it is almost never the case that Alice knows $\mu_{1},\ldots,\mu_{K}$ and hence the $\Delta^{\epsilon}_{i}$’s. Thus the oracle attack is impractical. Our focus in this paper is to design an attack that nearly matches the oracle attack, but for Alice who does not know $\{\mu_{i}\}$. We do so for two popular bandit algorithms, $\epsilon$-greedy and UCB .

What damage can Alice do in practice? She can largely control the arms pulled by Bob. She can also control which arm appears to Bob as the best arm at the end. As an example, consider the news-delivering contextual bandit problem . The arms are available news articles, and Bob selects which arm to pull (i.e., which article to show to a user at the news site). In normal operation, Bob shows news articles to users to maximize the click-through rate. However, Alice can attack Bob to change his behavior. For instance, Alice can manipulate the rewards so that users from a particular political base are always shown particular news articles that can reinforce or convert their opinion. Conversely, Alice can coerce the bandit to not show an important article to certain users. As another example, Alice may interfere with clinical trials to funnel most patients toward certain treatment, or make researchers draw wrong conclusions on whether treatment is better than control. Therefore, adversarial attacks on MAB deserve our attention. Insights gained from our study can be used to build defense in the future.

Finally, we note that our setting is motivated by modern industry-scale applications of contextual bandits, where arm selection, reward signal collection, and policy updates are done in a distributed way . Attacks can happen when the reward signal is joined with the selected arm, or when the arm-reward data is sent to another module for Bob to update his policy. In either case, Alice has access to both $I_{t}$ and $r_{t}^{0}$ for the present and previous rounds.

The rest of the paper is organized as follows. In Section 2, we introduce notations and straightforward attack algorithms that serve as baseline. We then propose our two attack algorithms for $\epsilon$-greedy and UCB in Section 3 and 4 respectively, along with their theoretical attack guarantees. In Section 5, we empirically confirm our findings with toy experiments. Finally, we conclude our paper with related work (Section 6) and a discussion of future work (Section 7) that will enrich our understanding of security vulnerability and defense mechanisms for secure MAB deployment.

Preliminaries

We assume all arm rewards are $\sigma^{2}$-sub-Gaussian where $\sigma^{2}$ is known to both Alice and Bob. Let $N_{i}(t)$ be the number of pulls of arm $i$ up to round $t$. We say the attack is successful after $T$ rounds if the number of target-arm pulls is $N_{K}(T)=T-o(T)$ in expectation or with high probability, while minimizing the cumulative attack cost $\sum_{t=1}^{T}|\alpha_{t}|$. Other attack settings are discussed in Section 7.

For convenience we define the following quantities:

$\tau_{i}(t):=\{s:s\leq t,I_{s}=i\}$, the set of rounds up to $t$ where arm $i$ is chosen,

${\hat{\mu}}^{0}_{i}(t):=N_{i}(t)^{-1}\sum_{s\in\tau_{i}(t)}r_{s}^{0}$, the pre-attack average reward of arm $i$ up to round $t$, and

${\hat{\mu}}_{i}(t):=N_{i}(t)^{-1}\sum_{s\in\tau_{i}(t)}r_{s}$, the corresponding post-attack average reward.

The oracle attack, revisited While the oracle attack was impractical, it gives us a baseline for comparison. The oracle attack drags down the reward of all non-target arms,The opposite strategy is to push up the target arm: $\alpha_{t}=\mathds{1}\{I_{t}=K\}\cdot(\mu_{K}-\max_{j}\mu_{j}-\epsilon)$ to make arm $K$ the best arm in post-attack rewards. However, a successful attack means that Alice pulls the target arm $T-o(T)$ times; the attack cost is necessarily linear in $T$, which is inefficient. Simulations that support “drag down” instead of “push up” are presented in Appendix D. and can be written as

Proposition 1 shows that the oracle attack succeeds and requires only a logarithmic attack cost. While more general statements for sublinear-regret algorithms can be made, we focus on logarithmic-regret bandit algorithms for simplicity. Throughout, omitted proofs can be found in our supplementary material.

The heuristic constant attack A slight variant of the oracle attack is to attack all the non-target arms with a single constant amount $A>0$, regardless of the actual $\mu_{i}$’s:

Let $\Delta_{i}:=\Delta^{0}_{i}$. Unfortunately, this heuristic constant attack depends critically on the value of $A$ compared to the unknown maximum gap $\max_{i}\Delta_{i}$. Proposition 2 states the condition under which the attack succeeds:

Assume that Bob’s bandit algorithm achieves an $O(\log T)$ regret bound. Then, Alice’s heuristic constant attack with $A$ succeeds if and only if $A>\max_{i}\Delta_{i}$. If the attack succeeds, then the expected attack cost is $O(A\log T)$.

Conversely, if $A<\max_{i}\Delta_{i}$ the attack fails. This is because in the transformed bandit problem, there exists an arm that has a higher expected reward than arm $K$, and Bob will mostly pull that arm. Therefore, the heuristic constant attack has to know an unknown quantity to guarantee a successful attack. Moreover, the attack is non-adaptive to the problem difficulty since some $\Delta_{i}$’s can be much smaller than $A$, in which case Alice pays an unnecessarily large attack cost.

Does there exist an attacker Alice that guarantees a successful attack with cost adaptive to the problem difficulty?

The answer is yes. We present attack strategies against two popular bandit algorithms of Bob: $\epsilon$-greedy and UCB. We show that Alice can indeed succeed in her attacks and incur cost as small as that of the oracle with an additive term due to the sub-Gaussian noise level $\sigma$.

Alice’s Attack on ϵitalic-ϵ\epsilon-Greedy Bob

The $\epsilon$-greedy strategy initially pulls each arm once in the first $K$ rounds. For convenience, we assume that the target arm is pulled first: $I_{1}=K$. Our results in this section can be adapted to any order of initialization with more complicated notation.

Bob’s $\epsilon$-greedy strategy has the following arm-selection rule for $t>K$ :

The strategy uses an exploration scheme $\{\epsilon_{t}\}$ over $t$. Alice’s attack algorithm is not aware of $\{\epsilon_{t}\}$ though her cumulative attack cost $\sum|\alpha_{t}|$ will implicitly depend on it. Later in Corollary 1 we show that, for the typical decaying scheme $\epsilon_{t}\propto 1/t$, the cumulative attack cost is mild: $O(\log(t))$.

Alice wants to make Bob always pull the target arm during exploitation rounds. Since Alice has no influence on which arm is pulled during exploration, this attack goal is the strongest she can achieve. Here, Algorithm 1 is specialized to ensure the following condition:

From this condition, we derive the actual attack $\alpha_{t}$. Since

where $[z]_{+}=\max(0,z)$. Note $\alpha$ is always non-negative, thus the cumulative attack cost can be written without absolute value: $\sum_{t=1}^{T}\alpha_{t}$.

With this $\alpha_{t}$, we claim that (i) Alice forces Bob to pull the target arm in all exploitation rounds as shown in Lemma 2, and (ii) the cumulative attack cost is logarithmic in $t$ for standard $\epsilon$-greedy learner exploration scheme $\epsilon_{t}=O(1/t)$ as shown in Corollary 1. Our main result is the following general upper bound on the cumulative attack cost.

Let $\delta\leq 1/2$. With probability at least $1-2\delta$, for any $T$ satisfying $\sum_{t=1}^{T}\epsilon_{t}\geq{\frac{K}{e-2}}\log(K/\delta)$, One can drop this condition by considering slightly larger $\widetilde{N}(t)$ and smaller $\widetilde{N}_{K}(t)$. However, we keep the condition as it simplifies $\widetilde{N}(t)$ and $\widetilde{N}_{K}(t)$. We refer to the proof of Lemma 4 for detail. Alice forces Bob running $\epsilon$-greedy to choose the target arm in at least $\widetilde{N}_{K}(T)$ rounds, using a cumulative attack cost at most

Before proving the theorem, we first look at its consequence. If Bob’s $\epsilon_{t}$ decay scheme is $\epsilon_{t}=\min\{1,cK/t\}$ for some $c>0$ as recommended in Auer et al. , Alice’s cumulative attack cost is $O(\sum_{i=1}^{K}\Delta_{i}\log T)$ for large enough $T$, as the following corollary shows:

Inherit the assumptions in Theorem 1. Fix $K$ and $\delta$. If $\epsilon_{t}=cK/t$ for some constant $c>0$, then

where $\widehat{O}$ ignores $\log\log$ factors.

Note that the two important constants are $\sum_{i}\Delta_{i}$ and $\sigma$. While a large $\sigma$ can increase the cost significantly, the term with $\sum_{i}\Delta_{i}$ dominates the cost for large enough $T$. Specifically, $\sum_{i}\Delta_{i}$ is multiplied by $\log T$ that is of higher order than $\sqrt{\log T}$. We empirically verify the scaling of cost with $T$ in Section 5.

To prove Theorem 1, we first show that $\beta$ in (2) is a high-probability bound on the pre-attack empirical mean of all arms on all rounds. Define the event

The following lemma proves the first half of our claim.

For $\delta\leq 1/2$ and under event $E$, attacks (4) force Bob to always pull the target arm $K$ in exploitation rounds.

We now show that on average each attack on a non-target arm $i$ is not much bigger than $\Delta_{i}$.

For $\delta\leq 1/2$ and under event $E$, we have for all arm $i<K$ and all $t$ that

Finally, we upper bound the number of non-target arm $i$ pulls $N_{i}(T)$ for $i<K$. Recall the arm $i$ pulls are only the result of exploration rounds. In round $t$ the exploration probability is $\epsilon_{t}$; if Bob explores, he chooses an arm uniformly at random. We also lower bound the target arm pulls $N_{K}(T)$.

Let $\delta<1/2$. Suppose $T$ satisfy $\sum_{t=1}^{T}\epsilon_{t}\geq{\frac{K}{e-2}}\log(K/\delta)$. With probability at least $1-\delta$, for all non-target arms $i<K$,

The theorem follows immediately from a union bound over Lemma 3 and Lemma 4 below. We add up the attack costs over $K-1$ non-target arms. Then, we note that $N\beta(N)$ is increasing in $N$ so $N_{i}(T)\beta(N_{i}(T))\leq\widetilde{N}(T)\beta(\widetilde{N}(T))$. Finally, by Lemma 8 in our supplementary material $\beta(N)$ is decreasing in $N$, so $\beta(N_{K}(T))\leq\beta(\widetilde{N}_{K}(T))$. ∎

Alice’s Attack on UCB Bob

Recall that we assume rewards are $\sigma^{2}$-sub-Gaussian. Bob’s UCB algorithm in its basic form often assumes rewards are bounded in $$; we need to modify the algorithm to handle the more general sub-Gaussian rewards. By choosing$\alpha=4.5$and$\psi:\lambda\mapsto\frac{\sigma^{2}\lambda^{2}}{2}$in the$(\alpha,\psi)$-UCB algorithm of Bubeck & Cesa-Bianchi [8, Section 2.2], we obtain the following arm-selection rule:

For the first $K$ rounds where Bob plays each of the $K$ arms once in an arbitrary order, Alice does not attack: $\alpha_{t}=0$ for $t\leq K$. After that, attack happens only when $I_{t}\neq K$. Specifically, consider any round $t>K$ where Bob pulls arm $i\neq K$. It follows from the UCB algorithm that

Alice attacks as follows. She computes an attack $\alpha_{t}$ with the smallest absolute value, such that

where $\Delta_{0}\geq 0$ is a parameter of Alice. Since the post-attack empirical mean can be computed recursively by the following

where $r_{t}^{0}$ is the pre-attack reward; this enables us to write down in closed form Alice’s attack:

For convenience, define $\alpha_{t}=0$ if $I_{t}=K$. We now present the main theorem on Alice’s cumulative attack cost against Bob who runs UCB.

Suppose $T\geq 2K$ and $\delta\leq 1/2$. Then, with probability at least $1-\delta$, Alice forces Bob to choose the target arm in at least

rounds, using a cumulative attack cost at most

While the bounds in the theorem are somewhat complicated, the next corollary is more interpretable and follows from a straightforward calculation. Specifically, we have the following by straightforward calculation:

Inherit the assumptions in Theorem 2 and fix $\delta$. Then, the total number of non-target arm pulls is

where $\widehat{O}$ ignores $\log\log(T)$ factors.

We observe that a larger $\Delta_{0}$ decreases non-target arm pulls (i.e. a more effective attack). The effect diminishes when $\Delta_{0}>\sigma\sqrt{\log T}$ since $\frac{K\sigma^{2}}{\Delta_{0}^{2}}\log T<K$. Thus there is no need for Alice to choose a larger $\Delta_{0}$. By choosing $\Delta_{0}=\Theta(\sigma)$, the cost is $\widehat{O}(\sum_{i<K}\Delta_{i}\log T+\sigma K\log T)$. This is slightly worse than the cost of attacking $\epsilon$-greedy where $\sigma$ is multiplied by $\sqrt{\log T}$ rather than $\log T$. However, we find that a stronger attack is possible when the time horizon $T$ is fixed and known to Alice ahead of time (i.e., the fixed budget setting). One can show that this choice $\Delta_{0}=\Theta\left(\sigma\sqrt{\log T}\right)$ minimizes the cumulative attack cost, which is $\widehat{O}\left(K\sigma\sqrt{\log T}\right)$. This is a very strong attack since the dominating term w.r.t. $T$ does not depend on $\sum_{i<K}\Delta_{i}$; in fact the cost associated with $\sum_{i<K}\Delta_{i}$ does not grow with $T$ at all. This means that under the fixed budget setting algorithm-specific attacks can be better than the oracle attack that is algorithm-independent. Whether the same is true in the anytime setting (i.e., $T$ is unknown ahead of time) is left as an open problem.

For the proof of Theorem 2 we use the following two lemmas.

Assume event $E$ holds and $\delta\leq 1/2$. Then, for any $i<K$ and any $t\geq 2K$, we have

Assume event $E$ holds and $\delta\leq 1/2$. Then, at any round $t\geq 2K$, the cumulative attack cost to any fixed arm $i<K$ can be bounded as:

Suppose event $E$ holds. The bounds are direct consequences of Lemmas 6 and 5 below, by summing the corresponding upper bounds over all non-target arms $i$. Specifically, the number of target arm pulls is $T-\sum_{i<K}N_{i}(T)$, and the cumulative attack cost is $\sum_{t=1}^{T}\alpha_{t}=\sum_{i<K}\sum_{t\in\tau_{i}(T)}\alpha_{t}$. Since event $E$ is true with probability at least $1-\delta$ (Lemma 1), the bounds also hold with probability at least $1-\delta$. ∎

Simulations

In this section, we run simulations on attacking $\epsilon$-greedy and UCB algorithms to illustrate our theoretical findings.

Attacking $\epsilon$-greedy The bandit has two arms. The reward distributions of arms 1 and 2 are $\mathcal{N}(\Delta_{1},\sigma^{2})$ and $\mathcal{N}(0,\sigma^{2})$, respectively, with $\Delta_{1}>0$. Alice’s target arm is arm 2. We let $\delta=0.025$. Bob’s exploration probability decays as $\epsilon_{t}=\frac{1}{t}$. We run Alice and Bob for $T=10^{5}$ rounds; this forms one trial. We repeat $1000$ trials.

In Figure 1LABEL:sub@exp:epsilon-cost-delta, we fix $\sigma=0.1$ and show Alice’s cumulative attack cost $\sum_{s=1}^{t}|\alpha_{s}|$ for different $\Delta_{1}$ values. Each curve is the average over 1000 trials. These curves demonstrate that Alice’s attack cost is proportional to $\log t$ as predicted by Corollary 1. As the reward gap $\Delta_{1}$ becomes larger, more attack is needed to reduce the reward of arm 1, and the slope increases.

Furthermore, note that $\sum_{t=1}^{T}|\alpha_{t}|=\widehat{O}\left(\Delta_{1}\log T+\sigma\sqrt{\log T}\right)$. Ignoring $\log\log T$ terms, we have $\sum_{t=1}^{T}|\alpha_{t}|\leq C(\Delta_{1}\log T+\sigma\sqrt{\log T})$ for some constant $C>0$ and large enough $T$. Therefore, $\log\left(\sum_{t=1}^{T}|\alpha_{t}|\right)\leq\max\{\log\log T+\log\Delta_{1},\tfrac{1}{2}\log\log T+\log\sigma\}+\log C$. We thus expect the log-cost curve as a function of $\log\log T$ to behave like the maximum of two lines, one with slope $1/2$ and the other with slope $1$. Indeed, we observe such a curve in Figure 1LABEL:sub@exp:epsilon-cost-sigma where we fix $\Delta_{1}=1$ and vary $\sigma$. All the slopes eventually approach 1, though larger $\sigma$’s take a longer time. This implies that the effect of $\sigma$ diminishes for large enough $T$, which was predicted by Corollary 1.

In Figure 1LABEL:sub@exp:epsilon-TAP, we compare the number of target arm (the suboptimal arm 2) pulls with and without attack. This experiment is with $\Delta_{1}=0.1$ and $\sigma=0.1$. Alice’s attack dramatically forces Bob to pull the target arm. In $10000$ rounds, Bob is forced to pull the target arm $9994$ rounds with the attack, compared to only $6$ rounds if Alice was not present.

Attacking UCB The bandit has two arms. The reward distributions are the same as the $\epsilon$-greedy experiment. We let $\delta=0.05$. To study how $\sigma$ and $\Delta_{0}$ affects the cumulative attack cost, we perform two groups of experiments. In the first group, we fix $\sigma=0.1$ and vary Alice’s free parameter $\Delta_{0}$ while in the second group, we fix $\Delta_{0}=0.1$ and vary $\sigma$. We perform $100$ trials with $T=10^{7}$ rounds.

Figure 2LABEL:sub@exp:UCB_cost_VD shows Alice’s cumulative attack cost as $\Delta_{0}$ varies. As $\Delta_{0}$ increases, the cumulative attack cost decreases. In Figure 2LABEL:sub@exp:UCB_cost_VS, we show the cost as $\sigma$ varies. Note that for large enough $t$, the cost grows almost linearly with $\log t$, which is implied by Corollary 2. In both figures, there is a large attack near the beginning, after which the cost grows slowly. This is because the initial attacks drag down the empirical average of non-target arms by a large amount, such that the target arm appears to have the best UCB for many subsequent rounds. Figure 2LABEL:sub@exp:UCB_TAP again shows that Alice’s attack forces Bob to pull the target arm: with attack Bob is forced to pull the target arm $10^{7}-2$ times, compared to only $156$ times without attack.

Related Work

The literature on general adversarial learning is vast and covers ethics, safety, fairness, and legal concerns; see e.g. Joseph et al. and Goodfellow et al. . Related to MAB, there has been empirical evidence that suggests adversarial attacks can be quite effective, even in the more general multi-step reinforcement learning problems, as opposed to the bandit case considered in this paper. The learned policy may be lured to visit certain target states when adversarial examples are driven , or have inferior generalization ability when training examples are corrupted . There are differences, though. In the first, non-stochastic setting , the reward is generated by an adversary instead of a stationary, stochastic process. However, the reward observed by the learner is still a real reward, in that the learner is still interested in maximizing it, or more precisely, minimizing some notion of regret in reference to some reference policy . Another related problem is reward shaping (e.g., Dorigo & Colombetti ), where the reward received by the learner is modified, as in our paper. However, those changes are typically done to help the learner in various ways (such as promoting exploration), and are designed in a way not to change the optimal policy the learner eventually converges to .

A concurrent work by Lykouris et al. considers a complementary problem to ours. They propose a randomized bandit algorithm that is robust to adversarial attacks on the stochastic rewards. In contrast, our work shows that the existing stochastic algorithms are vulnerable to adversarial attacks. Note that their attack protocol is slightly different in that the attacker has to prepare attacks for all the arms before the learner chooses an arm. Furthermore, they have a different attack cost definition where the cost in a round is the largest manipulation over the arms, regardless of which arm the learner selects afterwards.

Another concurrent work by Ma et al. considers attacking stochastic contextual bandit algorithms. The authors show that for a contextual bandit algorithm which periodically updates the arm selection policy, an attacker can perform offline attack to force the contextual bandit algorithm to pull some pre-specified target arm for a given target context vector. Our work differs in that we consider online attack, which is performed on the fly rather than offline.

Conclusions and Future Work

We presented a reward-manipulating attack on stochastic MABs. We analyzed the attack against $\epsilon$-greedy and a generalization of the UCB algorithm, and proved that the attacker can force the algorithms to almost always pull a suboptimal target arm. The cost of the attack is only logarithmic in time. Given the wide use of MABs in practice, this is a significant security threat.

Our analysis is only the beginning. We targeted $\epsilon$-greedy and UCB learners for their simplicity and popularity. Future work may look into attacking Thompson sampling , linear bandits , and contextual bandits , etc. We assumed the reward attacks $\alpha_{t}$ are unbounded from above; new analysis is needed if an application’s reward space is bounded or discrete. It will also be useful to establish lower bounds on the cumulative attack cost.

Beyond the attack studied in this paper, there is a wide range of possible attacks on MABs. We may organize them along several dimensions:

The attack goal: The attacker may force the learner into pulling or avoiding target arms, or worsen the learner’s regret, or make the learner identify the wrong best-arm, etc.

The attack action: The attacker can manipulate the rewards or corrupt the context for contextual bandits, etc.

Online vs. offline: An online attacker must choose the attack action in real time; An offline attacker poisons a dataset of historical action-reward pairs in batch mode, then the learner learns from the poisoned dataset.

The combination of these attack dimensions presents fertile ground for future research into both bandit-algorithm attacks and the corresponding defense mechanisms.

This work is supported in part by NSF 1837132, 1545481, 1704117, 1623605, 1561512, and the MADLab AF Center of Excellence FA9550-18-1-0166.

References

Supplementary Material

A Details on the oracle and constant attack

For simplicity, denote by $i^{*}$ the unique best arm; that is, $i^{*}=\arg\max_{i=1,\ldots,K}\mu_{i}$. We show that a logarithmic regret bound implies that the arm pull count of arm $i\neq i^{*}$ is at most logarithmic in $T$.

To balance the two terms, one can see that $\epsilon$ has to grow with $T$ and the term $\Delta_{i}/\epsilon^{2}$ is soon dominated by $1/\epsilon$. Thus, for large enough $T$ the optimal choice of $\epsilon$ is $\sqrt{C\log(T)}$, which leads to the attack cost of $O(K\sqrt{C\log T})$.

B Details on attacking the ϵitalic-ϵ\epsilon-greedy strategy

For $\delta\leq 1/2$, the $\beta(N)$ defined in (2) is monotonically decreasing in $N$.

It suffices to show that $f(x)=\frac{2\sigma^{2}}{x}\log\frac{\pi^{2}Kx^{2}}{3\delta}$ is decreasing for $x\geq 1$. Note that $\delta\leq 1/2\leq\frac{K}{3}(\frac{\pi}{e})^{2}$, thus for $x\geq 1$ we have

When $T$ is larger than the following threshold:

we have $\widetilde{N}_{K}(T)\geq\widetilde{N}(T)$. Because $\beta(N)$ is decreasing in $N$,

Due to the the exploration scheme of the strategy,

For sufficiently large $T$, there exists a constant $c_{2}$ depending on $c,K,\delta$ to further upper bound the RHS as follows:

Since $N\beta(N)$ is increasing in $N$, combining (9) and (10) we have for sufficiently large $T$,

Plugging this upper bound into Theorem 1,

Let $\{X_{j}\}_{j=1}^{\infty}$ be a sequence of i.i.d. $\sigma^{2}$-sub-Gaussian random variables with mean $\mu$. Let $\hat{\mu}^{0}_{N}=\frac{1}{N}\sum_{j=1}^{N}X_{j}$. By Hoeffding’s inequality

We show by induction that at the end of any round $t\geq K$ Algorithm 1 maintains the invariance

which forces the learner to pull arm $K$ if $t+1$ is an exploitation round.

Base case: By definition the learner pulls arm $K$ first, then all the other arms once. During round $t=2\ldots K$ the attack algorithm ensures $\hat{\mu}_{i}(t)\leq\hat{\mu}_{K}(t)-2\beta(1)<\hat{\mu}_{K}(t)$ for arms $i<K$, trivially satisfying (12).

Induction: Suppose (12) is true for rounds up to $t-1$. Consider two cases for round $t$:

If round $t$ is an exploration round and $I_{t}\neq K$ is pulled, then only $\hat{\mu}_{I_{t}}(t)$ changes; the other arms copy their empirical mean from round $t-1$. The attack algorithm ensures $\hat{\mu}_{K}(t)\geq\hat{\mu}_{I_{t}}(t)+2\beta(N_{K}(t))>\hat{\mu}_{I_{t}}(t)$. Thus (12) is satisfied at $t$.

Otherwise either $t$ is exploration and $K$ is pulled; or $t$ is exploitation – in which case $K$ is pulled because by inductive assumption (12) is satisfied at the end of $t-1$. Regardless, this arm $K$ pull is not attacked by Algorithm 1 and its empirical mean is updated by the pre-attack reward. We show this update does not affect the dominance of $\hat{\mu}_{K}(t)$. Consider any non-target arm $i<K$. Denote the last time $\hat{\mu}_{i}$ was changed by $t^{\prime}$. Note $t^{\prime}<t$ and $N_{K}(t^{\prime})<N_{K}(t)$. At round $t^{\prime}$, Algorithm 1 ensured that $\hat{\mu}_{i}(t^{\prime})\leq\hat{\mu}_{K}(t^{\prime})-2\beta(N_{K}(t^{\prime}))$. We have:

Thus (12) is also satisfied at round $t$.

Without loss of generality assume in round $t$ arm $i$ is pulled and the attacker needed to attack the reward (i.e. $I_{t}=i$ and $\alpha_{t}>0$). By definition (4),

Therefore, the cumulative attack on arm $i$ is

One can think of the term in front of $N_{i}(t)$ as the amortized attack cost against arm $i$. By Lemma 1,

The last inequality follows from the gap definition $\Delta_{i}:=[\mu_{i}-\mu_{K}]_{+}$.

Fix a non-target arm $i<K$. Let $X_{t}$ be the Bernoulli random variable for round $T$ being arm $i$ pulled. Then,

Since $X_{t}$’s are independent random variables, we may apply Lemma 9 of Agarwal et al. , so that for any $\lambda\in$, with probability at least $1-\delta/K$,

The same reasoning can be applied to all non-target arm $i<K$. Note the upper bound above is valid for $T$ such that $\sum_{t=1}^{T}\epsilon_{t}\geq{\frac{K}{e-2}}\log(K/\delta)$ only as otherwise $\lambda$ is greater than 1. One can get rid of such a condition by a slightly looser bound. Specifically, using $\lambda=1$ gives us a bound that holds true for all $T$. We then take the max of the two bounds, which can be simplified as $\sum_{t=1}^{T}X_{t}<(e-1)\sum_{t=1}^{T}\frac{\epsilon_{t}}{K}+\sqrt{3\sum_{t=1}^{T}\frac{\epsilon_{t}}{K}\log\frac{K}{\delta}}+\log{\frac{K}{\delta}}\;.$ The condition on $T$ in Theorem 1 can be removed using this bound. However, by keeping the mild assumption on $T$ we keep the exposition simple.

Finally, a union bound is applied to all $K$ arms to complete the proof.

C Details on attacking the UCB strategy

Fix some $t\geq 2K$. If $N_{i}(t)\leq 2$ for all $i<K$, then $N_{K}(t)\geq 2$, which implies $N_{i}(t)\leq\min\{N_{K}(t),2\}$. Thus, (8) holds trivially and we are done.

Now fix any $i<K$ such that $N_{i}(t)>2$. As the desired upper bound is nondecreasing in $t$, we only need to prove the result for $t$ where $I_{t}=i$. Let $t^{\prime}$ be the previous time where arm $i$ was pulled. Note that $t^{\prime}$ satisfies $K<t^{\prime}<t$ as $N_{i}(t)>2$, so the attacker has started attacking at round $t^{\prime}$. This implies that $N_{i}(t^{\prime}-1)+1=N_{i}(t^{\prime})=N_{i}(t-1)=N_{i}(t)-1$.

On one hand, it is clear that after attack $\alpha_{t^{\prime}}$ was added at round $t^{\prime}$, the following holds:

On the other hand, at round $t$, it must be the case that

where we have used Eqn. 13 in the second inequality, the condition in event $E$ as well as Lemma 8 in the third. Since $\Delta_{0}>0$, we can see that $N_{i}(t^{\prime})<N_{K}(t-1)$, and thus

Furthermore, since $3\sigma\sqrt{{\frac{\log t}{N_{K}(t-1)}}}>0$, we have $3\sigma\sqrt{\frac{\log t}{N_{i}(t^{\prime})}}>\Delta_{0}$, which implies

Combining (14) and (15) gives the desired bound (8).

Fix any $i<K$. As the desired upper bound is increasing in $t$, we only need to prove the result for $t$ where $I_{t}=i$ and $\alpha_{t}>0$. It follows from (7) that,

The proof is completed by observing $N_{K}(t-1)=N_{K}(t)$, $N_{i}(t)\leq N_{K}(t)$ (Lemma 5) and Lemma 8.

D Simulations on Heuristic Constant Attack

We run simulations on $\epsilon$-greedy and UCB to illustrate the heuristic constant attack algorithm. The bandit has two arms, where the reward distributions are $\mathcal{N}(1,0.1^{2})$ and $\mathcal{N}(0,0.1^{2})$ respectively, thus $\max_{i}\Delta_{i}=\mu_{1}-\mu_{2}=1$. Alice’s target arm is arm 2. In our experiment, Alice tried two different constants for attack: $A=1.2$ and $A=0.8$, one being greater and the other being smaller than $\max_{i}\Delta_{i}$. We run the attack for $T=10^{4}$ rounds. Fig. 3 and Fig. 4 show Alice’s cumulative attack cost and Bob’s number of target arm pulls $N_{K}(t)$ for $\epsilon$-greedy and UCB. Note that if $A>\max_{i}\Delta_{i}$, then $N_{K}(t)\approx t$, which verifies that Alice succeeds with the heuristic constant attack. At the same time, pushing up the target arm would incur linear cost; while dragging down the non-target arm achieves logarithmic cost. In summary, Alice should use an $A$ value larger than $\Delta$, and should drag down the expected reward of the non-target arm by amount $A$.