Poisoning the Search Space in Neural Architecture Search
  Deep learning has proven to be a highly effective problem-solving tool for
object detection and image segmentation across various domains such as
healthcare and autonomous driving. At the heart of this performance lies neural
architecture design which relies heavily on domain knowledge and prior
experience on the researchers' behalf. More recently, this process of finding
the most optimal architectures, given an initial search space of possible
operations, was automated by Neural Architecture Search (NAS). In this paper,
we evaluate the robustness of one such algorithm known as Efficient NAS (ENAS)
against data agnostic poisoning attacks on the original search space with
carefully designed ineffective operations. By evaluating algorithm performance
on the CIFAR-10 dataset, we empirically demonstrate how our novel search space
poisoning (SSP) approach and multiple-instance poisoning attacks exploit design
flaws in the ENAS controller to result in inflated prediction error rates for
child networks. Our results provide insights into the challenges to surmount in
using NAS for more adversarially robust architecture search.
