Research map / Bandits and online learning / Multi-armed bandits

Practical Adversarial Attacks on Stochastic Bandits via Fake Data Injection

NeurIPS 2026 · Bandits and online learning › Multi-armed bandits · approach: Non-stationary and structured-reward bandits · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Fake Data Injection, a bounded, rate-limited attack on stochastic bandits where the attacker injects fabricated (arm, reward) samples, and gives SI and PBI attacks on UCB with sublinear cost plus extensions to Thompson Sampling and epsilon-greedy.

Problem

Existing adversarial attacks on stochastic bandits assume per-round, unbounded reward manipulation of genuine feedback, which is unrealistic for real systems where attackers can only inject bounded fake feedback in limited amounts.

Approach

Inject bounded fake (arm, reward) samples to suppress non-target arms' empirical means below the target arm's lower confidence bound; once suppressed, UCB's own exploration rule prevents pulls of those arms (exponential suppression lemma), enabling simultaneous or periodic injection schedules with sublinear cost.

Key results

• On a UCB learner with K=10 arms and T=100,000, SBI, PBI and LI all drive the learner to the target arm, while the heuristic baseline fails to converge to it.
• PBI achieves comparable or better target selection than SBI at lower attack cost, while LI has the lowest overall cost because it uses unbounded injection values.
• Theory: SI attack cost is O~(K sigma sqrt(log T)) with delta_0 = Theta(sqrt(log T)), matching a cited lower bound of Omega(sqrt(log T)).

Surprising findings

• The heuristic injection schedule uses the same budget and number of fake samples as SBI yet fails, showing the injection timing matters more than total volume.

Limitations

• Passive learner assumed; no defense such as filtering or auditing is considered.
• Only stochastic bandits studied; contextual bandits and RL left open.
• Attacker detection risk and adaptive filtering are not modeled.

Experimental setup

Datasets: MovieLens 25M

Benchmarks: MovieLens 25M-derived bandit simulation

Metrics: attack cost target-arm selection rate

Baselines: heuristic randomized injection schedule standard feedback-perturbation attack (unbounded, per-round) Least Injection (LI) Simultaneous Bounded Injection (SBI)

Builds on: UCB Thompson Sampling epsilon-greedy

Closest papers by meaning

• Adversarial Attacks on Stochastic Bandits (NeurIPS 2018 · similarity 0.92)
• Stochastic Bandits Robust to Adversarial Attacks (ICLR 2025 · similarity 0.91)
• When Are Linear Stochastic Bandits Attackable? (ICML 2022 · similarity 0.90)
• Stealthy Adversarial Attacks on Stochastic Multi-Armed Bandits (AAAI 2024 · similarity 0.88)
• Sparsity-Agnostic Linear Bandits with Adaptive Adversaries (NeurIPS 2024 · similarity 0.87)
• A Near-optimal, Scalable and Parallelizable Framework for Stochastic Bandits Robust to Adversarial Corruptions and Beyond (NeurIPS 2025 · similarity 0.87)