Poisoning Attacks on the PGM-index

2026-09-02

AI Summary

研究针对PGM-index的投毒攻击，通过插入对抗性键值增加分段数，揭示了其内在脆弱性，并提出未来学习型索引需考虑鲁棒性。

Abstract

The PGM-index (Ferragina and Vinciguerra, VLDB'20) is one of the most practical learned indexes, owing to its theoretical elegance and consistently strong empirical performance. It is built on optimal piecewise linear approximations (PLAs) that minimize the number of segments. In this paper, we ask how sensitive this optimal PLA itself is to poisoning attacks. We propose PGM-attack, an efficient poisoning attack that sequentially inserts adversarial keys to inflate the resulting number of segments, and we develop a method for deriving theoretical upper bounds on the number of segments attainable under arbitrary insertions. Our experiments show that poisoning only 10% of the keys allows PGM-attack to increase the segment count by up to 120x. On every evaluated instance, our instance-dependent upper bound is at most 1.92x the segment count attained by PGM-attack, certifying that PGM-attack achieves at least 52% of the optimum. This increase in the number of segments enlarges the PGM-index by up to 120x. Moreover, the attack also transfers to other learned indexes, substantially inflating the index size of PLA-based ones in particular. Our results reveal that, despite the optimality of its PLAs, the PGM-index has an intrinsic vulnerability rooted in its optimization objective, motivating robustness-aware objective design for future learned indexes. Our code is publicly available at https://github.com/atsukisato/pgm-attack.

Problem

• Poisoning Attacks
• PGM-index
• Piecewise Linear Approximations
• Segment Count
• Learned Indexes

Innovation

• Poisoning Attacks
• PGM-index
• Piecewise Linear Approximations
• Adversarial Keys
• Optimization Objective