On Security and Sparsity of Linear Classifiers for Adversarial Settings

By Ambra Demontis, Paolo Russu, Battista Biggio, Giorgio Fumera, Fabio Roli. 2016

26 citations recorded by the source corpus.

Machine-learning techniques are widely used in security-related applications, like spam and malware detection. However, in such settings, they have been shown to be vulnerable to adversarial attacks, including the deliberate manipulation of data at test time to evade detection. In this work, we focus on the vulnerability of linear classifiers to evasion attacks. This can be considered a relevant problem, as linear classifiers have been increasingly used in embedded systems and mobile devices for their low processing time and memory requirements. We exploit recent findings in robust optimization to investigate the link between regularization and security of linear classifiers, depending on the type of attack. We also analyze the relationship between the sparsity of feature weights, which is desirable for reducing processing cost, and the security of linear classifiers. We further propose a novel octagonal regularizer that allows us to achieve a proper trade-off between them. Finally, we empirically show how this regularizer can improve classifier security and sparsity in real-world application examples including spam and malware detection.

Subfields: Artificial Intelligence, Control and Systems Engineering, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Control and Systems Engineering

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (2017, methodology): “Figure 13: Decision functions for linear SVMs with `2, `∞ and `1 regularization on the feature weights [77, 78].”
Adversarial Training and Robustness for Multiple Perturbations (2019, background): “[9] show a robustness trade-off for dual norms (e.”
Is Deep Learning Safe for Robot Vision? Adversarial Examples Against the iCub Humanoid (2017, methodology): “, like in the case of decision trees), one may use a surrogate differentiable classifier to approximate it, as also suggested in [4, 8, 22].”
Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection (2017, methodology): “It is finally worth remarking that we have also recently exploited the proposed learning algorithm to improve the security of PDF and Javascript malware detection systems against sparse evasion attacks [20], [38].”
Learning Universal Adversarial Perturbations with Generative Models (2017, unknown): “∞ metrics [3], [4], [6], [10], [14], [16], [20], [21], [40].”
Attacks on Machine Learning: Lurking Danger for Accountability (2019, background): “Attack [4] Evasion Attack [3, 24, 30, 61, 66] Feature Deletion [28] Adversarial Examples [31, 52, 66, 71]”
Adversarial Examples on Object Recognition (2020, background): “Practical robust counterparts for linear models or Support Vector Machines (SVMs) [156] rely on adding penalty terms to the loss function and have been used to protect against adversarial examples [37, 144].”
Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks (2018, methodology): “For images, the former constraint is used to implement either dense or sparse evasion attacks [12,25,37].”