Sparse Feature Attacks in Adversarial Learning

By Zhizhou Yin, Fei Wang, Wei Liu, Sanjay Chawla. 2014

60 citations recorded by the source corpus.

Adversarial learning is the study of machine learning techniques deployed in non-benign environments. Example applications include classification for detecting spam, network intrusion detection, and credit card scoring. In fact, as the use of machine learning grows in diverse application domains, the possibility for adversarial behavior is likely to increase. When adversarial learning is modelled in a game-theoretic setup, the standard assumption about the adversary (player) behavior is the ability to change <italic>all</italic> features of the classifiers (the opponent player) at will. The adversary pays a cost proportional to the size of the “attack”. We refer to this form of adversarial behavior as a dense feature attack. However, the aim of an adversary is not just to subvert a classifier but carry out data transformation in a way such that spam continues to remain effective. We demonstrate that an adversary could potentially achieve this objective by carrying out a sparse feature attack. We design an algorithm to show how a classifier should be designed to be robust against sparse adversarial attacks. Our main insight is that sparse feature attacks are best defended by designing classifiers which use <inline-formula> <tex-math notation="LaTeX">$\ell _{1}$</tex-math><alternatives><inline-graphic xlink:href="liu-ieq1-2790928.gif"/> </alternatives></inline-formula> regularizers.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Is Feature Selection Secure against Training Data Poisoning? (2015, background): “To this end, one may follow the intuition behind the recently-proposed feature selection algorithms to contrast evasion attacks, i.e. , to model interactions between the attacker and the feature selection algorithm (Li & Vorobeychik, 2014; Wang et al., 2014; Zhang et al., 2015).”
On Security and Sparsity of Linear Classifiers for Adversarial Settings (2016, background): “This amounts to (slightly) blurring the image, instead of obtaining a salt-and-pepper noise eﬀect (as the one produced by sparse attacks) [16].”
Adversarial Feature Selection Against Evasion Attacks (2016, background): “ifications to the malicious samples [11], [16], [35], [36].”
A Unified Gradient Regularization Family for Adversarial Examples (2015, background): “The examples constructed by using such perturbations are referred to as adversarial examples, which have attracted much interest in both machine learning and data mining [2], [4], [5].”
Secure Kernel Machines against Evasion Attacks (2016, background): “This behavior has been formalized in terms of application-dependent constraints in previous work [4, 32]; in particular, in terms of bounds on the distance between the initial malicious sample x and the manipulated one x (cid:48) in feature space.”
Attacks on Machine Learning: Lurking Danger for Accountability (2019, background): “Another group of attacks that tamper with data fed into the ML model, and thus are applicable on a wide range of different ML algorithms, are adversarial examples [5, 6, 17, 34, 51, 59], evasion attacks [23, 78], and feature deletion attacks.”