Nightmare at test time: robust learning by feature deletion

By Amir Globerson, Sam T. Roweis. 2006

366 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Towards the Science of Security and Privacy in Machine Learning (2016, background): “More broadly, machine learning models may also not perform correctly when some of their input features are corrupted or missing [40].”
Adversarial Examples for Evaluating Reading Comprehension Systems (2017, background): “For certain classes of models and adversaries, efﬁcient training strategies exist: for example, Globerson and Roweis (2006) train classiﬁers that are optimally robust to adversarial feature deletion.”
Towards Deep Learning Models Resistant to Adversarial Attacks (2017, background): “We also want to note that the study of adversarial ML predates the widespread use of deep neural networks [8, 10] (see [3] for an overview of earlier work).”
Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (2017, background): “…(poisoning attacks) [22–31] and at test time (evasion attacks) [18– 20, 28, 32–37]; ( ii ) propose systematic methodologies for security evaluation of learning algorithms against such attacks [37– 41]; and ( iii ) design suitable defense mechanisms to mitigate these threats [11, 18, 33, 42–46].”
Using Machine Teaching to Identify Optimal Training-Set Attacks on Machine Learners (2015, background): “There is a related line of research on robust learning (Globerson and Roweis 2006; Torkamani and Lowd 2013; El Ghaoui et al. 2003; Xu, Caramanis, and Mannor 2009; Kim, Magnani, and Boyd 2005; Dekel, Shamir, and Xiao 2010).”
Evasion Attacks against Machine Learning at Test Time (2013, methodology): “Similar to Globerson and Roweis [12], we consider discriminating between two distinct digits from the MNIST dataset [18].”
Poisoning Attacks against Support Vector Machines (2012, methodology): “Similarly to Globerson & Roweis (2006), we focus on two-class sub-problems of discriminating be-tween two distinct digits.”
Is Feature Selection Secure against Training Data Poisoning? (2015, background): “…work in the area of adversarial machine learning has addressed this issue, and proposed some pioneering methods for secure learning against particular kinds of attacks (Barreno et al., 2006; Huang et al., 2011; Biggio et al., 2014; 2012; 2013a; Br¨uckner et al., 2012; Globerson & Roweis, 2006).”
Practical Evasion of a Learning-Based Classifier: A Case Study (2014, methodology): “Some methods of this kind have been recently proposed for learning on problems with potential feature deletion or corruption [43], [44].”
Security Evaluation of Pattern Classifiers under Attack (2014, methodology): “learning algorithms robust to a limited amount of data contamination [14], [29], and classification algorithms robust to specific exploratory attacks [6], [23], [26], [32].”
Adversarial Detection of Flash Malware: Limitations and Open Issues (2017, background): “In many cases, these constraints can be directly encoded in terms of distances in feature space, computed between the source malware data and its manipulated versions [8], [13], [14], [16], [21], [29].”
Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection (2017, methodology): “puted between the source malware data and its manipulated versions [7], [15], [19], [21], [29], [40].”
Security Evaluation of Support Vector Machines in Adversarial Environments (2014, methodology): “The experimental evaluation presented in the following sections demonstrates the behavior of our proposed method on an artificial two-dimensional dataset and evaluates its effectiveness on the classical MNIST handwritten digit recognition dataset [32, 45].”
Security analysis of online centroid anomaly detection (2010, methodology): “A somewhat related approach has been developed for handling worst-case random noise; for example, random feature deletion (Globerson and Roweis, 2006; Dekel and Shamir, 2008).”
Support vector machines under adversarial label contamination (2015, methodology): “, using game-theoretical models for classification [15, 20–22], probabilistic models of the data distribution drift under attack [23, 24], and even multiple classifier systems [25–27].”
Measuring Neural Net Robustness with Constraints (2016, background): “In practice, X = Xtest is taken to be the test set.”