Enhancing robustness of machine learning systems via data transformations

By Arjun Nitin Bhagoji, Daniel Cullina, Chawin Sitawarin, Prateek Mittal. 2017

246 citations recorded by the source corpus.

We propose the use of data transformations as a defense against evasion attacks on ML classifiers. We present and investigate strategies for incorporating a variety of data transformations including dimensionality reduction via Principal Component Analysis to enhance the resilience of machine learning, targeting both the classification and the training phase. We empirically evaluate and demonstrate the feasibility of linear transformations of data as a defense mechanism against evasion attacks using multiple real-world datasets. Our key findings are that the defense is (i) effective against the best known evasion attacks from the literature, resulting in a two-fold increase in the resources required by a white-box adversary with knowledge of the defense for a successful attack, (ii) applicable across a range of ML classifiers, including Support Vector Machines and Deep Neural Networks, and (iii) generalizable to multiple application domains, including image classification and human activity classification.

Subfields: Artificial Intelligence, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Signal Processing

Citations in the corpus

Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks (2017, methodology): “proposed to use dimensionality reduction techniques such as Principal Component Analysis (PCA) as defense [2].”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, methodology): “[167] proposed to compress input data using Principal Component Analysis for adversarial robustness.”
Baseline Defenses for Adversarial Attacks Against Aligned Language Models (2023, methodology): “Some methods claim to remove malicious image perturbations as a preprocessing step before classification (Gu & Rigazio, 2014; Meng & Chen, 2017b; Bhagoji et al., 2018).”
A Survey on Security Threats and Defensive Techniques of Machine Learning: A Data Driven View (2018, methodology): “Besides, the dimension reduction strategy can be used to protect machine learning models from evasion attacks [95].”
Adversarial Examples on Object Recognition (2020, background): “Recent publications [128, 161] showed ML algorithms exhibit low robustness and triggered an impressive wave of publications.”
Smooth Adversarial Training (2020, background): “…adversarial robustness include defensive distillation [47], gradient discretization [6, 52, 72], dynamic network architectures [12, 66, 67, 34, 31, 37], randomized transformations [73, 4, 71, 50, 29, 1], adversarial input denoising/puriﬁcation [20, 48, 39, 59, 54, 33, 4, 44, 78, 15], etc .”