Feature Cross-Substitution in Adversarial Classification

By Bo Li, Yevgeniy Vorobeychik. 2014

124 citations recorded by the source corpus.

Subfields: Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Safety, Robustness & Interpretability

Citations in the corpus

Towards the Science of Security and Privacy in Machine Learning (2016, background): “Thus, while the above theoretical result and recent empirical work [94] suggests more complex models for defeating adversaries, in practice, availability of data may prohibit the use of this general result.”
Stealing Hyperparameters in Machine Learning (2018, background): “Evasion attacks: In these attacks [33], [22], [3], [51], [52], [17], [26], [23], [37], [56], [9], [44], [28], [36], an attacker aims to inject carefully crafted noise into a testing instance (e.”
Data Poisoning Attacks on Factorization-Based Collaborative Filtering (2016, methodology): “In this paper we provide a novel technique based on stochastic gradient Langevin dynamics optimization [10] to produce malicious users that mimic normal user behaviors in order to avoid detection, while achieving attack objectives.”
Is Feature Selection Secure against Training Data Poisoning? (2015, background): “In particular, it has been shown that classifier evasion can be facilitated if features are not selected according to an adversary-aware procedure that explicitly accounts for adversarial data manipulation at test time (Li & Vorobeychik, 2014; Wang et al., 2014; Zhang et al., 2015).”
Generating Adversarial Examples with Adversarial Networks (2018, background): “…have been proposed in the white-box setting, where the adversary has full access to the classiﬁer (Szegedy et al., 2014; Goodfellow et al., 2015; Carlini & Wagner, 2017a; Moosavi-Dezfooli et al., 2015; Papernot et al., 2016; Biggio et al., 2013; Kurakin et al., 2016; Li & Vorobeychik, 2014; 2015).”
Robust Physical-World Attacks on Deep Learning Models (2017, background): “Recent work in computer vision, however, has demonstrated that DNNs are vulnerable to adversarial perturbations [3], [5], [8], [12], [13], [22], [23], [28].”
Adversarial Feature Selection Against Evasion Attacks (2016, background): “ifications to the malicious samples [11], [16], [35], [36].”
Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality (2018, background): “However, these defenses can generally be evaded by Opt attacks, either wholly or partially (Carlini & Wagner, 2017a; He et al., 2017; Li & Vorobeychik, 2014; 2015).”
Robust Physical-World Attacks on Deep Learning Visual Classification (2018, background): “Recent work, however, has demonstrated that DNNs are vulnerable to adversarial perturbations [5, 9, 10, 15, 16, 22, 25, 29, 30, 35].”
Hardening Classifiers against Evasion: the Good, the Bad, and the Ugly (2017, methodology): “Instead, these consider the interaction as a non-zero-sum game, either played simultaneously between the learner and the attacker, or a Stackelberg game, in which the learner is the leader, while the attacker the follower [4], [18], [16], [27].”
Behavioral Experiments in Email Filter Evasion (2016, background): “…describe and motivate the experimental setup, we begin by considering in the abstract the problem of adversarial classiﬁer evasion , which has been previously studied in several forms from a computational standpoint (Lowd and Meek 2005b; 2005a; Vorobeychik and Li 2014; Li and Vorobeychik 2014).”
Robust Physical-World Attacks on Machine Learning Models (2017, background): “Even though Deep Neural Networks (DNNs) have been applied with great success in a variety of areas ranging from speech processing [7] to medical diagnostics [4], recent work has demonstrated that they are vulnerable to adversarial perturbations [3], [6], [8], [10], [11], [17], [18], [21].”
A Survey on Security Threats and Defensive Techniques of Machine Learning: A Data Driven View (2018, background): “There are several studies on attacking and defense techniques with respect to evasion attacks [55]–[57].”
Recent advances in feature selection and its applications (2017, background): “In fact, for adversarial tasks, feature selection can open the door for the adversary to evade the classiﬁcation system and misclassify the adversary sample as normal one [88].”
A Theoretical Framework for Robustness of (Deep) Classifiers against Adversarial Examples (2016, unknown): “A recent study (Li & Vorobeychik, 2014) explored a similar strategy by using equivalent-feature-group to replace each word feature in a group, in order to improve the robustness of spam-email classiﬁers against evasion attacks.”