Adversarial support vector machine learning

Abstract

Many learning tasks such as spam filtering and credit card fraud detection face an active adversary that tries to avoid detection. For learning problems that deal with an active adversary, it is important to model the adversary's attack strategy and develop robust learning models to mitigate the attack. These are the two objectives of this paper. We consider two attack models: a free-range attack model that permits arbitrary data corruption and a restrained attack model that anticipates more realistic attacks that a reasonable adversary would devise under penalties. We then develop optimal SVM learning strategies against the two attack models. The learning algorithms minimize the hinge loss while assuming the adversary is modifying data to maximize the loss. Experiments are performed on both artificial and real data sets. We demonstrate that optimal solutions may be overly pessimistic when the actual attacks are much weaker than expected. More important, we demonstrate that it is possible to develop a much more resilient SVM learning model while making loose assumptions on the data corruption models. When derived under the restrained attack model, our optimal SVM learning strategy provides more robust overall performance under a wide range of attack parameters.

Sparse Bayesian Adversarial Learning Using Relevance Vector Machine Ensembles

“…Zhou et al [17] present two attack models for which optimal learning strategies are derived. They formulate a convex optimization problem in which the constraint is defined over the sample space based on the proposed attack models.…”

Pattern Recognition Systems under Attack

“…A version of secure SVMs and Relevance Vector Machines (RVMs) has been proposed in [74,73]. Similarly to the problem of learning with invariances, these classifiers aim to minimize the worst-case loss under a given attacker's model.…”

On Sparse Feature Attacks in Adversarial Learning

“…However, in many situations there exists an adversary (such as a spammer) who manipulates the training data distribution (e.g., spam emails) in a way as to attack the classifiers (spam detectors). This is a scenario that challenges the assumption made in most traditional classifiers, and thus has motivated the research advanced of adversarial learning [1][2][3][4][5][6][7].…”

“…Recently, Zhou et al [6] introduced a model based on support vector machines that can tackle two kinds of attacks an adversary may carry out. However, the model is only evaluated on synthetically generated data instead of real world evolved data under adversarial influence.…”

“…We note that in the column 'Adversarial Modification', only Brückner et al [5] has a different formulation, which modifies all the data point in the union of classification boundary w, where τ i is a scalar associated with each data point. In the column 'Adversarial attack type', Liu et al [4] assume a zero-sum model Zhou et al [6] make the assumption that classification boundary w is not disclosed to the adversary. In the column 'Adversarial budget' and 'attack type', only our sparse model incorporates a pre-defined the budget and sparse feature attack.…”