MISLEAD: Manipulating Importance of Selected features for Learning Epsilon in Evasion Attack Deception
Vidit Khazanchi, Pavan Kulkarni, Yuvaraj Govindarajulu, Manojkumar Parmar
TL;DR
MISLEAD addresses tabular-model vulnerability to evasion by coupling SHAP-based feature importance with an Optimal Epsilon (via binary search) to generate precise, targeted adversarial samples in a black-box setting. It builds a SHAP Summary Dictionary and feature-conversion rules to identify and execute perturbations that move predictions between classes, demonstrated on Iris (multiclass) and Bank Marketing (binary) data with multiple ML architectures. Empirical results show MISLEAD achieves high evasion efficacy and can reveal weaknesses even against some defenses, while also quantifying the resulting drop in accuracy. The work highlights the importance of interpretability-driven vulnerability assessment and supports future extensions to other data modalities and defensive strategies for robust ML security.
Abstract
Emerging vulnerabilities in machine learning (ML) models due to adversarial attacks raise concerns about their reliability. Specifically, evasion attacks manipulate models by introducing precise perturbations to input data, causing erroneous predictions. To address this, we propose a methodology combining SHapley Additive exPlanations (SHAP) for feature importance analysis with an innovative Optimal Epsilon technique for conducting evasion attacks. Our approach begins with SHAP-based analysis to understand model vulnerabilities, crucial for devising targeted evasion strategies. The Optimal Epsilon technique, employing a Binary Search algorithm, efficiently determines the minimum epsilon needed for successful evasion. Evaluation across diverse machine learning architectures demonstrates the technique's precision in generating adversarial samples, underscoring its efficacy in manipulating model outcomes. This study emphasizes the critical importance of continuous assessment and monitoring to identify and mitigate potential security risks in machine learning systems.