Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Classification under strategic adversary manipulation using pessimistic bilevel optimisation

David Benfield, Stefano Coniglio, Martin Kunc, Phan Tu Vuong, Alain Zemkoho

TL;DR

This work presents a novel model and solution method which do not make the assumption that the adversary will choose the least costly solution leading to a convex lower-level problem with a unique solution, and sees significant improvements in performance.

Abstract

Adversarial machine learning concerns situations in which learners face attacks from active adversaries. Such scenarios arise in applications such as spam email filtering, malware detection and fake-image generation, where security methods must be actively updated to keep up with the ever improving generation of malicious data.We model these interactions between the learner and the adversary as a game and formulate the problem as a pessimistic bilevel optimisation problem with the learner taking the role of the leader. The adversary, modelled as a stochastic data generator, takes the role of the follower, generating data in response to the classifier. While existing models rely on the assumption that the adversary will choose the least costly solution leading to a convex lower-level problem with a unique solution, we present a novel model and solution method which do not make such assumptions. We compare these to the existing approach and see significant improvements in performance suggesting that relaxing these assumptions leads to a more realistic model.

Classification under strategic adversary manipulation using pessimistic bilevel optimisation

TL;DR

This work presents a novel model and solution method which do not make the assumption that the adversary will choose the least costly solution leading to a convex lower-level problem with a unique solution, and sees significant improvements in performance.

Abstract

Adversarial machine learning concerns situations in which learners face attacks from active adversaries. Such scenarios arise in applications such as spam email filtering, malware detection and fake-image generation, where security methods must be actively updated to keep up with the ever improving generation of malicious data.We model these interactions between the learner and the adversary as a game and formulate the problem as a pessimistic bilevel optimisation problem with the learner taking the role of the leader. The adversary, modelled as a stochastic data generator, takes the role of the follower, generating data in response to the classifier. While existing models rely on the assumption that the adversary will choose the least costly solution leading to a convex lower-level problem with a unique solution, we present a novel model and solution method which do not make such assumptions. We compare these to the existing approach and see significant improvements in performance suggesting that relaxing these assumptions leads to a more realistic model.

Paper Structure

This paper contains 6 sections, 3 theorems, 58 equations, 5 figures, 1 algorithm.

Table of Contents

  1. Introduction
  2. Previous and related works
  3. Protected training against adversarial attacks
  4. Solving the training problem under protection
  5. Applications and numerical experiments
  6. Conclusion

Key Result

Proposition 1

Let $w \in \mathbb{R}^q$ be such that $S(w)$ defined as in eqn:solution_map is non-empty. Suppose the adversary generates only one sample of data, $z \in (0,1)^{1 \times q}$. Then the lower-level problem defined by eqn:solution_map admits multiple optimal solutions.

Figures (5)

  • Figure 1: Varying parameters of the tanh approximation
  • Figure 2: Illustration of the nonconvexity of the lower--level objective function $f(w, \theta)$ with respect to $\theta$ where $w=10$, $z=0.5$, $\gamma = 1$ and $\mu = 0.1$.
  • Figure 3: LM convergence
  • Figure 4: Performance comparison
  • Figure 5: Varying the start points $\beta^0$ and $\zeta^0$

Theorems & Definitions (3)

  • Proposition 1
  • Proposition 2
  • Theorem 1