Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Adversarial Attacks for Drift Detection

Fabian Hinder, Valerie Vaquet, Barbara Hammer

TL;DR

This work formalizes concept drift as time-varying data distributions and reveals drift adversarials—drifts that escape detection by common drift detectors. It distinguishes metric-based and window-based attacks, then develops a rigorous framework for two-window detectors, proving that drift can be undetected unless the adversarial set $\textnormal{Adv}(A)$ is empty. The authors provide both limiting-case and finite-sample constructions using window representations $\mathbf{W}_n$ and sampling vectors to generate undetectable drift, and they validate the theory with synthetic experiments and a water-network case study. The results highlight a significant vulnerability in many drift detectors and suggest detector-combining or problem-tailored detector design as avenues for improved robustness in critical monitoring applications.

Abstract

Concept drift refers to the change of data distributions over time. While drift poses a challenge for learning models, requiring their continual adaption, it is also relevant in system monitoring to detect malfunctions, system failures, and unexpected behavior. In the latter case, the robust and reliable detection of drifts is imperative. This work studies the shortcomings of commonly used drift detection schemes. We show how to construct data streams that are drifting without being detected. We refer to those as drift adversarials. In particular, we compute all possible adversairals for common detection schemes and underpin our theoretical findings with empirical evaluations.

Adversarial Attacks for Drift Detection

TL;DR

This work formalizes concept drift as time-varying data distributions and reveals drift adversarials—drifts that escape detection by common drift detectors. It distinguishes metric-based and window-based attacks, then develops a rigorous framework for two-window detectors, proving that drift can be undetected unless the adversarial set is empty. The authors provide both limiting-case and finite-sample constructions using window representations and sampling vectors to generate undetectable drift, and they validate the theory with synthetic experiments and a water-network case study. The results highlight a significant vulnerability in many drift detectors and suggest detector-combining or problem-tailored detector design as avenues for improved robustness in critical monitoring applications.

Abstract

Concept drift refers to the change of data distributions over time. While drift poses a challenge for learning models, requiring their continual adaption, it is also relevant in system monitoring to detect malfunctions, system failures, and unexpected behavior. In the latter case, the robust and reliable detection of drifts is imperative. This work studies the shortcomings of commonly used drift detection schemes. We show how to construct data streams that are drifting without being detected. We refer to those as drift adversarials. In particular, we compute all possible adversairals for common detection schemes and underpin our theoretical findings with empirical evaluations.

Paper Structure

This paper contains 14 sections, 5 theorems, 24 equations, 1 figure, 2 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Concept Drift and Drift Detection
  3. Adversarial Attacks for Drift Detection
  4. Metric Adversarials
  5. Window Adversarials for Two-Window-Based Detectors
  6. The limiting case
  7. The finite case
  8. Empirical Evaluation
  9. Synthetic Data
  10. Application to Water Distribution Networks
  11. Conclusion
  12. Proofs
  13. Proof of \ref{['thm:main']}
  14. Proofs of the statements in \ref{['tab:adv']}

Key Result

Theorem 1

Define the improper adversarial functions for $A$ as in eq:limit_DD as then $A$ detects no drift, i.e., $A(\mathcal{D}_t) = 0$, if and only if $t \mapsto \mathcal{D}_t(S) \in \textnormal{Adv}_0(A)$ for all measurable $S \subset \mathcal{X}$. Define the adversarial functions$\textnormal{Adv}(A) \subset \textnormal{Adv}_0(A)$ as those that are not constant. Then, $\textn

Figures (1)

  • Figure 1: Shape curve for different window sizes (1 day, $6\frac{1}{2}$ days, 1 week). Red line marks leakage, orange crosses candidate points (transparency is MMD).

Theorems & Definitions (10)

  • Theorem 1
  • proof : Proof of \ref{['thm:main']}
  • Proposition 1: Fixed reference
  • proof
  • Lemma 1
  • proof
  • Proposition 2: Sliding windows
  • proof
  • Proposition 3: Growing reference
  • proof