Learning from the Good Ones: Risk Profiling-Based Defenses Against Evasion Attacks on DNNs

TL;DR

The paper addresses evasion attacks on DNNs in safety-critical settings and the need for defenses that balance static efficiency with dynamic adaptability. It introduces a risk profiling framework that simulates attacks, builds time-series risk profiles per victim, clusters victims by vulnerability, and uses less vulnerable instances to selectively train static anomaly detectors (kNN, OneClassSVM, MAD-GAN) to improve adversarial detection. In a BGMS case study using the OhioT1DM dataset and URET attacks, selective training yields recall gains up to $27.5\%$ for kNN and $16.8\%$ for OneClassSVM, with minimal precision loss; MAD-GAN achieves full recall with a $75\%$ reduction in training data. The approach demonstrates a practical pathway to enhance safety-critical systems by focusing training on robust patterns, reducing false negatives while preserving benign accuracy, and offering a scalable defense strategy for evolving threat landscapes.

Abstract

Safety-critical applications such as healthcare and autonomous vehicles use deep neural networks (DNN) to make predictions and infer decisions. DNNs are susceptible to evasion attacks, where an adversary crafts a malicious data instance to trick the DNN into making wrong decisions at inference time. Existing defenses that protect DNNs against evasion attacks are either static or dynamic. Static defenses are computationally efficient but do not adapt to the evolving threat landscape, while dynamic defenses are adaptable but suffer from an increased computational overhead. To combine the best of both worlds, in this paper, we propose a novel risk profiling framework that uses a risk-aware strategy to selectively train static defenses using victim instances that exhibit the most resilient features and are hence more resilient against an evasion attack. We hypothesize that training existing defenses on instances that are less vulnerable to the attack enhances the adversarial detection rate by reducing false negatives. We evaluate the efficacy of our risk-aware selective training strategy on a blood glucose management system that demonstrates how training static anomaly detectors indiscriminately may result in an increased false negative rate, which could be life-threatening in safety-critical applications. Our experiments show that selective training on the less vulnerable patients achieves a recall increase of up to 27.5\% with minimal impact on precision compared to indiscriminate training.

Figures (11)

• Figure 1: The five steps of the proposed risk profiling framework.
• Figure 2: A BGMS that uses a glucometer, insulin pump, DNN for insulin recommendations, and an anomaly detector to detect adversarial samples.
• Figure 3: The results of hierarchically clustering the risk profiles from (a) Subset A and (b) Subset B of the OhioT1DM dataset. Based on the distance between the clusters, the dendrograms show that patients in either Subset can be clustered into two groups - less and more vulnerable to the attack.
• Figure 4: Ratio of normal to abnormal data instances in the benign trace of the patients. Less vulnerable patients tend to have higher ratios while more vulnerable patients tend to have lower ratios.
• Figure 5: kNN anomaly detection on sample glucose traces of patients 5 and 2 from Subset A. Indiscriminately training the detector yields a higher false negative rate on patient 2 (more vulnerable) than patient 5 (less vulnerable).