Countering adversarial evasion in regression analysis
David Benfield, Phan Tu Vuong, Alain Zemkoho
TL;DR
The paper tackles adversarial evasion in regression by extending pessimistic bilevel optimization to regression with lower‑level data‑movement constraints, avoiding convexity or uniqueness assumptions for the adversary. It formulates a constrained, nonconvex bilevel problem where the adversary’s feasible modifications are bounded by cosine‑similarity, and the upper level trains a predictor under worst‑case manipulated data. A Levenberg–Marquardt based method solves the resulting nonsmooth system, recovering both the regression weights and the adversary’s optimal data in the original feature space. Empirical results on Wine Quality and Real Estate datasets show improved resilience over baselines and reveal feature‑level vulnerabilities, guided by an optimal similarity threshold around 0.95 and modest adversary budgets.
Abstract
Adversarial machine learning challenges the assumption that the underlying distribution remains consistent throughout the training and implementation of a prediction model. In particular, adversarial evasion considers scenarios where adversaries adapt their data to influence particular outcomes from established prediction models, such scenarios arise in applications such as spam email filtering, malware detection and fake-image generation, where security methods must be actively updated to keep up with the ever-improving generation of malicious data. Game theoretic models have been shown to be effective at modelling these scenarios and hence training resilient predictors against such adversaries. Recent advancements in the use of pessimistic bilevel optimsiation which remove assumptions about the convexity and uniqueness of the adversary's optimal strategy have proved to be particularly effective at mitigating threats to classifiers due to its ability to capture the antagonistic nature of the adversary. However, this formulation has not yet been adapted to regression scenarios. This article serves to propose a pessimistic bilevel optimisation program for regression scenarios which makes no assumptions on the convexity or uniqueness of the adversary's solutions.