Adversarial training with restricted data manipulation
David Benfield, Stefano Coniglio, Phan Tu Vuong, Alain Zemkoho
TL;DR
The paper addresses robustness of classifiers under adversarial distribution shifts by formulating a constrained pessimistic bilevel optimization where the adversary's data modifications are restricted by a similarity constraint using cosine similarity. The Learner selects weights $w$ to minimize $F(w,X)$ while the Adversary modifies data $X$ to maximize evasion, subject to $g(X) \le 0$ with $d(X_i,X_i^0)$ near the original; crucially, no convexity or lower-level uniqueness assumptions are imposed. The authors introduce a practical solving framework using Fischer–Burmeister reformulations and a Levenberg–Marquardt method for mixed nonlinear complementarity systems, plus an end-to-end training pipeline. Empirical results on text-based tasks (TREC, Amazon) show that the constrained model yields more consistent and improved performance against adversarial perturbations than prior unconstrained methods, with insights into the effects of the adversary’s sample size $m$ and the similarity threshold $\delta$ on robustness.
Abstract
Adversarial machine learning concerns situations in which learners face attacks from active adversaries. Such scenarios arise in applications such as spam email filtering, malware detection and fake image generation, where security methods must be actively updated to keep up with the everimproving generation of malicious data. Pessimistic Bilevel optimisation has been shown to be an effective method of training resilient classifiers against such adversaries. By modelling these scenarios as a game between the learner and the adversary, we anticipate how the adversary will modify their data and then train a resilient classifier accordingly. However, since existing pessimistic bilevel approaches feature an unrestricted adversary, the model is vulnerable to becoming overly pessimistic and unrealistic. When finding the optimal solution that defeats the classifier, it is possible that the adversary's data becomes nonsensical and loses its intended nature. Such an adversary will not properly reflect reality, and consequently, will lead to poor classifier performance when implemented on real-world data. By constructing a constrained pessimistic bilevel optimisation model, we restrict the adversary's movements and identify a solution that better reflects reality. We demonstrate through experiments that this model performs, on average, better than the existing approach.