Adequacy of the Gradient-Descent Method for Classifier Evasion Attacks
arXiv:1704.01704
Abstract
Despite the wide use of machine learning in adversarial settings including computer security, recent studies have demonstrated vulnerabilities to evasion attacks---carefully crafted adversarial samples that closely resemble legitimate instances, but cause misclassification. In this paper, we examine the adequacy of the leading approach to generating adversarial samples---the gradient descent approach. In particular (1) we perform extensive experiments on three datasets, MNIST, USPS and Spambase, in order to analyse the effectiveness of the gradient-descent method against non-linear support vector machines, and conclude that carefully reduced kernel smoothness can significantly increase robustness to the attack; (2) we demonstrate that separated inter-class support vectors lead to more secure models, and propose a quantity similar to margin that can efficiently predict potential susceptibility to gradient-descent attacks, before the attack is launched; and (3) we design a new adversarial sample construction algorithm based on optimising the multiplicative ratio of class decision functions.
10 pages, 7 figures, 10 tables
References in corpus (12)
- Explaining and Harnessing Adversarial Examples
- Intriguing properties of neural networks
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- Poisoning Attacks against Support Vector Machines
- Towards Deep Neural Network Architectures Robust to Adversarial Examples
- Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
- Adversarial Feature Selection against Evasion Attacks
- Learning with a Strong Adversary
- Defensive Distillation is Not Robust to Adversarial Examples
- Universal adversarial perturbations
- Improving the Robustness of Deep Neural Networks via Stability Training
- Suppressing the Unusual: towards Robust CNNs using Symmetric Activation Functions