Adversarial Learning in Statistical Classification: A Comprehensive Review of Defenses Against Attacks

Abstract

There is great potential for damage from adversarial learning (AL) attacks on machine-learning based systems. In this paper, we provide a contemporary survey of AL, focused particularly on defenses against attacks on statistical classifiers. After introducing relevant terminology and the goals and range of possible knowledge of both attackers and defenders, we survey recent work on test-time evasion (TTE), data poisoning (DP), and reverse engineering (RE) attacks and particularly defenses against same. In so doing, we distinguish robust classification from anomaly detection (AD), unsupervised from supervised, and statistical hypothesis-based defenses from ones that do not have an explicit null (no attack) hypothesis; we identify the hyperparameters a particular method requires, its computational complexity, as well as the performance measures on which it was evaluated and the obtained quality. We then dig deeper, providing novel insights that challenge conventional AL wisdom and that target unresolved issues, including: 1) robust classification versus AD as a defense strategy; 2) the belief that attack success increases with attack strength, which ignores susceptibility to AD; 3) small perturbations for test-time evasion attacks: a fallacy or a requirement?; 4) validity of the universal assumption that a TTE attacker knows the ground-truth class for the example to be attacked; 5) black, grey, or white box attacks as the standard for defense evaluation; 6) susceptibility of query-based RE to an AD defense. We also discuss attacks on the privacy of training data. We then present benchmark comparisons of several defenses against TTE, RE, and backdoor DP attacks on images. The paper concludes with a discussion of future work.

References in corpus (26)

• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networks
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• On Evaluating Adversarial Robustness
• Certified Defenses against Adversarial Examples
• Security Evaluation of Pattern Classifiers under Attack
• Spectral Signatures in Backdoor Attacks
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Support Vector Machines under Adversarial Label Contamination
• On Detecting Adversarial Perturbations
• Parseval Networks: Improving Robustness to Adversarial Examples
• Motivating the Rules of the Game for Adversarial Example Research
• Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks
• Towards Fast Computation of Certified Robustness for ReLU Networks
• Early Methods for Detecting Adversarial Images
• Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbation
• Efficient and Accurate Estimation of Lipschitz Constants for Deep Neural Networks
• ATD: Anomalous Topic Discovery in High Dimensional Discrete Data
• Revealing Perceptible Backdoors, without the Training Set, via the Maximum Achievable Misclassification Fraction Statistic
• A Mixture Model Based Defense for Data Poisoning Attacks Against Naive Bayes Spam Filters

Cited by in corpus (7)

• Recent advances for quantum classifiers
• Universal Adversarial Examples and Perturbations for Quantum Classifiers
• A Backdoor Attack against 3D Point Cloud Classifiers
• Revealing Perceptible Backdoors, without the Training Set, via the Maximum Achievable Misclassification Fraction Statistic
• Adversarial Example Detection by Classification for Deep Speech Recognition
• L-RED: Efficient Post-Training Detection of Imperceptible Backdoor Attacks without Access to the Training Set
• Reverse Engineering Imperceptible Backdoor Attacks on Deep Neural Networks for Detection and Training Set Cleansing