Abstract:Many modern machine learning classifiers are shown to be vulnerable to adversarial perturbations of the instances. Despite a massive amount of work focusing on making classifiers robust, the task seems quite challenging. In this work, through a theoretical study, we investigate the adversarial risk and robustness of classifiers and draw a connection to the well-known phenomenon of “concentration of measure” in metric measure spaces. We show that if the metric probability space of the test instance is concentrated, any classifier with some initial constant error is inherently vulnerable to adversarial perturbations.One class of concentrated metric probability spaces are the so-called Lévy families that include many natural distributions. In this special case, our attacks only need to perturb the test instance by at most O(√n) to make it misclassified, where n is the data dimension. Using our general result about Lévy instance spaces, we first recover as special case some of the previously proved results about the existence of adversarial examples. However, many more Lévy families are known (e.g., product distribution under the Hamming distance) for which we immediately obtain new attacks that find adversarial examples of distance O(√n).Finally, we show that concentration of measure for product spaces implies the existence of forms of “poisoning” attacks in which the adversary tampers with the training data with the goal of degrading the classifier. In particular, we show that for any learning algorithm that uses m training examples, there is an adversary who can increase the probability of any “bad property” (e.g., failing on a particular test instance) that initially happens with non-negligible probability to ≈ 1 by substituting only Õe(√m) of the examples with other (still correctly labeled) examples.

Hardness of evasion of multiple classifier system with non-linear classifiers

One-and-a-Half-Class Multiple Classifier Systems for Secure Learning Against Evasion Attacks at Test Time

Evasion and Hardening of Tree Ensemble Classifiers

Elm-Based Multiple Classifier Systems

Towards Robust Domain Generation Algorithm Classification

Physics-Constrained Robustness Verification of Intelligent Security Assessment for Power Systems

An Evasion and Counter-Evasion Study in Malicious Websites Detection

Characterizing the Evasion Attackability of Multi-label Classifiers

A Generalized and Robust Nonlinear Approach based on Machine Learning for Intrusion Detection

Improving Adversarial Robustness of Ensemble Classifiers by Diversified Feature Selection and Stochastic Aggregation

MultiRobustBench: Benchmarking Robustness Against Multiple Attacks

Mixing Classifiers to Alleviate the Accuracy-Robustness Trade-Off

Attack Transferability Characterization for Adversarially Robust Multi-label Classification

Explanation-Guided Diagnosis of Machine Learning Evasion Attacks

On Security and Sparsity of Linear Classifiers for Adversarial Settings

MCES: Multi-classifier Ensemble System for Malware Detection and Identification

Robust Mode Connectivity-Oriented Adversarial Defense: Enhancing Neural Network Robustness Against Diversified $\ell_p$ Attacks

How robust accuracy suffers from certified training with convex relaxations

Adversarial Feature Selection Against Evasion Attacks

The Curse of Concentration in Robust Learning: Evasion and Poisoning Attacks from Concentration of Measure

Towards Class-wise Robustness Analysis