Evasion Attacks against Machine Learning at Test Time

TL;DR

This paper introduces a gradient-based method to evaluate the robustness of classification algorithms against evasion attacks at test time, highlighting vulnerabilities in malware detection systems and suggesting countermeasures.

Contribution

It presents a systematic approach for assessing classifier security under evasion attacks, aiding in better model selection and robustness evaluation.

Findings

Classifiers can be easily evaded by gradient-based attacks.

Evaluation framework helps in understanding security risks.

Countermeasures can improve system robustness.

Abstract

In security-sensitive applications, the success of machine learning depends on a thorough vetting of their resistance to adversarial data. In one pertinent, well-motivated attack scenario, an adversary may attempt to evade a deployed system at test time by carefully manipulating attack samples. In this work, we present a simple but effective gradient-based approach that can be exploited to systematically assess the security of several, widely-used classification algorithms against evasion attacks. Following a recently proposed framework for security evaluation, we simulate attack scenarios that exhibit different risk levels for the classifier by increasing the attacker's knowledge of the system and her ability to manipulate attack samples. This gives the classifier designer a better picture of the classifier performance under evasion attacks, and allows him to perform a more informed model selection (or parameter setting). We evaluate our approach on the relevant security task of malware detection in PDF files, and show that such systems can be easily evaded. We also sketch some countermeasures suggested by our analysis.