On the Robustness of Domain Constraints

TL;DR

This paper investigates how domain constraints in various fields limit adversarial attacks on machine learning models and proposes methods to incorporate these constraints into adversarial example generation, improving model robustness.

Contribution

It introduces techniques to learn domain constraints from data and integrates them into adversarial crafting, demonstrating improved robustness in network and phishing detection models.

Findings

82% of adversarial examples violate domain constraints

Enforcing domain constraints increases model accuracy by up to 34%

Domain constraints make generating valid adversarial examples more challenging

Abstract

Machine learning is vulnerable to adversarial examples-inputs designed to cause models to perform poorly. However, it is unclear if adversarial examples represent realistic inputs in the modeled domains. Diverse domains such as networks and phishing have domain constraints-complex relationships between features that an adversary must satisfy for an attack to be realized (in addition to any adversary-specific goals). In this paper, we explore how domain constraints limit adversarial capabilities and how adversaries can adapt their strategies to create realistic (constraint-compliant) examples. In this, we develop techniques to learn domain constraints from data, and show how the learned constraints can be integrated into the adversarial crafting process. We evaluate the efficacy of our approach in network intrusion and phishing datasets and find: (1) up to 82% of adversarial examples produced by state-of-the-art crafting algorithms violate domain constraints, (2) domain constraints are robust to adversarial examples; enforcing constraints yields an increase in model accuracy by up to 34%. We observe not only that adversaries must alter inputs to satisfy domain constraints, but that these constraints make the generation of valid adversarial examples far more challenging.