Support Vector Machines under Adversarial Label Contamination

TL;DR

This paper investigates the vulnerability of Support Vector Machines (SVMs) to adversarial label noise attacks, proposing strategies to understand and improve their robustness in security-critical applications.

Contribution

It formalizes an optimal attack strategy against SVMs under label noise and evaluates its effectiveness, offering insights for developing more secure SVM algorithms.

Findings

Adversarial label flipping significantly degrades SVM performance.

Heuristic approaches can effectively approximate optimal attacks.

Insights can guide the design of more robust SVMs.

Abstract

Machine learning algorithms are increasingly being applied in security-related tasks such as spam and malware detection, although their security properties against deliberate attacks have not yet been widely understood. Intelligent and adaptive attackers may indeed exploit specific vulnerabilities exposed by machine learning techniques to violate system security. Being robust to adversarial data manipulation is thus an important, additional requirement for machine learning algorithms to successfully operate in adversarial settings. In this work, we evaluate the security of Support Vector Machines (SVMs) to well-crafted, adversarial label noise attacks. In particular, we consider an attacker that aims to maximize the SVM's classification error by flipping a number of labels in the training data. We formalize a corresponding optimal attack strategy, and solve it by means of heuristic approaches to keep the computational complexity tractable. We report an extensive experimental analysis on the effectiveness of the considered attacks against linear and non-linear SVMs, both on synthetic and real-world datasets. We finally argue that our approach can also provide useful insights for developing more secure SVM learning algorithms, and also novel techniques in a number of related research areas, such as semi-supervised and active learning.