Classification under strategic adversary manipulation using pessimistic bilevel optimisation

TL;DR

This paper introduces a novel approach to adversarial machine learning by modeling the interaction as a pessimistic bilevel optimization problem, improving robustness against strategic adversaries without restrictive assumptions.

Contribution

It presents a new model and solution method for adversarial classification that relaxes previous assumptions, leading to more realistic and effective defenses.

Findings

Significant performance improvements over existing models

Relaxing assumptions yields more realistic adversary modeling

New solution method effectively handles non-convex lower-level problems

Abstract

Adversarial machine learning concerns situations in which learners face attacks from active adversaries. Such scenarios arise in applications such as spam email filtering, malware detection and fake-image generation, where security methods must be actively updated to keep up with the ever improving generation of malicious data.We model these interactions between the learner and the adversary as a game and formulate the problem as a pessimistic bilevel optimisation problem with the learner taking the role of the leader. The adversary, modelled as a stochastic data generator, takes the role of the follower, generating data in response to the classifier. While existing models rely on the assumption that the adversary will choose the least costly solution leading to a convex lower-level problem with a unique solution, we present a novel model and solution method which do not make such assumptions. We compare these to the existing approach and see significant improvements in performance suggesting that relaxing these assumptions leads to a more realistic model.