A General Retraining Framework for Scalable Adversarial Classification
Bo Li Vanderbilt University、Yevgeniy Vorobeychik Vanderbilt University、Xinyun Chen Shanghai Jiaotong University
Abstract
Traditional classification algorithms assume that training and test data come from similar distributions. This assumption is violated in adversarial settings, where malicious actors modify instances to evade detection. A number of custom methods have been developed for both adversarial evasion attacks and robust learning. We propose the first systematic and general-purpose retraining framework which can: a) boost robustness of an arbitrary learning algorithm, in the face of b) a broader class of adversarial models than any prior methods. We show that, under natural conditions, the retraining framework minimizes an upper bound on optimal adversarial risk, and show how to extend this result to account for approximations of evasion attacks. Extensive experimental evaluation demonstrates that our retraining methods are nearly indistinguishable from state-of-the-art algorithms for optimizing adversarial risk, but are more general and far more scalable. The experiments also confirm that without retraining, our adversarial framework dramatically reduces the effectiveness of learning. In contrast, retraining significantly boosts robustness to evasion attacks without significantly compromis
中文速览
机器学习分类器在对抗环境中往往不堪一击——攻击者只需稍微修改恶意样本（如改写垃圾邮件内容），就能绕过检测，而现有的防御方法要么只针对特定攻击模型，要么改造算法难度大，要么根本无法处理高维数据。作者提出了一个名为 RAD（Retraining with Adversarial Data，对抗数据重训练）的通用框架：它的核心思路是在每轮训练后，让攻击模拟器生成能欺骗当前分类器的对抗样本并加入训练集，反复迭代直到无法再添加新样本为止；整个过程无需修改底层学习算法，任何分类器都可以"套壳使用"。理论分析证明，RAD 的收敛结果等价于最小化最优对抗风险的一个上界，即使攻击模拟器只是近似求解也能保持类似保证。在垃圾邮件过滤和手写数字识别的实验中，RAD 的鲁棒性表现与专门为对抗风险设计的最先进算法不相上下，同时在规模可扩展性上远远超越后者，且几乎不损失正常场景下的分类精度。这项工作意义在于，它为各类机器学习系统提供了一把"免费的对抗防御升级钥匙"，无需重新设计算法即可显著提升安全性。
原文 arXiv:1604.02606;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1604.02606v2