Fast Adversarial Label-Flipping Attack on Tabular Data
Xinglong Chang 11 Gillian Dobbie 11 Jörg Wicker 11
Abstract
Machine learning models are increasingly used in fields that require high reliability such as cybersecurity. However, these models remain vulnerable to various attacks, among which the adversarial label-flipping attack poses significant threats. In label-flipping attacks, the adversary maliciously flips a portion of training labels to compromise the machine learning model. This paper raises significant concerns as these attacks can camouflage a highly skewed dataset as an easily solvable classification problem, often misleading machine learning practitioners into lower defenses and miscalculations of potential risks. This concern amplifies in tabular data settings, where identifying true labels requires expertise, allowing malicious label-flipping attacks to easily slip under the radar. To demonstrate this risk is inherited in the adversary’s objective, we propose Falfa (Fast Adversarial Label-Flipping Attack), a novel efficient attack for crafting adversarial labels. Falfa is based on transforming the adversary’s objective and employs linear programming to reduce computational complexity. Using ten real-world tabular datasets, we demonstrate Falfa’s superior attack potential, high
中文速览
标签翻转攻击（label-flipping attack）是一种只需篡改训练数据标签、无需修改特征值的低成本数据投毒手段，在网络安全等高可靠性场景中危害尤为突出——攻击者可以把一个高度偏斜的数据集伪装成"看似简单"的分类问题，让从业者放松警惕、低估风险。为此，研究者提出了 Falfa（Fast Adversarial Label-Flipping Attack），通过变量变换将攻击者的非线性目标函数转化为线性规划（linear programming）问题，从而大幅降低计算复杂度，并保证在任意投毒比例下都能求得可行解。在十个真实世界的表格数据集上，Falfa 的攻击效果与现有最强基线方法 ALFA 相当甚至更优，同时具备更高的计算效率，而且能在压低测试准确率的同时维持训练准确率不变，从而更隐蔽地掩盖攻击痕迹。这项工作揭示了表格数据场景下标签投毒威胁被长期低估的现实风险，呼吁业界在此类数据上构建更强健的防御机制。
原文 arXiv:2310.10744;中英对照 + 大白话阅读 https://aha.fim.ai/paper/2310.10744v1