With the increased popularity of Machine Learning (ML) in real-world applications, adversarial attacks are emerging to subvert the ML-based decision support systems. It appears that the existing adversarial defenses are ineffective against adaptive attacks since these are highly depend on knowledge of prior attacks and the ML model architecture. To alleviate the challenges, We propose a negative filtering strategy that does not require any adversarial knowledge and can work independent of ML models. This filtering strategy relies on salient features of clean (training) data and employs a complementary approach to cover possible attack surface in an application. Our empirical experiments with different data sets demonstrate that the negative filters could effectively detect wide-range of adversarial inputs and update itself to protect against adaptive attacks.

1. Using Negative Detectors for
Identifying Adversarial Data
Manipulation
Presented by :
Kishor Datta Gupta

2. Adversarial Attack (AA) on AI/ML
“Manipulation of training data, Machine Learning (ML) model architecture, or
manipulate testing data in a way that will result in wrong output from ML”

3. Limitation of AA Defense
Strategies
• Generate Adversarial Example and
Retrain the model
• Limitations: Reduce the accuracy of
learning model
Retrain:
• Using PCA, low-pass filtering, JPEG
compression, soft thresholding techniques
as pre-processing technique.
• Limitation: Vulnerable to adaptive attack.
Input Reconstruction or
Transformation:
• Modifying the ML architecture to detect
adversarial attack
• Limitations: Require Modification of
learning models.
Model Modification:

4. We need an adaptive defense strategy which don’t modify
the learning model and don’t require the adversarial
knowledge.
Problem Definition
Detect adversarial input using only the knowledge of
non-adversarial data,
Converting it as an Outlier detection problem

5. Relevant Outlier Detection models
Type Abbr Algorithm
Linear Model
MCD Minimum Covariance Determinant (use the mahalanobis distances as the outlier scores)
OCSVM One-Class Support Vector Machines
LMDD Deviation-based Outlier Detection (LMDD)
Proximity-Based
LOF Local Outlier Factor
COF Connectivity-Based Outlier Factor
CBLOF Clustering-Based Local Outlier Factor
LOCI LOCI: Fast outlier detection using the local correlation integral
HBOS Histogram-based Outlier Score
SOD Subspace Outlier Detection
ROD Rotation-based Outlier Detection
Probabilistic
ABOD Angle-Based Outlier Detection
COPOD COPOD: Copula-Based Outlier Detection
FastABOD Fast Angle-Based Outlier Detection using approximation
MAD Median Absolute Deviation (MAD)
SOS Stochastic Outlier Selection
Outlier Ensembles
IForest Isolation Forest
FB Feature Bagging
LSCP LSCP: Locally Selective Combination of Parallel Outlier Ensembles
XGBOD Extreme Boosting Based Outlier Detection (Supervised)
LODA Lightweight On-line Detector of Anomalies
Neural Networks
AutoEncoder Fully connected AutoEncoder (use reconstruction error as the outlier score)
VAE Variational AutoEncoder (use reconstruction error as the outlier score)
Beta-VAE Variational AutoEncoder (all customized loss term by varying gamma and capacity)
SO_GAAL Single-Objective Generative Adversarial Active Learning
MO_GAAL Multiple-Objective Generative Adversarial Active Learning

6. Negative Selection Algorithm

7. Generating Detector set

8. Use of Detectors

9. System Workflow

10. Experimental Results

11. Comparison

12. Summary
We devised an adaptive negative filtering methodology to detect adversarial
attacks that does not modify the ML model or information about the ML
model.
Our strategy can be implemented in any ML-based system without expensive
retraining.
Adaptive attacks are ineffective in our negative filtering approach.
Further works will be needed to conduce comprehensive experiments for
testing various attacks using datasets from different domains.

13. Q/A