PaperlayerView exact revision on arXiv

Source-linked AI summary

Security Evaluation of Support Vector Machines in Adversarial Environments

Battista Biggio, Igino Corona, Blaine Nelson, Benjamin I. P. Rubinstein, Davide Maiorca, Giorgio Fumera, Giorgio Giacinto, and Fabio Roli

arXiv:1401.7727v1cs.LGcs.CR

TL;DR

Adaptive adversaries can manipulate data to undermine SVMs used in security-sensitive tasks, making their security difficult to assess under conventional learning assumptions. The chapter applies an empirical evaluation framework to SVM evasion, poisoning, and privacy threats, and reports evasion and poisoning vulnerability across kernels and application domains. It also discusses countermeasures, including privacy and utility guarantees for certain SVM settings.

  • Problem

    Adaptive adversaries can manipulate data and violate the stationarity assumption, raising the question of whether learning systems can be safely used in security-sensitive tasks.

    Source: §1 · p. 2, §2.3 · p. 7

  • Method

    The chapter applies an empirical security-evaluation framework to SVMs, models evasion and poisoning attacks, and examines privacy threats and countermeasures.

    Source: §1 · p. 3, §4.2 · p. 19, §6.2 · p. 39

  • Results

    SVMs are vulnerable to evasion and poisoning with linear and nonlinear kernels in handwritten-digit classification and PDF-malware detection.

    Source: §1 · p. 3

  • Takeaways & Limitations

    The analysis helps designers quantify SVM detector risk against learning benefits and consider countermeasures, including privacy and utility guarantees in finite-dimensional feature spaces.

    Source: §6.3 · p. 42

    Further work could improve the poisoning attack with surrogate data or simultaneous multi-point optimization; the presented gradient-ascent method is not optimal.

    Source: §5.4 · p. 35

Abstract

from arXiv · show

Support Vector Machines (SVMs) are among the most popular classification techniques adopted in security applications like malware detection, intrusion detection, and spam filtering. However, if SVMs are to be incorporated in real-world security systems, they must be able to cope with attack patterns that can either mislead the learning algorithm (poisoning), evade detection (evasion), or gain information about their internal parameters (privacy breaches). The main contributions of this chapter are twofold. First, we introduce a formal general framework for the empirical evaluation of the security of machine-learning systems. Second, according to our framework, we demonstrate the feasibility of evasion, poisoning and privacy attacks against SVMs in real-world security problems. For each attack technique, we evaluate its impact and discuss whether (and how) it can be countered through an adversary-aware design of SVMs. Our experiments are easily reproducible thanks to open-source code that we have made available, together with all the employed datasets, on a public repository.

1 Introduction

Security applications use SVMs to detect attacks, but adaptive adversaries can manipulate data and undermine learning. This chapter presents a framework for evaluating those risks and applies it to SVM attacks and countermeasures.

1 Introduction

  • Adversarial data manipulation violates the stationarity assumption underlying learning, raising questions about safe use in security-sensitive tasks.The chapter identifies vulnerability analysis, attack implementation, and countermeasure design as open issues.Source: §1 · p. 2
  • The chapter reviews poisoning during training and evasion during deployment as practical attack modes against learning systems.These attacks respectively contaminate training data and circumvent the learned classifier.Source: §1 · p. 2
  • The chapter introduces a general empirical framework for evaluating classifier security by modeling adversary goals, knowledge, and capabilities.An analyst can formalize an attack strategy as an optimization problem.Source: §1 · p. 2
  • Experiments show SVM vulnerability to evasion and poisoning with linear and nonlinear kernels across handwritten-digit classification and PDF-malware detection.The chapter also applies its framework to describe privacy-attack settings and discusses countermeasures.Source: §1 · p. 3
  • The analysis aims to help system designers quantify SVM detector risk, weigh it against learning benefits, and consider countermeasures.For privacy attacks, the chapter discusses countermeasures with differential-privacy guarantees.Source: §1 · p. 3
  • The experiments’ code and data are publicly available, with documented open-source code intended to support reproduction and extension.The authors also state that researchers can customize and improve the work.Source: §1 · p. 3

2 Background

The background explains the learning assumptions and SVM mechanisms that security applications build on, then frames adversarial machine learning as a security-evaluation problem involving adaptive attacks and defenses.

2 Background

  • Learning infers a classifier from labeled samples so it can predict labels for unseen samples drawn from the same distribution.The classical supervised setting assumes independently drawn training pairs from an unknown joint distribution.Source: §2 · pp. 3–4

2.1 Support Vector Machines

  • SVMs use maximum-margin classification, with soft-margin slack variables and a penalty trade-off; kernels enable implicit nonlinear feature spaces.The dual solution is sparse, with support vectors carrying nonzero coefficients.Source: §2.1 · pp. 4–5

2.2 Machine Learning for Computer Security: Motivation, Trends, and Arms Races

  • Machine learning complements signatures to detect novel attacks, while anomaly detection can produce false alarms and adaptive image spam illustrates attacker responses.Signature systems miss variants; anomaly detection assumes anomalous traffic is intrusive, though some non-intrusive traffic can also be anomalous.Source: §2.2 · pp. 5–6

2.3 Adversarial Machine Learning

  • Adversarial machine learning examines how intentional data manipulation can violate stationarity and affect classifiers in security-sensitive settings.Because future distribution changes are difficult to predict, the chapter motivates proactive attack simulation.Source: §2.3 · p. 7

2.3.1 Reactive and Proactive Arms Races

  • Reactive defenses update classifiers after new attacks, whereas proactive design models threats and tests countermeasures before deployment.The proactive approach may delay the reactive cycle, though general-purpose secure classifier design remains open.Source: §2.3.1 · pp. 7–8

2.3.2 Previous Work on Security Evaluation

  • Prior security evaluations often used application-specific criteria, making results difficult to generalize or compare across domains.The authors identify a need for systematic, unified evaluation guidelines.Source: §2.3.2 · p. 9

2.3.3 A Taxonomy of Potential Attacks against Machine Learning Algorithms

  • The attack taxonomy distinguishes causative training-data influence from exploratory test-time influence, and classifies violations as integrity, availability, or privacy.Attack specificity ranges from targeted samples to indiscriminate attacks.Source: §2.3.3 · p. 10

3 A Framework for Security Evaluation

The framework turns security evaluation into a modeled and repeatable process: analysts specify an adversary, derive attacks, and evaluate their impact under application-relevant assumptions.

3 A Framework for Security Evaluation

  • The framework systematizes security evaluation by identifying attack scenarios, devising corresponding attacks, and systematically measuring their impact during classifier design.Its final countermeasure-design step remains application-specific rather than a unique part of the framework.Source: §3 · p. 11
  • The framework’s what-if analysis helps designers identify relevant threats and decide whether to deploy with known risks or mitigate them first.The authors describe this scrutiny as an essential design step.Source: §3 · p. 11

3.1 Modeling the Adversary

  • An adversary model specifies goals, system knowledge, and capabilities to manipulate samples, while allowing application-specific constraints.This model supports practical attack strategies and can guide resilient-classifier design.Source: §3.1 · p. 12

3.1.1 Adversary’s Goal

  • Adversary goals reflect the anticipated security violation and attack specificity, and can be formalized as an objective to maximize.Examples include maximizing evading spam while minimizing content changes, or maximizing classification errors.Source: §3.1.1 · p. 12

3.1.2 Adversary’s Knowledge

  • Adversary knowledge ranges from training data and features to the algorithm, learned parameters, and classifier feedback.Assuming knowledge of learned parameters provides a worst-case performance bound; algorithm knowledge plus query feedback is a more limited-knowledge scenario.Source: §3.1.2 · pp. 12–13

3.1.3 Adversary’s Capability

  • Capability assumptions specify whether training or test data can be changed, which samples and features are alterable, and how class priors may shift.These choices constrain changes to the training and test distributions.Source: §3.1.3 · pp. 13–14

3.1.4 Attack Strategy

  • Given goals, knowledge, and capabilities, the analyst formulates a constrained optimization problem, generates attack samples, and integrates them consistently into evaluation data.The chapter points to its evasion and poisoning sections for specific attack and resampling examples.Source: §3.1.4 · p. 14

3.2 How to use our Framework

  • The workflow defines an attack scenario, models the adversary, derives an optimization strategy, resamples training and test data, and evaluates security.Evaluation can be repeated under different knowledge or capability assumptions, and the chapter discusses kernel selection as a security–accuracy trade-off.Source: §3.2 · p. 15

4 Evasion Attacks against SVMs

This section presents test-time evasion attacks against SVMs, including kernel-based classifiers, using gradient descent. It also reports that a surrogate classifier can enable reliable evasion even when the attacker lacks precise knowledge of the target.

4 Evasion Attacks against SVMs

  • Gradient descent provides a straightforward approach to evading kernel-based classifiers, including SVMs, beyond the simpler classifier families covered by earlier work.The approach derives from Golland’s technique of discriminative directions.Source: §4 · p. 15
  • A surrogate classifier learned from surrogate data can reliably evade a targeted SVM without precise knowledge of its decision function.Source: §4 · p. 15
  • The section models the adversary, derives an attack strategy, evaluates it experimentally, and interprets the findings.Source: §4 · p. 15

4.1 Modeling the Adversary

The section specifies the evasion threat by defining the attacker’s goal, knowledge, and capabilities, then formulates an optimization strategy. A density term guides attacks toward regions represented by benign samples, while introducing a trade-off when feasible modifications are tightly constrained.

4.1.1 Adversary’s Goal

  • The adversary seeks to minimize the classifier’s discriminant function so malicious samples are classified as legitimate with the largest confidence.The authors describe this setting as a worst-case bound for the targeted classifier.Source: §4.1.1 · p. 16

4.1.2 Adversary’s Knowledge

  • The evaluation distinguishes perfect knowledge of the target decision function from limited knowledge, where a surrogate classifier approximates it.For limited knowledge, the surrogate may use classifier feedback or true labels; without feedback, the latter may poorly approximate the target unless accurate.Source: §4.1.2 · pp. 16–17

4.1.3 Adversary’s Capability

  • The evasion attacker can modify test data but not training data, and the attack is exploratory and indiscriminate, subject to application-specific modification constraints.The maximum distance dmax bounds changes from the original sample, and the distance should reflect domain-specific effort or cost.Source: §4.1.3 · p. 17

4.1.4 Attack Strategy

  • The attack minimizes the target discriminant or its surrogate while bounding distance from the original malicious sample; gradient descent is one optimization approach.For non-convex estimates, descent can reach unsupported low-density regions where classifier behavior is unspecified and evasion may be stymied.Source: §4.1.4 · pp. 17–18
  • A density-estimation term penalizes low-density attack points and favors imitation of benign-class samples, reshaping descent toward regions where that class is concentrated.The alternate objective trades off reducing the estimated discriminant against increasing estimated benign-class density; Figure 4 illustrates the paths.Source: §4.1.4 · pp. 18–19, Figure 4 · p. 18
  • The density term can disregard evasion patterns in unsupported regions, especially under a strict dmax constraint, so its trade-off with discriminant minimization matters.Source: §4.1.4 · p. 19

4.2 Evasion Attack Algorithm

The attack algorithm iteratively follows the gradient of a discriminant-plus-density objective while respecting feasible modifications. The section derives gradients for SVM and density-estimation kernels and adapts descent to discrete feature spaces.

4.2 Evasion Attack Algorithm

  • The attack iteratively updates the sample along a unit vector aligned with the objective gradient, using a step size and projecting back when the distance constraint is exceeded.The objective can also use the mimicry/KDE term when the classifier is not sufficiently smooth for gradient descent.Source: §4.2 · p. 19

4.2.1 Gradient of Support Vector Machines

  • SVM discriminant gradients are computed from kernel gradients, which are available for the linear, RBF, and polynomial kernels described.Source: §4.2.1 · p. 20

4.2.2 Gradients of Kernel Density Estimators

  • The kernel-density gradient’s scale is proportional to 1/(nh), so λ should make the density contribution comparable to or larger than the discriminant range to influence descent.Source: §4.2.2 · p. 20

4.2.3 Gradient Descent Attack in Discrete Spaces

  • In discrete spaces, descent can use feasible neighboring points aligned with the objective gradient instead of probing every neighbor, but large steps may increase the objective.The update should favor feasible changes that reduce the objective and ignore changes that raise it.Source: §4.2.3 · p. 21

4.3 Experiments

Experiments illustrate the attack on MNIST and evaluate it on malicious-PDF detection under realistic feature constraints. The results show that small modifications can evade classifiers, while mimicry’s effect depends on kernel and attacker knowledge.

4.3.1 Handwritten Digits

  • With mimicry, the MNIST attack takes longer to reduce the discriminant but transforms a “3” into an image resembling a mixture of “3” and “7”.Without mimicry, the attack quickly reduces the discriminant and is reliably misclassified, but the image has only weak resemblance to “7”.Source: §4.3.1 · p. 22, Figure 5 · p. 22

4.3.2 Malware Detection in PDF Files

  • The PDF evaluation uses malicious and benign samples, keyword-count features, feature-count bounds, and a modification budget reflecting the ability to add but not remove PDF objects.The corpus comprises 500 malicious and 500 benign PDFs, split into five training/testing pairs; each feature count is capped at 100.Source: §4.3.2 · p. 23
  • Even with only 100 surrogate samples, limited-knowledge attacks without mimicry evade classifiers with probability only slightly below perfect-knowledge attacks.Source: §4.3.2 · p. 24
  • 5–10 PDF keyword modifications almost always evade the linear SVM, while the RBF SVM provides greater security than the linear SVM.Figure 6 reports false-negative rates at FP=0.5% as dmax increases; the PDF attacks permit feature increments only.Source: §4.3.2 · pp. 23–24, Figure 6 · p. 25
  • For the RBF SVM, mimicry significantly improves perfect-knowledge evasion, whereas limited-knowledge mimicry shows no significant improvement.For linear SVMs, mimicry decreases evasion success in both knowledge settings; the authors attribute this to a slower, less direct descent path.Source: §4.3.2 · pp. 25–26
  • The authors conclude that a few malicious modifications can significantly degrade detection, motivating systems designed for robustness as well as accuracy.Source: §4.3.2 · p. 26

4.4 Discussion

The discussion describes evasion under both full and limited knowledge, then considers design choices and implementation extensions that may improve security or accommodate non-invertible features.

4.4 Discussion

  • The evasion attack works against SVMs with differentiable kernels and can evade classifiers with high probability when the adversary learns a surrogate from limited knowledge.The attack was also investigated under perfect knowledge; the authors suggest extending its formulation to classifiers with non-differentiable discriminant functions.Source: §4.4 · p. 26
  • Tightly enclosing legitimate samples can force evaders to mimic that class, while penalizing low-density blind spots may improve security at the cost of higher false-positive rates.The discussion notes that malicious packets or PDFs may need to retain valid exploits and may have immutable features; attack samples could also be added to discriminative-classifier training data.Source: §4.4 · p. 26
  • When feature representations are non-invertible, each gradient step can be approximated by modifying the corresponding real-world object to approach the next feature-space point.The examples contrast invertible representations, such as spam-email or PDF features, with n-gram analysis.Source: §4.4 · p. 27
  • Possible extensions include building smaller representative surrogate datasets and improving the classifier estimate by averaging several classifiers with bagging.The passage cites strategies for selecting surrogate data and bagging as examples.Source: §4.4 · p. 27

5 Poisoning Attacks against SVMs

This section introduces poisoning as a training-time attack against SVMs, distinct from the preceding test-time evasion attack, and outlines its coverage in the chapter.

5 Poisoning Attacks against SVMs

  • Poisoning seeks to make an SVM misclassify as many test samples as possible by injecting crafted samples into training data, while leaving test data unmanipulated.The section presents this as a separate attack from test-time evasion.Source: §5 · p. 27
  • Poisoning can target adaptive or online classifiers and systems retrained on test-time-collected data, including unsupervised or semi-supervised systems.The passage also cites application examples in intrusion detection, spam filtering, and biometric authentication.Source: §5 · p. 27
  • The chapter models the poisoning adversary, derives an optimal attack and algorithm, then reports experiments and discusses their findings.The treatment follows the structure used for the preceding evasion section.Source: §5 · p. 27

5.1 Modeling the Adversary

The section applies the security-evaluation framework to poisoning by specifying the attack objective, adversary assumptions and capabilities, and an optimization strategy.

5.1 Modeling the Adversary

  • The framework models the poisoning scenario and derives the corresponding optimal attack strategy.The section introduces the model before specifying the goal, knowledge, capabilities, and optimization problem.Source: §5.1 · p. 27

5.1.1 Adversary’s Goal

  • The poisoning objective is to add points that maximally decrease SVM classification accuracy, beginning with one attack point whose label is fixed but arbitrary.The chosen label defines the attacking class; the other class is the attacked class.Source: §5.1.1 · p. 28

5.1.2 Adversary’s Knowledge

  • The analysis assumes the adversary knows the training samples, feature representation, learning algorithm, and learned parameters, but uses no feedback.These assumptions provide a worst-case estimate of the maximum poisoning error; limited-knowledge poisoning is left for future work despite the potential availability of surrogate data.Source: §5.1.2 · p. 28

5.1.3 Adversary’s Capability

  • The adversary manipulates training data by adding attack-class points one at a time and changing their features within specified lower and upper bounds.The feasible region is a box bounded by x_lb and x_ub.Source: §5.1.3 · pp. 28–29

5.1.4 Attack Strategy

  • The optimal strategy maximizes hinge loss on a separate validation set, targeting generalization error rather than only its training-set estimate.The separate validation set avoids adding a further regularization term to the objective.Source: §5.1.4 · p. 29

5.2 Poisoning Attack Algorithm

The algorithm iteratively adjusts a poisoning point to increase validation loss, using gradients derived from how the SVM solution changes and kernel-specific derivatives.

5.2 Poisoning Attack Algorithm

  • The attack point starts by cloning a point from the attacked class and flipping its label, then moves by gradient ascent while remaining within feasible feature bounds.A starting point too near the attacking class boundary may become a reserve point and halt progress.Source: §5.2 · p. 29, §5.2.1 · p. 30
  • The attack uses a small fixed step because the gradient calculation assumes the SVM support-vector sets remain unchanged; each update recomputes the SVM solution incrementally.The algorithm projects out-of-bounds points onto the feasible region and stops when validation-error change falls below a threshold.Source: §5.2 · p. 29, §5.2.1 · p. 30

5.2.1 Gradient Computation

  • The objective gradient uses contributions from validation points with non-zero hinge loss and is normalized to update the attack point.The gradient step is repeated to maximize the non-convex objective.Source: §5.2.1 · p. 30
  • The gradient computation differentiates the SVM’s KKT conditions while holding the support-vector-set composition fixed, yielding gradients through the kernel matrix.The derivation solves the resulting equations using the Sherman–Morrison–Woodbury formula.Source: §5.2.1 · p. 31

5.2.2 Kernelization

  • Kernel-specific derivatives determine the gradient, and using the previous attack point for sufficiently small steps enables extension to arbitrary differentiable kernels.The passage provides expressions for three common kernels.Source: §5.2.2 · p. 32

5.3 Experiments

The experiments evaluate the gradient-ascent poisoning strategy on a two-dimensional Gaussian example and MNIST digit pairs. On MNIST, optimized single-point attacks sharply increase classification error, while repeated attacks show error rising with training contamination.

5.3.1 Two-dimensional Toy Example

  • The toy example used two Gaussian classes with 25 training and 500 validation points per class, and constrained the linear attack point to x ∈ [−4,4]².The experiment evaluated hinge loss and classification error on the validation set as the attack point moved.Source: §5.3.1 · pp. 32–33
  • For both kernels, gradient ascent found a reasonably good local maximum; the linear attack ended at the bounded region’s corner, while the RBF hinge-loss maximum also maximized classification error in the area.Figure 7 traces the attack point’s gradual shift for the linear and RBF kernels, with C = 1 and γ = 0.5.Source: §5.3.1 · pp. 32–33, Figure 7 · p. 33

5.3.2 Handwritten Digits

  • The MNIST evaluation covered 7 vs. 1, 9 vs. 8, and 4 vs. 0 using a linear SVM with C = 1 and training and validation samples of 100 and 500.The complete MNIST testing data contained about 2,000 samples per digit.Source: §5.3.2 · pp. 33–34
  • The MNIST attack blurred initial digit prototypes toward the attacking class: 7 toward 1, 9 toward 8, and 4 toward 0.Figure 8 shows initial and final attack points alongside validation and testing error increases across iterations.Source: §5.3.2 · p. 34, Figure 8 · p. 34
  • 15–20% classification error followed a single optimized attack point, up from initial error rates of 2–5%.The attack exceeded the error caused by the initial random label flip; validation error generally overestimated classification error because its sample was smaller.Source: §5.3.2 · pp. 34–35
  • 15–20% classification error was reached with 4–6% training contamination in multi-point, multi-run MNIST attacks.Error rose steadily as contamination increased, though its variance was high because the training and validation sets were relatively small.Source: §5.3.2 · p. 35

5.4 Discussion

The poisoning attack is presented as an early step in SVM training-data security analysis, with substantial classification impact despite a nonoptimal gradient-ascent method. The discussion identifies open attack extensions and practical constraints, including attacker control of injected labels.

5.4 Discussion

  • The gradient-ascent poisoning method is not optimal, but attained a surprisingly large impact on SVM classification accuracy.The authors describe this work as a first step toward analyzing SVM vulnerability to training-data attacks.Source: §5.4 · p. 35
  • Further work could test surrogate-data attacks and simultaneous multi-point optimization; greedy sequential single-point attacks were already rather successful.The surrogate-data scenario assumes the adversary lacks the training data but can collect samples from the same distribution.Source: §5.4 · p. 35
  • Bounded losses such as ramp loss may limit the impact of individual attack points, but make SVM optimization non-convex and more computationally demanding.The authors frame this as a trade-off between learning-algorithm complexity and security.Source: §5.4 · p. 35
  • The attack assumes control of injected-point labels, which may not hold when trusted sources such as humans assign labels.Attack data would then need to meet side constraints to fool the labeling oracle, a requirement left for further work.Source: §5.4 · pp. 35–36
  • Multi-point, multi-run MNIST experiments plotted poisoning-related classification error against training-contamination percentage for validation and test sets across the 7-vs-1, 9-vs-8, and 4-vs-0 tasks.Source: Figure 9 · p. 36

6 Privacy Attacks against SVMs

The section models privacy threats to SVM training data and presents differentially private SVM learning as a countermeasure. It gives sensitivity and utility guarantees, discusses extensions, and notes that practical attacks on SVM training-data privacy remain unexplored.

6.1 Modeling the Adversary

  • The attacker seeks an individual training datum’s features or label and may know all other training data, the learning mechanism and classifier parameters, and have unlimited classifier feedback.The model also allows manipulation of training and test data, except direct modification of the unknown target datum.Source: §6.1.1 · p. 37, §6.1.2 · p. 38, §6.1.3 · p. 38

6.1.4 Attack Strategy

  • A proposed attack guesses a missing datum and iteratively simulates SVM training, updating the guess to shift the learned parameters toward the released classifier.The discussion describes this as a general approach; practical attacks on SVM training-data privacy remain unexplored.Source: §6.1.4 · pp. 38–39

6.2.1 Background on Differential Privacy

  • Differential privacy compares the distributions of learned functions on neighboring datasets, which differ by a training datum; smaller β makes those distributions closer.The stated privacy guarantee is intended to limit information revealed about an individual datum, even with extensive access to the learner and side information.Source: §6.2.1 · pp. 39–40

6.2.2 Global Sensitivity of Linear SVM

  • The linear SVM’s L1 global sensitivity is upper-bounded by 4Cκ for finite-dimensional features, bounded L2 norm, hinge loss, and C > 0.The result also extends to convex Lipschitz losses.Source: §6.2.2 · p. 41

6.2.3 Differentially-Private SVMs

  • Adding Laplace noise to the learned SVM weight vector yields β-differential privacy, with noise depending on the desired privacy level, SVM stability, and training conditions.With C typically scaling as 1/n, the noise decreases as the training set grows; tighter privacy, higher C, or greater κ or F increases it.Source: §6.2.3 · p. 41, §6.2.2 · p. 41
  • The private SVM has an (ε,δ)-utility guarantee relative to the non-private SVM with the same C and kernel, while privacy and accuracy trade off with the mechanism’s parameters and data conditions.The utility bound concerns point-wise prediction closeness over M with high probability; higher C or κ, Φ, or F permits less accuracy under the stated result.Source: §6.2.3 · pp. 41–42

6.3 Discussion

  • The privacy mechanism extends to certain translation-invariant kernels, including the infinite-dimensional RBF, through a training-data-independent random-kernel approximation and a primal SVM solution.The approximation composes with the utility result to provide an analogous utility guarantee.Source: §6.3 · pp. 42–43
  • The section also reports lower bounds on utility for private learners, with pathological, unrealistic witnesses, and notes that further work is needed to sharpen them.It contrasts this approach with Chaudhuri et al., which adds noise to the primal objective but does not allow hinge loss.Source: §6.3 · p. 43

7 Concluding Remarks

The chapter concludes that evasion, poisoning, and privacy attacks are feasible threats to SVMs. Its examples include high-probability evasion after few pattern modifications and a single poisoning point that substantially raises classification error.

Evasion

  • SVMs with linear and RBF kernels were evaded with high probability after a few attack-pattern modifications in perfect- and limited-knowledge simulations.The analysis also notes that when a classifier tightly encloses legitimate samples, evasion requires close mimicry, which may indicate a feature-representation flaw if such mimicry remains possible.Source: §7 · p. 43

Poisoning

  • A single poisoning point raised classification error from initial rates of 2–5% to 15–20%, and the attack achieved higher error rates than random label flips.The discussion identifies bounded losses, kernels, or feature values as ways intended to limit an individual point’s influence, while calling for further investigation of bounded-loss SVMs.Source: §7 · pp. 43–44

Privacy

  • The chapter also presents an SVM learning algorithm that preserves differential privacy and provides bounds on the utility of its predictions relative to a non-private SVM.The mechanism adds Laplace-distributed noise to the weight vector, with scale depending on SVM stability and the desired privacy level.Source: §7 · p. 44

Related papers

Loading 1401.7727v1…