Source-linked AI summary
Is feature selection secure against training data poisoning?
Huang Xiao, Battista Biggio, Gavin Brown, Giorgio Fumera, Claudia Eckert, Fabio Roli
TL;DR
Poisoned training data may undermine feature selection in security-sensitive machine learning, but the extent of this vulnerability is unclear. The paper develops an attack framework for popular embedded selectors and finds that poisoning can nearly randomize feature choices, motivating secure alternatives.
Problem
It is unclear whether feature selection remains beneficial or becomes counterproductive when intelligent attackers poison training data in security applications.
Method
The paper develops a framework for modeling attacks against feature selection and applies it to poisoning strategies targeting LASSO, ridge regression, and elastic net.
Results
Feature selection can be significantly compromised under attack: stability quickly approaches zero with few poisoning samples, and poisoning up to 20% increases LASSO classification error from 2% to 20%.
Takeaways & Limitations
The findings motivate engineering secure feature selection algorithms and investigating robust feature-selection approaches against poisoning.
Takeaways & Limitations
The empirical security analysis is a PDF malware-detection case study, while the authors identify training-size-to-dimensionality effects as a topic for further analysis.
Abstract
from arXiv · showhide
Learning in adversarial settings is becoming an important task for application domains where attackers may inject malicious data into the training set to subvert normal operation of data-driven technologies. Feature selection has been widely used in machine learning for security applications to improve generalization and computational efficiency, although it is not clear whether its use may be beneficial or even counterproductive when training data are poisoned by intelligent attackers. In this work, we shed light on this issue by providing a framework to investigate the robustness of popular feature selection methods, including LASSO, ridge regression and the elastic net. Our results on malware detection show that feature selection methods can be significantly compromised under attack (we can reduce LASSO to almost random choices of feature sets by careful insertion of less than 5% poisoned training samples), highlighting the need for specific countermeasures.
1. Introduction
Security-sensitive machine-learning applications face growing attack opportunities and high-dimensional feature spaces, making feature selection useful but potentially vulnerable to adversarial manipulation. This work develops a framework and evaluates poisoning attacks against popular embedded feature-selection methods.
- Security applications increasingly use machine learning for tasks including spam and malware detection, web-page ranking, and network protocol verification.
- Large feature sets make learning challenging, while feature selection can reduce dimensionality effects, improve generalization, and produce efficient, more interpretable models.
- Attackers may increasingly target machine-learning techniques deployed in security-sensitive settings with specifically crafted attacks.
- Recent work identified vulnerabilities involving feature selection, including evasion facilitated when features are not selected through adversary-aware procedures.
- Poisoning attacks threaten data-driven technologies by injecting malicious training data, with practical relevance to applications such as collaborative spam filtering and malware collection.
- The paper proposes a framework for attacks on feature selection and formalizes poisoning strategies against LASSO, ridge regression, and elastic net, evaluating feature selection and classification error in PDF malware detection.
2. Feature Selection Under Attack
The framework characterizes feature selection under attack by specifying the attacker’s goal, knowledge, and data-manipulation capabilities. It distinguishes security violations and attack settings, then formulates optimal attacks through an objective over feasible manipulated samples.
- The framework defines feature selection as selecting a relevant feature subset by minimizing a criterion over the training data.
- A feature subset is represented by π ∈ {0, 1}^d, and the selection algorithm h(D) minimizes a criterion L(D, π), such as classification error.
- Attacker goals are categorized by security violation—integrity, availability, or privacy—and by specificity, distinguishing targeted from indiscriminate attacks.
- The attacker’s knowledge may concern the training data, feature representation, and selection algorithm, ranging from partial access to complete system knowledge.
- Privacy attacks against feature selection are described as speculative, and the instability of feature-selection algorithms makes them difficult to reverse-engineer.
- Poisoning gives the attacker causative influence by injecting crafted samples into training data, whereas evasion manipulates malicious samples at test time.
- The optimal attack strategy maximizes an objective W over feasible manipulated samples, conditioned on attacker knowledge θ and modification space Φ(A).
3. Poisoning Embedded Feature Selection
The paper constructs poisoning attacks against embedded feature-selection methods by differentiating through their regularized learning objectives and iteratively modifying injected samples. The approach handles LASSO, ridge, and elastic net models under feasible feature constraints and discrete-valued heuristics.
- LASSO, ridge regression, and elastic net select features through a linear model that trades off training loss against regularization.
- The common selection criterion uses quadratic loss, while LASSO, ridge, and elastic net apply ℓ1, ℓ2, and combined ℓ1–ℓ2 regularization, respectively.
- When at most k features may be selected, the method retains the k weights with largest absolute values.
- The poisoning objective increases classification error by enforcing selection of an incorrect feature subset, under PK or LK knowledge and a bounded number of injected points.
- The attacker optimizes injected samples with subgradient ascent, repeatedly updating the learned model while simulating feature selection on poisoned data.
- The attack differentiates through model parameters using KKT optimality assumptions, then solves a linear system to obtain the gradients used for sample updates.
- For multiple attack points, the algorithm iteratively updates each point, uses line search and projection onto a feasible domain, and applies gradient-guided neighbor search for discrete features.
4. Experiments
The experiments evaluate poisoning attacks against feature selection for PDF malware detection, measuring classification error, selected-feature counts, and selection stability. Carefully crafted poisoning substantially degrades performance and can make sparse feature selection behave nearly randomly.
- Experimental setup: The study uses PDF malware detection with keyword-count features, 5,993 malware samples, 5,951 benign samples, and an initial set of 114 keywords.Five random training/test splits use 300 training samples and 5,000 test samples.
- Experimental setup: Figure 2 compares PK and LK poisoning against LASSO, ridge, and elastic net as the injected-poisoning percentage increases from 0% to 20%.It reports classification error, automatically selected-feature counts, and stability for the top k = 30 and k = 50 features, averaged over five runs.
- Evaluation measures: The experiments evaluate selection stability by comparing unpoisoned and attacked feature subsets using Kuncheva’s Stability Index for equal-sized top-k sets.Pairwise combinations are averaged to obtain the expected index and standard deviation.
- Attack constraints: A keyword-count bound constrains the attacker because otherwise an unconstrained number of added keywords could arbitrarily influence training.The bound limits manipulation without affecting generalization accuracy absent attack.
- Results: 10-fold classification-error growth occurs for LASSO under 20% poisoning, from 2% to 20%, while elastic net and ridge degrade slightly less.The proposed poisoning strategy is more effective than random label-flip attacks.
- Results: The stability index quickly approaches zero under small poisoning fractions, especially for LASSO and elastic net, indicating nearly random feature selection.Ridge is more robust among the tested methods, plausibly because it selects larger subsets and spreads weights more evenly.
5. Discussion
The discussion contrasts the apparent vulnerability of sparse regularization under poisoning with its robustness to non-adversarial perturbations. Poisoning introduces systematic bias, which can make sparsity-promoting selection easier to compromise.
- Discussion: ℓ1 regularization reduces variance by selecting smaller feature subsets, but does so at the expense of higher bias under non-adversarial perturbations.Its reported robustness in that setting does not imply robustness to poisoning.
- Discussion: Poisoning attacks induce systematic bias into the training set, potentially increasing the bias component for sparse feature-selection algorithms.The discussion notes a similar vulnerability for sparse algorithms under evasion attacks.
- Discussion: The discussion reports that ℓ1 regularization may worsen performance under attack, consistent with prior findings in evasion settings.The underlying attack scenarios differ, but both manipulate data to induce specific bias.
6. Conclusions and Future Work
The paper presents a framework for modeling attacks on feature selection and shows severe poisoning vulnerability in PDF malware detection. It concludes that secure feature selection requires dedicated defenses and further theoretical analysis.
- Conclusions: The framework models attack scenarios using explicit assumptions about the attacker’s goal, knowledge, and capabilities.It is applied to poisoning attacks against LASSO, ridge, and elastic net.
- Conclusions: Attackers can completely control reduced feature-subset selection by injecting only a small fraction of poisoning training points, especially when sparsity is enforced.This result is reported for a real-world PDF malware-detection application.
- Future work: The findings demand engineering secure feature-selection algorithms against poisoning attacks.Suggested directions include adversary-aware feature selection and robust LASSO or robust regression.
- Future work: Future theoretical work should examine poisoning relative to training-set size and feature dimensionality, and its effects on bias-variance decomposition.These analyses may inform secure feature-selection procedures.