PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Feature Selection against Evasion Attacks

Fei Zhang, Patrick P. K. Chan, Battista Biggio, Daniel S. Yeung, Fabio Roli

arXiv:2005.12154v1cs.LGcs.CRstat.ML

TL;DR

Feature selection can reduce classifier security against test-time evasion, but its security effects have not been thoroughly investigated. The paper proposes an adversary-aware, wrapper-based selection model that jointly considers generalization and attack resistance, and validates it on spam and PDF-malware detection. The approach improves security without significantly affecting performance without attacks, while its current implementation requires attack simulation.

  • Problem

    The paper addresses limited understanding of how reduced feature sets affect classifier security against evasion attacks, despite feature selection’s relevance in security-sensitive classification.

  • Method

    The paper selects features by optimizing classifier generalization together with a security term based on evasion hardness, using a wrapper-based implementation.

  • Results

    The proposed approach outperforms traditional feature selection in classifier security without significantly affecting performance in the absence of attacks, across spam and PDF-malware examples.

  • Takeaways & Limitations

    Feature selection can be made more compatible with adversarial settings by incorporating assumptions about adversarial data manipulation into the selection objective.

  • Takeaways & Limitations

    The wrapper implementation increases computational complexity because it requires simulating attacks against the targeted classifier.

Abstract

from arXiv · show

Pattern recognition and machine learning techniques have been increasingly adopted in adversarial settings such as spam, intrusion and malware detection, although their security against well-crafted attacks that aim to evade detection by manipulating data at test time has not yet been thoroughly assessed. While previous work has been mainly focused on devising adversary-aware classification algorithms to counter evasion attempts, only few authors have considered the impact of using reduced feature sets on classifier security against the same attacks. An interesting, preliminary result is that classifier security to evasion may be even worsened by the application of feature selection. In this paper, we provide a more detailed investigation of this aspect, shedding some light on the security properties of feature selection against evasion attacks. Inspired by previous work on adversary-aware classifiers, we propose a novel adversary-aware feature selection model that can improve classifier security against evasion attacks, by incorporating specific assumptions on the adversary's data manipulation strategy. We focus on an efficient, wrapper-based implementation of our approach, and experimentally validate its soundness on different application examples, including spam and malware detection.

I. INTRODUCTION

Adversarial evasion attacks challenge machine-learning systems by manipulating malicious test samples, while the security effects of feature selection remain insufficiently understood. The paper evaluates this gap and proposes selecting features jointly for generalization and evasion security.

  • Adversarial setting: Evasion attacks manipulate malicious test samples at deployment time to cause misclassification, including by obfuscating spam, malware, or network-attack content.
  • Feature-selection gap: Feature selection may worsen evasion security because reduced feature sets can let attackers reach comparable outcomes by modifying fewer features.
  • Paper approach: The paper systematically evaluates reduced feature sets and proposes an adversary-aware selection model that jointly optimizes classifier generalization and security against manipulation.
  • Adversarial setting: Traditional learning assumes training and test data share a distribution, but adversaries can violate this assumption by carefully manipulating inputs.
  • Security measure: Classifier security can be measured by hardness of evasion, the expected minimum cost of modifying a malicious sample until it is classified as legitimate.

B. Feature Selection, Robustness, and Stability

Feature selection reduces computational and representational burdens, but conventional methods optimize accuracy or surrogates without accounting for adversarial evasion. Existing robustness notions and methods do not fully address wrapper-based security against test-time manipulation.

  • Feature-selection role: Feature selection chooses relevant features to improve generalization, reduce time and space complexity, and facilitate data understanding and visualization.
  • Feature-selection categories: Filter methods rank subsets largely independently of the classifier, whereas other methods guide selection using classifier performance.
  • Security weakness: Traditional feature selection optimizes classification accuracy without considering adversarial attacks, and may leave classifiers evadable with fewer data modifications.
  • Robustness distinctions: Robustness to random training-set perturbations differs from robustness to adversarial manipulations considered in newer approaches and this paper.
  • Research gap: The paper identifies a gap in wrapper-based feature selection designed specifically to learn classifiers more secure against test-time evasion attacks.

III. ADVERSARIAL FEATURE SELECTION

The proposed criterion selects a fixed-size feature subset by balancing estimated classifier generalization against security to evasion. Security is operationalized as the average minimum manipulation cost, but reliable estimation currently requires a wrapper that simulates attacks.

  • Selection criterion: Feature selection chooses m of d features by optimizing a weighted combination of classifier generalization capability and evasion security.
  • Selection criterion: The selection vector θ is binary, with selected features marked 1, and the constraint can require exactly m or at most m selected features.
  • Generalization term: Generalization G(θ) can be estimated with application-specific utility measures, such as classification accuracy, using available samples and cross-validation.
  • Security term: Security S(θ) is hardness of evasion: the average minimum number of modifications required for malicious samples to evade detection.
  • Implementation: The security term depends on feature-subset size, so the trade-off parameter λ may need rescaling when comparing subsets of different sizes.
  • Implementation: Because no reliable attack-free estimator of evasion security is available, the paper uses wrapper-based selection that simulates attacks against each trained classifier.

A. Wrapper-based Adversarial Feature Selection (WAFS)

WAFS extends wrapper-based feature selection by evaluating both classifier generalization and security during iterative feature selection. It selects features using a rescaled trade-off between these two criteria.

  • A. Wrapper-based Adversarial Feature Selection (WAFS): WAFS is a wrapper-based forward-selection or backward-elimination procedure that returns a binary vector identifying the selected features.Forward selection starts empty and adds features; backward elimination starts full and deletes features until the target size is reached.
  • A. Wrapper-based Adversarial Feature Selection (WAFS): At each iteration, every candidate feature is evaluated by training the classifier and estimating generalization G(θ) and security S(θ) through cross-validation.The candidate with the highest combined objective is selected after evaluating the relevant feature subset.
  • A. Wrapper-based Adversarial Feature Selection (WAFS): The selection criterion combines G(θ) and λS(θ), with λ rescaled using the maximum candidate security value before choosing the next feature.This rescaling is performed at each iteration to balance the security term with the generalization term.
  • A. Wrapper-based Adversarial Feature Selection (WAFS): Unlike traditional wrapper methods, the proposed approach evaluates classifier security in addition to generalization when selecting each feature.Traditional wrappers use classifier performance to guide feature selection, whereas this method also incorporates the security term.

B. Evaluating Classifier Security to Evasion

The paper evaluates evasion by finding the closest malicious-sample modification that crosses the classifier’s decision boundary, using gradient-based optimization under feature-space constraints. Algorithm 2 handles linear and differentiable nonlinear classifiers, but nonlinear landscapes can produce local minima or failed projections.

  • B. Evaluating Classifier Security to Evasion: Optimal evasion searches for the closest sample x′ to a malicious sample x that evades detection under a chosen distance function.The optimization may use black-box search, while the paper develops a gradient-based procedure for relevant differentiable cases.
  • B. Evaluating Classifier Security to Evasion: The ℓ1-norm favors sparse manipulation of a few features, whereas the ℓ2-norm suits attacks that distribute smaller changes across many features.The appropriate distance depends on the feature space and the attacker’s preferred manipulation pattern.
  • B. Evaluating Classifier Security to Evasion: Algorithm 2 moves toward the decision boundary when the current point remains malicious and reduces the distance objective after entering the feasible evasion region.It projects points back into additional feasible domains when constraints such as box bounds are violated.
  • B. Evaluating Classifier Security to Evasion: The analysis assumes continuous feature values on a potentially compact space, while discrete features require a different search procedure.The paper notes that non-differentiable classifier extensions are left for future work.
  • B. Evaluating Classifier Security to Evasion: For a linear classifier with ℓ2 distance, the optimal evasion point has an analytical solution determined by the classifier’s weights, bias, and discriminant value.The point is obtained by moving from x along the weight direction by a distance proportional to g(x)/||w||2.
  • B. Evaluating Classifier Security to Evasion: For differentiable nonlinear classifiers, gradient descent can encounter local minima, and projection may fail when the gradient becomes zero while the sample remains malicious.The paper addresses this by trying different initialization locations before running gradient descent.
  • B. Evaluating Classifier Security to Evasion: Algorithm 2 quickly converges to the optimal evasion point for linear g(x) from either proposed initialization.The figure illustrates descent paths under different distance functions, SVM types, and continuous or discrete representations.

1) Gradients:

Algorithm 2 requires gradients of both the distance function and classifier discriminant. The paper provides these for ℓ1/ℓ2 distances, linear classifiers, and kernelized SVMs, and notes extension to differentiable nonlinear models.

  • 1) Gradients:: For ℓ2 and ℓ1 distances, the gradients with respect to x′ are 2(x′ −x) and sign(x′ −x), respectively.The sign function is defined componentwise, with zero, positive, or negative values determined by each coordinate difference.
  • 1) Gradients:: For a linear discriminant g(x)=⟨w,x⟩+b, the gradient is the feature-weight vector w.The classifier parameters are the weights w and bias b.
  • 1) Gradients:: For a kernelized SVM, the discriminant gradient is the weighted sum of kernel gradients, ∇g(x)=Σ_i α_i y_i∇k(x,x_i).The coefficients and bias are learned during training, and the kernel derivative must be computable for the chosen numeric kernel.
  • 1) Gradients:: For the RBF kernel, ∇k(x,x_i)=−2γ exp{−γ∥x−x_i∥2}(x−x_i), providing the derivative needed by the attack procedure.The approach can extend to other differentiable nonlinear classifiers, including neural networks.

2) Descent in discrete spaces:

In discrete feature spaces, exact gradient descent is unavailable because gradient steps may produce inadmissible feature values. The attack therefore searches feasible neighboring samples for objective decreases.

  • 2) Descent in discrete spaces:: Discrete-space descent selects a feasible neighbor that maximally decreases the objective at each step.This neighborhood search may require exponentially many objective queries in the number of features.

IV. SECURITY EVALUATION

The security evaluation simulates test-time evasion under explicit assumptions about attacker goals, knowledge, and manipulation capability. It considers both perfect and limited knowledge, with limited-knowledge attackers using surrogate classifiers.

  • The evaluation procedure simulates attacks potentially incurred at test time using assumptions about the adversary’s goal, system knowledge, and manipulation capability.The attacker seeks to evade detection by manipulating malicious test samples.
  • Under perfect knowledge, the attacker fully knows the classification algorithm and can perform a worst-case attack.
  • Under limited knowledge, the attacker lacks the true discriminant function but learns a surrogate classifier from collected surrogate data.The surrogate is then used to construct evasion points against the targeted classifier.
  • The manipulation constraint bounds the maximum amount of changes to the initial malicious sample through cmax.The modified sample is selected to be misclassified as legitimate with the highest possible confidence under that bound.

V. APPLICATION EXAMPLES

The paper validates its adversarial feature selection approach empirically on spam filtering and PDF malware detection. The experiments compare traditional and adversarial feature selection methods across distinct classifiers and application settings.

  • The empirical validation covers spam filtering and PDF malware detection as two application examples.The paper describes these examples as representative cases for assessing empirical performance.
  • Spam experiments compare traditional forward feature selection with its adversarial counterpart using a linear SVM.
  • PDF malware experiments compare traditional and adversarial backward feature elimination using an SVM with an RBF kernel.

A. Spam Filtering

The spam experiments use bag-of-words email features and evaluate traditional versus adversarial forward selection under perfect- and limited-knowledge attacks. WAFS improves security under attack while preserving no-attack performance overall.

  • Spam filtering: Spam emails are represented with binary bag-of-words features, and evasion changes feature values through bad-word obfuscations or good-word insertions.
  • Experimental setup: The TREC 2007 corpus contains 25,220 legitimate and 50,199 real spam emails, with the dictionary extracted from the first 5,000 emails.
  • Experimental setup: The security evaluation tunes λ to maximize average TP at the 1% FP operating point across cmax ∈[0, 20].A maximum 1% decrease in no-attack TP is treated as tolerable when selecting λ.
  • Experimental setup: The experiments repeatedly split sampled data into training and test sets, selecting 1 to 499 features through 5-fold cross-validation.
  • Experimental results: Under attack, WAFS always significantly outperformed traditional selection for both PK and LK scenarios, whereas no-attack performance was similar.With limited attacker knowledge, manipulating up to 20 known selected words could almost surely evade the true classifier under traditional selection.
  • Experimental results: WAFS required attackers to modify more words for every considered subset size without significantly changing no-attack accuracy G(θ).The result supports maximizing the security term S(θ) during feature selection.
  • Security measures: Weight evenness and hardness of evasion had an almost-zero Pearson correlation, so weight evenness may not characterize classifier security adequately.The proposed explanation is that weight evenness uses classifier weights but not data-distribution information.

B. Malware Detection in PDF Files

The PDF malware experiments evaluate adversarial backward feature elimination with an RBF-SVM on discrete keyword-count features. WAFS generally improves attack security without significantly reducing no-attack accuracy, though variability and computational cost are higher.

  • Malware detection in PDF files: PDF files are modeled through keyword-occurrence features extracted from a dataset containing 5,591 legitimate and 5,993 malicious PDFs.The initial feature set contains 114 distinct keywords.
  • Evaluation measures: The PDF feature space is discrete, and S(θ) measured with the ℓ1 norm counts added keywords divided by 100.The evaluation again uses an algorithm designed for discrete spaces.
  • Experimental setup: Feature subsets from 1 to 113 were selected by traditional and adversarial backward elimination using 5-fold cross-validation, with λ = 0.9.
  • Experimental results: WAFS outperformed traditional selection under attack without significant no-attack performance loss for RBF-SVM models evaluated on 23, 46, 68, and 91 features.
  • Experimental results: In the LK scenario, significantly higher TP differences favored WAFS for most subset sizes, although high variability prevented significance in some cases.For subsets of 23, 46, and 68 features, WAFS was significantly better except when cmax ∈[0, 0.03].
  • Security and cost: WAFS produced significantly higher S(θ) values in both attack scenarios without significantly affecting G(θ).Computing S(θ) for a nonlinear classifier requires more computational complexity than for a linear classifier.
  • Security mechanism: The security improvement is associated with selecting features having higher average values for the malicious class, which makes legitimate-class mimicry harder under x ≤x′.

VI. CONCLUSIONS AND FUTURE WORK

Traditional feature selection can reduce computational complexity and address dimensionality, but may weaken security against evasion attacks. The proposed adversarial method improves security while retaining reduced feature representations, although computational cost and complex feature mappings remain important boundaries.

  • Traditional feature selection supports smaller, more manageable representations, but its performance can be affected when training and test distributions differ under adversarial manipulation.The method addresses this security concern rather than optimizing only ordinary classification performance.
  • The proposed adversarial feature selection method optimizes both wrapped-classifier generalization and security against test-time evasion attacks.It extends classifier-security modeling to nonlinear classifiers with continuous or discrete features.
  • Experiments on spam and PDF malware detection showed improved security over traditional approaches without significantly changing performance in the absence of attacks.
  • The wrapper-based method increases computational complexity because it simulates evasion attacks against the wrapped classifier at each iteration.This motivates surrogate security measures that could support more efficient filter-based feature selection.
  • For complex feature mappings, deriving real malicious samples that realize optimal feature-space attacks is nontrivial because of the inverse feature-mapping problem.Restricting attackers to realistic sample manipulations may yield only suboptimal evasion points.
  • The work provides an initial concrete basis for understanding feature-selection vulnerabilities and developing more secure feature-selection schemes in adversarial settings.
Loading 2005.12154v1…