Source-linked AI summary
Adversarial Training of Linear Models under Stealthy Attacks
Lovisa Eriksson, Dave Zachariah, André M. H. Teixeira
TL;DR
The paper addresses false data injection attacks that can evade existing detection and adversarial-training guarantees. It proposes a detector-based switched model with protected features and derives convex adversarial-risk formulations for linear prediction, with experiments supporting improved performance on partially attacked data.
Problem
Predictive models are vulnerable to false data injection attacks, while existing detection and adversarial-training approaches lack guarantees against stealthy attacks.
Method
The paper proposes a detector-based switched model with protected features and derives convex adversarial-risk formulations for linear and logistic regression.
Results
Numerical experiments on synthetic and real data support the resulting model, and secure recovery reverts to the nominal prediction rather than trusting unprotected features.
Takeaways & Limitations
The framework makes the trade-off between clean and attacked data regimes explicit through the attack-probability hyperparameter.
Abstract
from arXiv · showhide
Predictive models are widely used in many fields, but are vulnerable to false data injection attacks. To address this, detection schemes and adversarial training have been proposed, but such approaches lack guarantees against stealthy attacks. We therefore propose a detector-based switched model, in which optimal attack strategies are stealthy. For linear prediction models, we derive a convex formulation of the resulting adversarial risk. The model incorporates protected features and introduces a hyperparameter modelling attack probability, enabling an explicit performance trade-off between clean and attacked data regimes. Numerical simulations on real and synthetic data show improved performance on partially attacked data, even for misspecified attack probabilities.
I. INTRODUCTION
Predictive models can fail under distribution shifts and false data injection attacks, while existing defenses do not analytically characterize performance trade-offs across clean and attacked regimes. The paper proposes a detector-based switched model that supports stealthy attacks, protected features, explicit clean–attacked trade-offs, and convex adversarial training for linear models.
- False data injection attacks intentionally craft new data to deteriorate predictive-model performance.
- Existing approaches constrain attack magnitude or impose stealthiness, but do not analytically characterize performance trade-offs across regimes.
- The proposed model switches between modes according to whether an attack detector triggers an alarm, while allowing attacks to be stealthy.
- The framework protects some features and derives formal results for linear models.
- Its contributions include explicit clean-versus-attacked accuracy trade-offs, adversarial stealthiness induced by the prediction model, and convex formulations for linear-model adversarial training.
II. PROBLEM FORMULATION
The problem formulation models clean and attacked test observations with protected features, an attack probability, and a detector-driven switched predictor. The recovery model handles detector-triggered observations, but detector-aware attackers can evade detection, motivating robustness to stealthy attacks.
- Training uses independent clean samples, while test features may be manipulated with probability γ and are partitioned into protected and unprotected components.
- An adversarial attack leaves protected features fixed and chooses unprotected features to maximize a model’s loss.
- A deterministic anomaly detector maps observed features to an alarm indicator and has false alarm rate p(δ(ex) = 1|a = 0).
- The switched predictor uses a nominal model when δ = 0 and a recovery model when δ = 1.
- Minimizing switched-model risk can be no worse than using either component model alone.
- Complete detector knowledge lets attackers design stealthy events that evade detection, so robustness is targeted under a detector false-alarm bound.
III. THEORETICAL RESULTS
The paper establishes security conditions for detector-based switched models, making adversarial attacks effectively stealthy and enabling convex risk formulations for linear and logistic prediction. The resulting models support global numerical optimization while balancing clean and attacked regimes through attack probability.
- Security of the switched model: The secure recovery model imputes unprotected features and reverts to the base prediction instead of trusting attacked values.When an attack is detected, this design prevents the attack event from causing greater harm.
- Security of the switched model: A secure recovery model makes any adversarial attack event equivalent in risk to a stealthy attack.Security supplies an imputation mapping that preserves protected features and yields an undetected recovery input when needed.
- Detector construction: The detector uses an energy-based rule whose threshold can control false alarms under general or Gaussian feature distributions.Chebyshev bounds the false-alarm rate for general distributions, while Gaussian assumptions permit an exact chi-test rate.
- Security of the switched model: The paper shows that suitable recovery parameters θ1 can make the switched model secure for both linear and logistic regression.This security result is established for the detector-based switched model and its specified imputation function.
- Convex adversarial risk: For linear regression, the stealthy adversarial risk with attack probability γ is convex in θ0 and θ1.The risk decomposes into clean and attacked components weighted by 1 − γ and γ, respectively.
- Convex adversarial risk: For logistic regression, the corresponding stealthy adversarial risk is also convex in the model parameters θ.The result follows from the convexity of logistic loss and norms.
IV. METHOD
Adversarial training minimizes empirical loss on clean training data while constraining the model to satisfy the security condition. The procedure requires specifying false-alarm and training attack-probability bounds.
- Adversarial training minimizes empirical risk subject to the security constraint using clean training data.The empirical objective is optimized with stochastic gradient descent, momentum, and a decreasing step size.
- The method requires an upper bound on false alarms, ¯α, and an assumed training attack probability, γtrain.
V. NUMERICAL RESULTS
The numerical evaluation compares the proposed switched model with fully secure and standard switched baselines under stealthy attacks. Risk is measured as attack probability varies using separate train and test sets.
- The fully secure baseline discards unprotected features, while the standard switched model is optimized for clean-data risk.The fully secure model is secure with respect to any detector and itself; the standard switched model uses a clean-risk minimizer for its nominal component.
- Models are evaluated by empirical risk under stealthy attacks with test attack probability γtest.Data are split evenly into training and test sets, and experiments use synthetic and real-world data.
A. Synthetic data
Synthetic experiments use a four-dimensional correlated Gaussian regression problem. The proposed switched model performs favorably across attack probabilities, including when the training attack-probability assumption is misspecified.
- A. Synthetic data: The synthetic task uses linear regression with d = 4, labels defined by y = Σ_i=1^4 x_i, and n = 2000 training samples.Features are zero-mean Gaussian with unit variances and selected covariance pairs equal to 0.8.
- A. Synthetic data: Stealthy attacks are detrimental to the standard model because no attacks are detected.
- A. Synthetic data: When γtrain = γtest = 0, the proposed switched model matches the standard model and converges toward the fully secure model as γtest increases.
- A. Synthetic data: With misspecified γtrain, the proposed model has a risk range below the fully secure model and remains consistently below the standard model.The passage reports this behavior for an underestimated training attack probability.
- A. Synthetic data: Other Gaussian settings and logistic regression show the same overall behavior, differing only in convergence rate.
B. Real world data
Real-world evaluation uses Credit Card Fraud Detection data with one protected feature and 21 unprotected features. The figures examine risk across attack probabilities and compare switched-model baselines under specified false-alarm settings.
- B. Real world data: The Credit Card Fraud Detection dataset contains n = 569k samples, with ‘amount’ protected and 21 features treated as unprotected.Seven features were removed because of high correlation with other features.
- B. Real world data: Figure 1 plots risk against γtest and γtrain, including misspecified γtrain = 0.05 and comparisons with standard switched and fully secure models.The setting ¯α = 0.01 yields an actual false alarm rate of 1.3%.
- B. Real world data: Figure 2 plots risk against γtest and additionally includes the standard switched model.The chosen ¯α produces an actual false alarm rate of 0.01%.
VI. CONCLUSION
The paper shows that attack detection and alignment with the nominal model force adversarial attacks to be stealthy, while enabling convex adversarial-risk formulations for linear and logistic regression.
- An attack detector combined with recovery-model alignment to the nominal model forces adversarial attacks to be stealthy.
- The paper derives a convex risk formulation for the proposed setup in linear and logistic regression.
- Numerical results support the optimality of the resulting model.