AI SECURITY: Defending Machine Learning Against Adversarial Attacks

Author

Ashitha, Prof. Riya Prakash, Dr. L. C. Manikandan

Abstract

 Artificial Intelligence (AI) and Machine Learning (ML) have become important technologies in applications such as healthcare, autonomous systems, cybersecurity, image recognition and natural language processing. However, the increasing dependence on ML models has also introduced new security vulnerabilities. Adversarial attacks are deliberate manipulations designed to cause machine-learning systems to produce incorrect or unintended outputs. These attacks can target different stages of the machine-learning lifecycle, including training data, model development and inference. This paper presents an overview of adversarial attacks against machine-learning systems and examines major defense mechanisms used to improve model robustness. The study discusses adversarial examples, evasion attacks, poisoning attacks, black-box attacks, adversarial attacks against reinforcement learning and other emerging threats. Various defense techniques, including adversarial training, robust optimization, input preprocessing, anomaly detection and model-level protection, are also examined. The paper further discusses challenges such as attack transferability, computational cost, robustness-accuracy trade-offs and the limitations of existing defenses. The review highlights the importance of adopting a layered AI-security approach in which machine-learning models are continuously evaluated, monitored and protected throughout their lifecycle.

Keywords

Artificial Intelligence, Machine Learning, AI Security, Adversarial Attacks, Adversarial Examples, Adversarial Defense, Machine Learning Security

Full Text:

Download Paper PDF

References

[1]  B. Biggio and F. Roli, “Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning,” Pattern Recognition, vol. 84, pp. 317–331, 2018, doi: 10.1016/j.patcog.2018.07.023.

[2] Y. Li, B. Wu, H. Wu, and Y. Wang, “The Security of Machine Learning in an Adversarial Setting: A Survey,” Journal of Parallel and Distributed Computing, 2018.

[3] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and Harnessing Adversarial Examples,” in International Conference on Learning Representations (ICLR), 2015.

[4] A. Chakraborty, M. Alam, V. Dey, A. Chattopadhyay, and D. Mukhopadhyay, “Adversarial Attacks and Defenses Against Deep Neural Networks: A Survey,” Procedia Computer Science, vol. 140, pp. 152–161, 2018, doi: 10.1016/j.procs.2018.10.315.

[5]  Y. Yuan, W. Li, and X. Wu, “A Survey of Practical Adversarial Example Attacks,” Cybersecurity, vol. 1, art. no. 9, 2018, doi: 10.1186/s42400-018-0012-9.

[6]  M. Jagielski, A. Oprea, B. Biggio, C. Liu, C. Nita-Rotaru, and B. Li, “Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning,” in 2018 IEEE Symposium on Security and Privacy (SP), pp. 19–35, 2018, doi: 10.1109/SP.2018.00057.

[7] T. Gu, B. Dolan-Gavitt, and S. Garg, “BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain,” arXiv preprint arXiv:1708.06733, 2017.

[8] Y. Liu, S. Ma, Y. Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning Attack on Neural Networks,” in Proceedings of the Network and Distributed System Security Symposium (NDSS), 2018.

[9] F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing Machine Learning Models via Prediction APIs,” in 25th USENIX Security Symposium (USENIX Security 16), pp. 601–618, 2016.

[10] N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical Black-Box Attacks Against Machine Learning,” in Proceedings of the 2017 ACM Asia Conference on Computer and Communications Security (ASIA CCS), pp. 506–519, 2017, doi: 10.1145/3052973.3053009.

[11] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership Inference Attacks Against Machine Learning Models,” in 2017 IEEE Symposium on Security and Privacy (SP), pp. 3–18, 2017, doi: 10.1109/SP.2017.41.

[12] N. Carlini and D. A. Wagner, “Towards Evaluating the Robustness of Neural Networks,” in 2017 IEEE Symposium on Security and Privacy (SP), pp. 39–57, 2017, doi: 10.1109/SP.2017.49.

[13] S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks,” in 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 2574–2582, 2016, doi: 10.1109/CVPR.2016.282.

[14] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards Deep Learning Models Resistant to Adversarial Attacks,” in International Conference on Learning Representations (ICLR), 2018.

[15] W. Xu, D. Evans, and Y. Qi, “Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks,” in Network and Distributed System Security Symposium (NDSS), 2018.

[16] N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks,” in 2016 IEEE Symposium on Security and Privacy (SP), pp. 582–597, 2016, doi: 10.1109/SP.2016.41.

[17] H. Zhang, Y. Yu, J. Jiao, E. Xing, L. E. Ghaoui, and M. I. Jordan, “Theoretically Principled Trade-off Between Robustness and Accuracy,” in Proceedings of the 36th International Conference on Machine Learning, vol. 97, pp. 7472–7482, 2019.

[18] J. Cohen, E. Rosenfeld, and J. Z. Kolter, “Certified Adversarial Robustness via Randomized Smoothing,” in Proceedings of the 36th International Conference on Machine Learning, vol. 97, pp. 1310–1320, 2019.

[19] K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust Physical-World Attacks on Deep Learning Visual Classification,” in 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 1625–1634, 2018, doi: 10.1109/CVPR.2018.00175.

[20] F. Tramèr, N. Carlini, W. Brendel, and A. Madry, “On Adaptive Attacks to Adversarial Example Defenses,” in Advances in Neural Information Processing Systems, vol. 33, 2020.

[21] Z. Wang, J. Ma, X. Wang, J. Hu, Z. Qin, and K. Ren, “Threats to Training: A Survey of Poisoning Attacks and Defenses on Machine Learning Systems,” ACM Computing Surveys, vol. 55, no. 7, art. no. 134, 2022, doi: 10.1145/3538707.

[22] M. Goldblum, D. Tsipras, C. Xie, X. Chen, A. Schwarzschild, D. Song, A. Madry, B. Li, and T. Goldstein, “Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses,” arXiv preprint arXiv:2012.10544, 2020.

[23] A. Raghunathan, S. M. Xie, F. Yang, J. Duchi, and P. Liang, “Understanding and Mitigating the Tradeoff Between Robustness and Accuracy,” in Proceedings of the 37th International Conference on Machine Learning, vol. 119, pp. 7909–7919, 2020.

[24] Y. Dong, T. Pang, H. Su, and J. Zhu, “Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 4312–4321, 2019.

[25] Y. Liu, X. Chen, C. Liu, and D. Song, “Delving into Transferable Adversarial Examples and Black-box Attacks,” in International Conference on Learning Representations (ICLR), 2017.

[26] S. Ma, Y. Liu, G. Tao, W.-C. Lee, and X. Zhang, “NIC: Detecting Adversarial Examples in the Wild via Neural Network Invariant Checking,” in Proceedings of the 26th Annual Network and Distributed System Security Symposium (NDSS), 2019.

 

Share your valuable work from Social Media Buttons