According to the traditional definition, Adversarial machine learning is a technique employed in the field of machine learning which attempts to fool models through malicious input. However, I have mostly seen GANs as an example of an adversarial machine learning algorithm. Does anything that leads to the modification of the performance of the ML model count as adversarial machine learning?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
We find a very broad definition of "adversarial examples" in Justin Gilmer, Ryan P. Adams, Ian Goodfellow, David Andersen, George E. Dahl "Motivating the Rules of the Game for Adversarial Example Research"
Of particular recent interest has been the investigation of errors arising from maliciously crafted inputs, or “adversarial examples”. Although there is not a consistent definition in the literature of what makes an input an adversarial example, we will adopt the definition from Goodfellow et al.: “adversarial examples are inputs to machine learning models that an attacker has intentionally designed to cause the model to make a mistake.”
To me, this suggests that you can use any method, GAN or otherwise, to produce the adversarial examples, and that "adversarial machine learning" is the process that constructs evasive examples.
Here are some examples of adversarial machine learning methods.
Gradient-based attacks such as FGSM are targeted at moving an input across the boundary.
- Alexey Kurakin, Ian J. Goodfellow, Samy Bengio, "ADVERSARIAL MACHINE LEARNING AT SCALE."
Aside from neural networks, researchers have also looked at adversarial attacks against decision tree-based models. For example,
- Hongge Chen, Huan Zhang, Duane Boning, Cho-Jui Hsieh, "Robust Decision Trees Against Adversarial Examples
- Alex Kantchelian, J. D. Tygar, Anthony D. Joseph, "Evasion and Hardening of Tree Ensemble Classifiers"
A model-agnostic way to approach the problem is to train an agent how to modify an input using reinforcement learning.
- Hyrum S. Anderson, Anant Kharkar, Bobby Filar, David Evans, Phil Roth. "Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning"
In some problems, you can even append junk data to the input. This junk data is misinterpreted by the classifier, so the input is misclassified.
- William Fleshman. "Evading Machine Learning Malware Classifiers"
This is far from an exhaustive overview, but if you read these papers and papers citing these papers, you'll get a fuller sense of the broad scope of adversarial machine learning.
