[Paper Review] Adequacy of the Gradient-Descent Method for Classifier Evasion Attacks

Yi Han, Benjamin I. P. Rubinstein|arXiv (Cornell University)|Apr 6, 2017

Adversarial Robustness in Machine Learning35 references3 citations

TL;DR

This paper evaluates the gradient-descent method for generating adversarial samples against RBF-SVMs, demonstrating that reduced kernel smoothness (lower γ) significantly increases model robustness. It introduces a novel gradient-quotient method that outperforms standard gradient descent in attack success and input perturbation efficiency, while also proposing a geometric margin-like predictor to assess model vulnerability before attacks are launched.

ABSTRACT

Despite the wide use of machine learning in adversarial settings including computer security, recent studies have demonstrated vulnerabilities to evasion attacks---carefully crafted adversarial samples that closely resemble legitimate instances, but cause misclassification. In this paper, we examine the adequacy of the leading approach to generating adversarial samples---the gradient descent approach. In particular (1) we perform extensive experiments on three datasets, MNIST, USPS and Spambase, in order to analyse the effectiveness of the gradient-descent method against non-linear support vector machines, and conclude that carefully reduced kernel smoothness can significantly increase robustness to the attack; (2) we demonstrate that separated inter-class support vectors lead to more secure models, and propose a quantity similar to margin that can efficiently predict potential susceptibility to gradient-descent attacks, before the attack is launched; and (3) we design a new adversarial sample construction algorithm based on optimising the multiplicative ratio of class decision functions.

Motivation & Objective

• To systematically evaluate the effectiveness and limitations of the gradient-descent method in generating adversarial samples for RBF-SVMs.
• To investigate how kernel smoothness (controlled by γ) affects model robustness against gradient-based evasion attacks.
• To identify geometric properties of support vectors that correlate with model vulnerability to gradient-descent attacks.
• To develop and validate a new adversarial sample generation method that improves attack success and reduces input perturbation.

Proposed method

• The gradient-descent method is applied to generate adversarial samples by iteratively modifying input features to maximize misclassification, using the gradient of the decision function.
• A new attack method, the gradient-quotient approach, is proposed that optimizes the ratio of the top-class decision score to the target-class score, enabling more effective evasion.
• The paper introduces a geometric metric based on inter-class support vector distances and margin-like properties to predict model susceptibility to attacks before deployment.
• Experiments are conducted on MNIST, USPS, and Spambase datasets using RBF-SVMs with varying γ values to analyze attack success rates and phase transitions.
• Transferability of attacks is evaluated using both intra-model (same RBF-SVM) and inter-model (RBF-SVM to RBF neural network) settings to test generalization.
• For mimicry attacks, an indirect two-step method is used—first misclassifying to an intermediate class (e.g., '6') before targeting the final class (e.g., '0') to improve success rates.

Experimental results

Research questions

• RQ1 Does the gradient-descent method have structural limitations in evading RBF-SVMs, and if so, under what conditions?
• RQ2 How does the kernel precision parameter γ influence the success rate of gradient-descent-based evasion attacks on RBF-SVMs?
• RQ3 Can a geometric measure related to margin and inter-class support vector distances predict model vulnerability to gradient-descent attacks?
• RQ4 Is the proposed gradient-quotient method more effective than standard gradient descent in generating adversarial samples for multiclass scenarios?
• RQ5 Can transferability of attacks be achieved across different model types, such as from RBF-SVM to RBF neural networks?

Key findings

• A phase transition in attack success rate is observed at specific γ values, with lower γ (reduced kernel smoothness) significantly increasing robustness to gradient-descent attacks.
• The proposed gradient-quotient method achieves higher attack success rates than standard gradient descent, particularly in multiclass and mimicry attack scenarios.
• The success rate of gradient-quotient attacks on RBF-SVMs ranged from 61.3% to 69.1% in inter-model transferability tests, indicating strong generalization across model types.
• For mimicry attacks, the indirect method of first targeting class '6' before '0' doubled the overall success rate, achieving 100% success in the first step and improving final misclassification to '0'.
• The proposed geometric vulnerability predictor, based on inter-class support vector distances, strongly correlates with model susceptibility and enables pre-emptive assessment of attack risk.
• Intra-model transferability of attacks across RBF-SVMs achieved success rates above 65%, with some models reaching 100%, indicating strong attack transferability within the same model family.