[Paper Review] Is feature selection secure against training data poisoning?

Xiao Huang, Battista Biggio+4 more|arXiv (Cornell University)|Apr 21, 2018

Network Security and Intrusion Detection40 references287 citations

TL;DR

The paper provides a framework to evaluate robustness of embedded feature selection methods (LASSO, ridge, elastic net) under poisoning attacks and shows LASSO can be driven to almost random feature selection with <5% poisoned data, significantly degrading accuracy.

ABSTRACT

Learning in adversarial settings is becoming an important task for application domains where attackers may inject malicious data into the training set to subvert normal operation of data-driven technologies. Feature selection has been widely used in machine learning for security applications to improve generalization and computational efficiency, although it is not clear whether its use may be beneficial or even counterproductive when training data are poisoned by intelligent attackers. In this work, we shed light on this issue by providing a framework to investigate the robustness of popular feature selection methods, including LASSO, ridge regression and the elastic net. Our results on malware detection show that feature selection methods can be significantly compromised under attack (we can reduce LASSO to almost random choices of feature sets by careful insertion of less than 5% poisoned training samples), highlighting the need for specific countermeasures.

Motivation & Objective

• Motivate studying robustness of feature selection under adversarial data manipulation in security-critical tasks.
• Develop a formal framework to model attacker goals, knowledge, and capabilities for poisoning feature selection.
• Analyze poisoning attacks on embedded feature selection methods (LASSO, ridge, elastic net) and quantify impact on selection and classification.
• Demonstrate practical implications with a malware-detection case study (PDF malware) and discuss countermeasures.

Proposed method

• Propose a framework extending prior security evaluations to feature selection, with attacker goal, knowledge, and capability definitions.
• Model feature selection as minimizing a loss with regularization (Eq. 2) to select a subset via weights w.
• Formulate poisoning as augmenting the training set with attack points and optimizing an objective (Eq. 3) to maximize error.
• Derive gradients for poisoning attacks by differentiating through the learning solution with KKT-based adjustments (Eq. 7).
• Present an iterative poisoning algorithm (Algorithm 1) that adjusts multiple attack points while keeping a feasible domain.
• Apply a surrogate-data (LK) setup and test PK/LK parity in the context of PDF malware detection.

Experimental results

Research questions

• RQ1 How vulnerable are embedded feature selection methods (LASSO, ridge, elastic net) to training-data poisoning?
• RQ2 What is the effect of poisoning on both feature selection stability and final classifier accuracy?
• RQ3 Does attacker knowledge (perfect vs limited) significantly change attack effectiveness in poisoning feature selection?
• RQ4 Which regularization method shows greater robustness under poisoning in high-dimensional security tasks?
• RQ5 How does poisoning impact the top-ranked feature stability as measured by stability indices?

Key findings

• Poisoning up to 20% of training data increases LASSO error from 2% to about 20%.
• Elastic net and ridge show slightly better robustness than LASSO under poisoning.
• Poisoning rapidly decreases the stability of selected features, with the stability index approaching zero for LASSO and elastic net even at low poisoning levels.
• Under attack, feature selection can become almost random, allowing an attacker to control selected features.
• Ridge regression exhibits higher robustness among the three methods analyzed.
• Results from PK and LK settings are similar, indicating surrogate data can enable effective poisoning without full data access.