Wickerlab

Wickerlab

wickerlab@mrezha.wicker.nz

Wickerlab, Machine Learning Group, School of Computer Science, University of Auckland

Location:: Auckland

New Zealand

Homepage:: https://wickerlab.org

BAARD: Blocking Adversarial Examples by Testing for Applicability, Reliability and Decidability

Sat, 27 May 2023 09:57:08 +1200

Wickerlab

wickerlab@mrezha.wicker.nz

Joerg Simon Wicker wrote the following post Sat, 27 May 2023 09:15:00 +1200

BAARD: Blocking Adversarial Examples by Testing for Applicability, Reliability and Decidability

Luke will be giving a talk on the connections between the concept of Applicability Domain in #Cheminformatics and adversarial defenses in #MachineLearning - at #PAKDD2023 in Osaka.

There are interesting connections between those areas, and Luke will be discussing the potential of an applicability domain algorithm to detect adversarial examples.

Hear more about it in Luke's talk today, Friday, May 27, in Session 5A starting at 3:30pm!

Mon, 29 May 2023 21:25:33 +1200

Joerg Simon Wicker

js@mrezha.wicker.nz

The paper is now published:

#^BAARD: Blocking Adversarial Examples by Testing for Applicability, Reliability and Decidability

Adversarial defenses protect machine learning models from adversarial attacks, but are often tailored to one type of model or attack. The lack of information on unknown potential attacks makes detecting adversarial examples challenging. Additionally, attackers do not...

Mon, 29 May 2023 21:26:05 +1200

Joerg Simon Wicker

js@mrezha.wicker.nz

Or you can check our earlier preprint:

#^Intriguing Usage of Applicability Domain: Lessons from Cheminformatics Applied to Adversarial Learning

Defending machine learning models from adversarial attacks is still a
challenge: none of the robust models is utterly immune to adversarial examples
to date. Different defences have been proposed; however, most of them are
tailored to particular ML models and adversarial attacks, therefore their
effectiveness and applicability are strongly limited. A similar problem plagues
cheminformatics: Quantitative Structure-Activity Relationship (QSAR) models
struggle to predict biological activity for the entire chemical space because
they are trained on a very limited amount of compounds with known effects. This
problem is relieved with a technique called Applicability Domain (AD), which
rejects the unsuitable compounds for the model. Adversarial examples are
intentionally crafted inputs that exploit the blind spots which the model has
not learned to classify, and adversarial defences try to make the classifier
more robust by covering these blind spots. There is an apparent similarity
between AD and adversarial defences. Inspired by the concept of AD, we propose
a multi-stage data-driven defence that is testing for: Applicability: abnormal
values, namely inputs not compliant with the intended use case of the model;
Reliability: samples far from the training data; and Decidability: samples
whose predictions contradict the predictions of their neighbours.It can be
applied to any classification model and is not limited to specific types of
adversarial attacks. With an empirical analysis, this paper demonstrates how
Applicability Domain can effectively reduce the vulnerability of ML models to
adversarial examples.