Defending Regression Learners Against Poisoning Attacks

In robust statistics, robust regression is well studied to devise estimators that are not strongly affected by the presence of noise and outliers [14]. Huber [15] uses a modified loss function that optimizes the squared loss for relatively small errors and absolute loss for relatively large ones. As the influence on absolute loss by outliers is less compared to squared loss, this reduces their effect on the optimization problem, thereby resulting in a less distorted estimator. Mangasarian and Musicant [9] solve the Huber M-estimator problem by reducing it to a quadratic program, thereby improving its performance. The Theil–Sen estimator, developed by Thiel [16] and Sen [17] uses the median of pairwise slopes as an estimator of the slope parameter of the regression model. As the median is a robust measure that is not influenced by outliers, the resulting regression model is considered to be robust as well.

Fischler and Bolles [18] introduced random sample consensus (RANSAC), which iteratively trains an estimator using a randomly sampled subset of the training data. At each iteration, the algorithm identifies data samples that do not fit the trained model by a predefined threshold as outliers. The remaining data samples (i.e., inliers) are considered as part of the consensus set. The process is repeated a fixed number of times, replacing the currently accepted model if a refined model with a larger consensus set is found. Huang et al. [8] decomposes the noisy data in to clean data and outliers by formulating an optimization problem. The estimator parameters are then computed using the clean data.

While these methods provide robustness guarantees against noise and outliers, we focus on malicious perturbations by sophisticated attackers that craft adversarial samples that are similar to normal data. Moreover, the aforementioned classical robust regression methods may fail in high dimensional settings as outliers might not be distinctive in that space due to high-dimensional noise [19].

The problem of learning under adversarial conditions has inspired a wide range of research from the machine learning community, see the work of Liu et al. [20] for a survey. Although adversarial learning in classification and anomaly detection has received a lot of attention [21, 22, 23, 24], adversarial regression remains relatively unexplored.

Most works in adversarial regression provide performance guarantees given several assumptions regarding the training data and noise distribution hold. The resilient algorithm by Chen et al. [25] assumes that the training data before adversarial perturbations, as well as the additive noise, are sub-Gaussian and that training features are independent. Feng et al. [26] provides a resilient algorithm for logistic regression under similar assumptions.

Xiao et al. [7] examined how the parameters of the hyperplane in a linear regression model change under adversarial perturbations. The authors also introduced a novel threat model against linear regression models. Liu et al. [6] use robust PCA to transform the training data to a lower-dimensional subspace and follow an iterative trimmed optimization procedure where only the $n$ samples with the lowest residuals are used to train the model. Note that $n$ here is the number of normal samples in the training data set. Jagielski et al. [5] use a similar approach for the algorithm “TRIM”, where trimmed optimization is performed in the input space itself. Therefore they do not assume a low-rank feature matrix as done in [6]. Both approaches, however, assume that the learner is aware of $n$ (or at least an upper bound for $n$), thereby reducing the practicality of the algorithms.

Tong et al. [27] consider an attacker that perturbs data samples during the test phase to induce incorrect predictions. The authors use a single attacker, multiple learner framework modeled as a multi-learner Stackelberg game. Alfeld et al. [28] propose an optimal attack algorithm against auto-regressive models for time series forecasting. In our work, we consider poisoning attacks against models that are used for interpolating instead of extrapolating. Nelson et al. [29] originally introduced RONI (Reject On Negative Impact) as a defense for adversarial attacks against classification models. In RONI, the impact of each data sample on training is measured, and samples with notable negative impacts are excluded from the training process.

In summary, to the best of our knowledge, no linear regression algorithm has been proposed that reduces the effects of adversarial perturbations in training data through the use of LID. Most existing works on adversarial regression make strong assumptions regarding the attacker/attack, making them impractical, whereas, we propose a novel defense that makes no such assumptions.

In the theory of intrinsic dimensionality, classical expansion models measure the rate of growth in the number of data samples encountered as the distance from the sample of interest increases [10]. As an example, in Euclidean space, the volume of an m-dimensional ball grows proportionally to $r^{m}$, when its size is scaled by a factor of $r$. From this rate of change of volume w.r.t distance, the expansion dimension $m$ can be deduced as:

Transferring the concept of expansion dimension to the statistical setting of continuous distance distributions leads to the formal definition of LID. By substituting the cumulative distance for volume, LID provides measures of the intrinsic dimensionality of the underlying data subspace. Refer to the work of Houle [10] for more details concerning the theory of LID. The formal definition of LID is given below [10].

The last equality of Equation (5) follows by applying L’Hôpital’s rule to the limits [10]. The local intrinsic dimension at $x$ is in turn defined as the limit when the radius $r$ tends to zero:

$\text{LID}_{F}$ describes the relative rate at which its cumulative distribution function $F(r)$ increases as the distance $r$ increases from $0$ (Figure 2). In the ideal case where the data in the vicinity of $x$ is distributed uniformly within a subspace, $\text{LID}_{F}$ equals the dimension of the subspace; however, in practice these distributions are not ideal, the manifold model of data does not perfectly apply, and $\text{LID}_{F}$ is not an integer [12]. Nevertheless, the local intrinsic dimensionality is an indicator of the dimension of the subspace containing $x$ that would best fit the data distribution in the vicinity of $x$.

The above estimation assumes that samples are drawn from a tight neighborhood, in line with its development from Extreme Value Theory. In practice, the sample set is drawn uniformly from the available training data (omitting $x$ itself), which itself is presumed to have been randomly drawn from $\mathcal{P}$. Note that the LID defined in Equation (6) is the theoretical calculation, and that $\widehat{\text{LID}}$ defined in Equation (7) is its estimate.

We now introduce a novel LID based measure called neighborhood LID ratio (N-LID) and discuss the intuition behind using N-LID to identify adversarial samples during training. By perturbing the feature vector, the adversary moves a training sample away from the distribution of normal samples. Computing LID estimates with respect to its neighborhood would then reveal an anomalous distribution of the local distance to these neighbors. Furthermore, as $\widehat{\text{LID}}(x)$ is an indicator of the dimension of the subspace that contains $x$, by comparing the LID estimate of a data sample to the LID estimates of its nearest neighbors, we can identify regions that have a similar lower-dimensional subspace. More importantly, any samples that have a substantially different lower-dimensional subspace compared to its neighbors can be identified as poisoned samples.

Considering this aspect of poisoning attacks, we propose a novel LID ratio measure that has similar properties as the local outlier factor (LOF) algorithm introduced by Breunig et al. [31] as follows:

Here, $\widehat{\text{LID}}(x_{i})$ denotes the LID estimate of the $i$-th nearest neighbor from the $k$ nearest neighbors of $x$. Figure 3(a) shows the LID estimates of a poisoned sample and its $k$ nearest neighbors. As the poisoned sample’s LID estimate is substantially different from its neighbors, the N-LID value calculated using Equation(8) highlights it as an outlier. As Figure 3(b) shows, N-LID is a powerful metric that can give two distinguishable distributions for poisoned and normal samples. Although ideally, we like to see no overlap between the two distributions, in real-world datasets, we see some degree of overlap.

We now describe a baseline weighting scheme calculated using the N-LID distributions of poisoned and normal samples. Define $p_{n}$ and $p_{a}$ as the probability density functions of the N-LID values of normal samples and poisoned samples. For a given data sample $x_{i}$ with the N-LID estimate $\text{N-LID}(x_{i})$, we define two possible hypotheses, $H_{n}$ and $H_{a}$ as

where the notation “$\text{N-LID}(x_{i})\sim p$” denotes the condition “$\text{N-LID}(x_{i})$ is from the distribution $p$”. To clarify, $H_{n}$ is the hypothesis that $\text{N-LID}(x_{i})$ is from the N-LID distribution of normal samples and $H_{a}$ is the hypothesis that $\text{N-LID}(x_{i})$ is from the N-LID distribution of poisoned samples.

The likelihood ratio (LR) is usually used in statistics to compare the goodness of fit of two statistical models. We define the likelihood ratio of a data sample $x_{i}$ with the N-LID estimate $\text{N-LID}(x_{i})$ as

where $p(\text{N-LID}(x_{i}))$ denotes the probability of the N-LID of sample $x_{i}$ w.r.t the probability distribution $p$. To clarify, $\Lambda(\text{N-LID}(x_{i}))$ expresses how many times more likely it is that $\text{N-LID}(x_{i})$ is under the N-LID distribution of normal samples than the N-LID distribution of poisoned samples.

As there is a high possibility for $p_{n}$ and $p_{a}$ to have an overlapping region (Figure 3(b)), there is a risk of emphasizing the importance of (giving a higher weight to) poisoned samples. To mitigate that risk, we only de-emphasize samples that are suspected to be poisoned (i.e., low LR values). Therefore, we transform the LR values such that $\Lambda(\text{N-LID}(x))\in[0,1]$. The upper bound is set to $1$ to prevent overemphasizing samples.

Subsequently, we fit a hyperbolic tangent function to the transformed LR values ($z$) in the form of $0.5(1-\tanh(az-b))$ and obtain suitable values for the parameters $a$ and $b$. The scalar value of $0.5$ maintains the scale and vertical position of the function between $0$ and $1$. By fitting a smooth function to the LR values, we remove the effect of noise and enable the calculation of weights for future training samples. Finally, we use the N-LID value of each $x_{i}$ and use Equation (11) to obtain its corresponding weight $\beta_{i}$.

The LR based weighting scheme described above assigns weights to training samples based on the probabilities of their N-LID values. This approach requires the learner to be aware of the probability density functions (PDFs) of normal and poisoned samples. The two distributions can be obtained by simulating an attack and deliberately altering a subset of data during training, by assuming the distributions based on domain knowledge or prior experience or by having an expert identify attacked and non-attacked samples in a subset of the dataset. However, we see that the N-LID measure in Equation (8) results in larger values for poisoned samples compared to normal samples (Figure 3(b)). In general, therefore, it seems that a weighting scheme that assigns small weights to large N-LID values and large weights to small N-LID values would lead to an estimator that is less affected by the poisoned samples present in training data.

Considering this aspect of N-LID, we choose three weighting mechanisms that assign $\beta=1$ for the sample with the smallest N-LID and $\beta=0$ for the sample with the largest N-LID as shown in Figure 4. Note that there is a trade-off between preserving normal samples, and preventing poisoned samples from influencing the learner. The concave weight function attempts to preserve normal samples, which causes poisoned samples to affect the learner as well. In contrast, the convex weight function reduces the impact of poisoned samples while reducing the influence of many normal samples in the process. The linear weight function assigns weights for intermediate N-LID values linearly without considering the trade-off.

We obtain the weight functions by first scaling the N-LID values of the training samples to $[0,1]$. Take $v_{i}$ as the scaled N-LID value of sample $x_{i}$. Then, for the linear weight function, we take $\beta_{i}=1/v_{i}$ as the weight. For the concave weight function we use $\beta_{i}=1-v_{i}^{2}$ and for the convex weight function we use $\beta_{i}=1-(2v_{i}-v_{i}^{2})^{0.5}$. We choose these two arbitrary functions as they possess the trade-off mentioned in the paragraph above. Any other functions that have similar characteristics can also be used to obtain the weights.

The main advantage of our proposed defense is that it is decoupled from the learner; it can be used in conjunction with any learner that allows the loss function to be weighted. In Section 6, we demonstrate the effectiveness of our proposed defense by incorporating it into a ridge regression model and an NNR model.

The high level procedures used to obtain uninfluenced ridge regression models under adversarial conditions are formalized in Algorithms 1 and 2 for the baseline defense (N-LID LR) and the convex weight function based defense (N-LID CVX).

We provide here a brief description of the simulations that were conducted to obtain the data for the case study that we are considering in this paper. Refer to the work of Weerasinghe et al. [33] for additional information regarding the security application in SDR networks.

Network simulation and data collection: We use the INET framework for OMNeT++ [34] as the network simulator, considering signal attenuation, signal interference, background noise, and limited radio ranges in order to conduct realistic simulations. We place the nodes (civilians, rogue agents, and listeners) randomly within the given confined area. The simulator allows control of the frequencies and bit rates of the transmitter radios, their communication ranges, message sending intervals, message lengths, the sensitivity of the receivers, minimum energy detection of receivers, among other parameters. It is assumed that all the communications are encrypted; therefore, the listeners are unable to access the content of the captured transmissions. We obtain the duration of the reception, message length, inter-arrival time (IAT), carrier frequency, bandwidth, and bitrate as features using the data captured by the listeners.

Considering the data received by the three closest listeners (using the power of the received signal) of each transmission source, the duration, message length, and IAT of the messages received by each listener are averaged every five minutes, which results in $108$ ($12\times 3\times 3$) features in total. Adding the latter three parameters (fixed for each transmission source) gives the full feature vector of $111$ features. The response variables (i.e., the risk of being a rogue agent) are assigned based on the positions of the data samples in the feature space.

We use the following combination of relatively high dimensional and low dimensional regression datasets in our experimental analysis. In particular, The House and Loan datasets are used as benchmark datasets in the literature [5]. Table I provides the training and test set sizes, the regularization parameter $\lambda$ of the ridge regression model, and the line search learning rates $\eta$ of the attacks considered for each of the datasets.

House dataset: The dataset uses features such as year built, floor area, number of rooms, and neighborhood to predict the sale prices of houses. There are $275$ features in total, including the response variable. All features are normalized into $[0,1]$. We fix the training set size to $840$, and the test set size to $280$.

Loan dataset: The dataset contains information regarding loans made on LendingClub. Each data sample contains $89$ features, including loan amount, term, the purpose of the loan, and borrower’s attributes with the interest rate as the response variable. We normalize the features into $[0,1]$ and fix the training set and test set size as above.

Grid dataset: Arzamasov et al. [35] simulated a four-node star electrical grid with centralized production to predict its stability, w.r.t the behavior of participants of the grid (i.e., generator and consumers). The system is described with differential equations, with their variables given as features of the dataset. In our work, we use the real component of the characteristic equation root as the response variable for the regression problem.

Machine dataset: The dataset by Kibler et al. [36] is used to estimate the relative performance of computer hardware based on attributes such as machine cycle time, memory, cache size, and the number of channels.

For each learning algorithm, we find its hyperparameters using five-fold cross-validation on a pristine dataset. For LID calculations we tune $k$ over $[10,100)$ as previously done by Ma et al. [12]. Kernel density estimation for LR calculation was performed using a Gaussian kernel with the bandwidth found using a cross-validation approach to avoid overfitting. The effects of kernel density estimation are neutralized by the smooth function fitting (Equation (11)); therefore, the algorithm is robust to these choices.

For each dataset, we create five cross-validation sets. We present the average MSE of the cross-validation sets for each learner when the poisoning rate increases from $0$ to $20$. While increasing the poisoning rate over $20\%$ is feasible, it is unrealistic to expect a learner to withstand such amounts of poisoned data, and it also assumes a powerful attacker with significant influence over the training data. As the existence of such an attacker is unlikely, we limit the poisoning rate to $20\%$, similar to prior works in the literature.