Robust Ensemble of Selectively Strengthened and Augmented Predictors

Technical Summary: Robust Ensemble of Selectively Strengthened and Augmented Predictors (RESSAP)

Problem Statement
Machine learning classifiers, while successful in various domains, possess inherent "blind spots" in their decision boundaries that can be exploited by adversarial evasion attacks. In these attacks, adversaries manipulate input data at inference time to cause misclassification without altering the training process. Existing defense mechanisms often suffer from limited generalizability, requiring significant architectural changes or restricting the choice of learning algorithms. Furthermore, many defenses are evaluated under narrow attack scenarios, failing to provide systematic robustness across diverse threats. There is a critical need for a model-agnostic framework that enhances robustness against evasion attacks while maintaining high accuracy on benign data and fitting seamlessly into existing ML pipelines (e.g., SecDevOps).

Methodology
The authors propose RESSAP (Robust Ensemble of Selectively Strengthened and Augmented Predictors), a framework that transforms a single pre-trained classifier ($clf_0$) into an ensemble of specialized sub-models. The methodology consists of four primary components:

1. Feature Selection and Subset Generation:
   The framework introduces a composite Resilience Metric ($FSRI$) to guide feature selection. This metric combines two distinct scores for each feature $j$:

   • Feature Importance ($FSI$): Calculated via permutation importance, measuring the drop in baseline accuracy when feature values are shuffled.
   • Feature Robustness ($FSR$): Calculated by measuring the sensitivity of the baseline accuracy to small random noise perturbations added to the feature.
   • Resilience ($FSRI$): Defined as the sum of normalized $FSI$ and $FSR$.

   Using these metrics, the framework generates $t$ diverse feature subsets ($s_l$). To ensure diversity, subsets are constructed by selecting top-ranked features based on three strategies: half of the subsets prioritize $FSRI$ (resilience), a quarter prioritize $FSI$ (importance), and the remaining quarter prioritize $FSR$ (robustness).

2. Data Augmentation:
   For each feature subset, the corresponding training data is vertically sliced. Noise-based data augmentation is then applied to these subsets by adding Gaussian noise ($\epsilon \sim N(0, \sigma)$). This process simulates natural variations and minor adversarial perturbations, encouraging the sub-models to learn more stable and generalizable decision boundaries.

3. Ensemble Training:
   A weak classifier ($f_l$) is trained independently on each augmented feature subset. This creates an ensemble of $t$ classifiers, each operating on a distinct, resilient feature space.

4. Randomized Inference:
   At inference time, the system does not use all classifiers. Instead, a random subset of $k$ classifiers is selected to form the prediction set $P$. The final prediction is derived by aggregating the probability vectors of the selected classifiers and choosing the class with the maximum aggregated probability. This randomization increases the unpredictability of the system, forcing adversaries to query the system more frequently to map the decision boundaries.

Key Contributions
The paper outlines three primary contributions:

1. RESSAP Framework: A novel ensemble architecture that enhances adversarial robustness by integrating feature-level diversity with classifier-level randomization, operating as a post-training enhancement step.
2. Resilience-Based Feature Selection: A new approach to feature selection that unifies permutation importance and robustness into a single metric ($FSRI$) to guide the formation of diverse and resilient feature subsets.
3. Empirical Validation: Experimental validation on synthetic datasets demonstrating that the framework significantly improves resistance to evasion attacks while preserving clean data accuracy.

Results
The authors evaluated RESSAP on a synthetic dataset ($n=600$ instances, $d=10$ features) using a Multi-Line Search (MLS) attack strategy. The results were compared against a baseline Support Vector Machine (SVM) and ablated versions of RESSAP:

• Attack Success Rate: The full RESSAP model reduced the adversarial attack success rate to 32.49%, a significant improvement over the baseline SVM (100%) and ablated variants (ranging from 35.63% to 51.45%).
• Clean Accuracy: RESSAP maintained high accuracy on clean data (96.5%), comparable to the baseline (94.2%) and other variants.
• Query Cost: The framework significantly increased the number of queries required for an adversary to successfully evade the model. In 78.08% of cases, the full RESSAP model required more queries to flip a prediction than the baseline SVM.
• Ablation Analysis: Removing any single component (feature selection, random classifier selection, or data augmentation) consistently resulted in lower robustness, confirming that each mechanism contributes to the overall defense.

Significance and Claims
The paper claims that RESSAP provides a scalable and flexible, model-agnostic defense strategy. Its significance lies in its ability to enhance the security of machine learning systems without requiring major changes to existing architectures or training procedures. By transforming a single model into a randomized ensemble, RESSAP increases the "query cost" for adversaries, making it computationally more expensive and difficult to craft successful evasion examples. The authors emphasize that this approach balances the trade-off between robustness and classification accuracy, addressing a key limitation in current defense mechanisms.

The authors modestly acknowledge limitations, noting that the current evaluation relies on a synthetically generated dataset and has not yet been compared against other robust architectures specifically designed for adversarial settings. They identify future work as focusing on diverse real-world datasets and further refinement of the feature selection process.