# Improving Robustness of ML Classifiers against Realizable Evasion Attacks Using Conserved Features

arXiv: https://arxiv.org/abs/1708.08327 · HTML: https://mlsanity.com/paper/1708.08327/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Aug 2017.

## Built on by (most cited first, 18 of 18)

- [Trustworthy AI: From Principles to Practices](https://mlsanity.com/paper/2110.01167/) (2021)
- ["Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practice](https://mlsanity.com/paper/2212.14315/) (2022)
- [Adversarial Robustness with Non-uniform Perturbations](https://mlsanity.com/paper/2102.12002/) (2021)
- [Robust Deep Reinforcement Learning through Bootstrapped Opportunistic Curriculum](https://mlsanity.com/paper/2206.10057/) (2022)
- [Preference Poisoning Attacks on Reward Model Learning](https://mlsanity.com/paper/2402.01920/) (2024)
- [SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection](https://mlsanity.com/paper/2305.00550/) (2023)
- [It Is All About Data: A Survey on the Effects of Data on Adversarial Robustness](https://mlsanity.com/paper/2303.09767/) (2023)
- [Multi-SpacePhish: Extending the Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learning](https://mlsanity.com/paper/2210.13660/) (2022)
- [Wild Networks: Exposure of 5G Network Infrastructures to Adversarial Examples](https://mlsanity.com/paper/2207.01531/) (2022)
- [PhishLang: A Real-Time, Fully Client-Side Phishing Detection Framework Using MobileBERT](https://mlsanity.com/paper/2408.05667/) (2024)
- [Oriole: Thwarting Privacy against Trustworthy Deep Learning Models](https://mlsanity.com/paper/2102.11502/) (2021)
- [Enhancing Robustness of Neural Networks through Fourier Stabilization](https://mlsanity.com/paper/2106.04435/) (2021)
- [Open Image Content Disarm And Reconstruction](https://mlsanity.com/paper/2307.14057/) (2023)
- [On the Exploitability of Audio Machine Learning Pipelines to Surreptitious Adversarial Examples](https://mlsanity.com/paper/2108.02010/) (2021)
- [MaMaDroid2.0 -- The Holes of Control Flow Graphs](https://mlsanity.com/paper/2202.13922/) (2022)
- [Counteracting Concept Drift by Learning with Future Malware Predictions](https://mlsanity.com/paper/2404.09352/) (2024)
- [Robust Context-Aware Detection of Malicious Instructions in Text](https://mlsanity.com/paper/2608.05430/) (2026)
- [Robusta: Robust AutoML for Feature Selection via Reinforcement Learning](https://mlsanity.com/paper/2101.05950/) (2021)

## Abstract (arXiv)

Machine learning (ML) techniques are increasingly common in security applications, such as malware and intrusion detection. However, ML models are often susceptible to evasion attacks, in which an adversary makes changes to the input (such as malware) in order to avoid being detected. A conventional approach to evaluate ML robustness to such attacks, as well as to design robust ML, is by considering simplified feature-space models of attacks, where the attacker changes ML features directly to effect evasion, while minimizing or constraining the magnitude of this change. We investigate the effectiveness of this approach to designing robust ML in the face of attacks that can be realized in actual malware (realizable attacks). We demonstrate that in the context of structure-based PDF malware detection, such techniques appear to have limited effectiveness, but they are effective with content-based detectors. In either case, we show that augmenting the feature space models with conserved features (those that cannot be unilaterally modified without compromising malicious functionality) significantly improves performance. Finally, we show that feature space models enable generalized robustness when faced with a variety of realizable attacks, as compared to classifiers which are tuned to be robust to a specific realizable attack.