# Adversarial Feature Selection against Evasion Attacks

arXiv: https://arxiv.org/abs/2005.12154 · HTML: https://mlsanity.com/paper/2005.12154/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 May 2020.

## Built on by (most cited first, 13 of 13)

- [Adv-Bot: Realistic Adversarial Botnet Attacks against Network Intrusion Detection Systems](https://mlsanity.com/paper/2303.06664/) (2023)
- [Adversarial Attacks and Defenses in Physiological Computing: A Systematic Review](https://mlsanity.com/paper/2102.02729/) (2021)
- [TAD: Transfer Learning-based Multi-Adversarial Detection of Evasion Attacks against Network Intrusion Detection Systems](https://mlsanity.com/paper/2210.15700/) (2022)
- [Refining Latent Homophilic Structures over Heterophilic Graphs for Robust Graph Convolution Networks](https://mlsanity.com/paper/2312.16418/) (2023)
- [A Comprehensive Survey on the Security of Smart Grid: Challenges, Mitigations, and Future Research Opportunities](https://mlsanity.com/paper/2407.07966/) (2024)
- [Enhancing TinyML Security: Study of Adversarial Attack Transferability](https://mlsanity.com/paper/2407.11599/) (2024)
- [Topology-preserving Adversarial Training for Alleviating Natural Accuracy Degradation](https://mlsanity.com/paper/2311.17607/) (2023)
- [Group-Structured Adversarial Training](https://mlsanity.com/paper/2106.10324/) (2021)
- [Evaluating robustness of support vector machines with the Lagrangian dual approach](https://mlsanity.com/paper/2306.02639/) (2023)
- [A Survey of Learning-Based Intrusion Detection Systems for In-Vehicle Network](https://mlsanity.com/paper/2505.11551/) (2025)
- [Responsiveness Verification: Will Predictions Change? How Much? How Often?](https://mlsanity.com/paper/2507.02169/) (2025)
- [Metaphor-based Jailbreak Attacks on Text-to-Image Models](https://mlsanity.com/paper/2512.10766/) (2025)
- [Certified Causal Attribution for Real-Time Attack Forensics in 6G Network Slicing](https://mlsanity.com/paper/2605.26679/) (2026)

## Abstract (arXiv)

Pattern recognition and machine learning techniques have been increasingly adopted in adversarial settings such as spam, intrusion and malware detection, although their security against well-crafted attacks that aim to evade detection by manipulating data at test time has not yet been thoroughly assessed. While previous work has been mainly focused on devising adversary-aware classification algorithms to counter evasion attempts, only few authors have considered the impact of using reduced feature sets on classifier security against the same attacks. An interesting, preliminary result is that classifier security to evasion may be even worsened by the application of feature selection. In this paper, we provide a more detailed investigation of this aspect, shedding some light on the security properties of feature selection against evasion attacks. Inspired by previous work on adversary-aware classifiers, we propose a novel adversary-aware feature selection model that can improve classifier security against evasion attacks, by incorporating specific assumptions on the adversary's data manipulation strategy. We focus on an efficient, wrapper-based implementation of our approach, and experimentally validate its soundness on different application examples, including spam and malware detection.