# Classification under strategic adversary manipulation using pessimistic bilevel optimisation

arXiv: https://arxiv.org/abs/2410.20284 · HTML: https://mlsanity.com/paper/2410.20284/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 12 of its 46 references that are in the map.
- First posted on arXiv 26 Oct 2024.

## Builds on (most cited first, 12 of 12)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Evasion Attacks against Machine Learning at Test Time](https://mlsanity.com/paper/1708.06131/) (2017)
- [Strategic Classification](https://mlsanity.com/paper/1506.06980/) (2015)
- [How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses](https://mlsanity.com/paper/2305.10862/) (2023)
- [Adversarial Attacks Against Medical Deep Learning Systems](https://mlsanity.com/paper/1804.05296/) (2018)
- [A Survey of Game Theoretic Approaches for Adversarial Machine Learning in Cybersecurity Tasks](https://mlsanity.com/paper/1912.02258/) (2019)
- [Extending F1 metric, probabilistic approach](https://mlsanity.com/paper/2210.11997/) (2022)
- [Randomized Prediction Games for Adversarial Machine Learning](https://mlsanity.com/paper/1609.00804/) (2016)
- [A fresh look at nonsmooth Levenberg--Marquardt methods with applications to bilevel optimization](https://mlsanity.com/paper/2305.19870/) (2023)
- [Leadership in Singleton Congestion Games: What is Hard and What is Easy](https://mlsanity.com/paper/1808.10209/) (2018)
- [Finding Zeros of H"older Metrically Subregular Mappings via Globally Convergent Levenberg-Marquardt Methods](https://mlsanity.com/paper/1812.00818/) (2018)

## Built on by (most cited first, 2 of 2)

- [Countering adversarial evasion in regression analysis](https://mlsanity.com/paper/2509.22113/) (2025)
- [Adversarial training with restricted data manipulation](https://mlsanity.com/paper/2510.03254/) (2025)

## Abstract (arXiv)

Adversarial machine learning concerns situations in which learners face attacks from active adversaries. Such scenarios arise in applications such as spam email filtering, malware detection and fake-image generation, where security methods must be actively updated to keep up with the ever improving generation of malicious data.We model these interactions between the learner and the adversary as a game and formulate the problem as a pessimistic bilevel optimisation problem with the learner taking the role of the leader. The adversary, modelled as a stochastic data generator, takes the role of the follower, generating data in response to the classifier. While existing models rely on the assumption that the adversary will choose the least costly solution leading to a convex lower-level problem with a unique solution, we present a novel model and solution method which do not make such assumptions. We compare these to the existing approach and see significant improvements in performance suggesting that relaxing these assumptions leads to a more realistic model.