# Adversarial training with restricted data manipulation

arXiv: https://arxiv.org/abs/2510.03254 · HTML: https://mlsanity.com/paper/2510.03254/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 14 of its 36 references that are in the map.
- First posted on arXiv 26 Sep 2025.

## Builds on (most cited first, 14 of 14)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Evasion Attacks against Machine Learning at Test Time](https://mlsanity.com/paper/1708.06131/) (2017)
- [How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses](https://mlsanity.com/paper/2305.10862/) (2023)
- [Adversarial Attacks Against Medical Deep Learning Systems](https://mlsanity.com/paper/1804.05296/) (2018)
- [A Survey of Game Theoretic Approaches for Adversarial Machine Learning in Cybersecurity Tasks](https://mlsanity.com/paper/1912.02258/) (2019)
- [Extending F1 metric, probabilistic approach](https://mlsanity.com/paper/2210.11997/) (2022)
- [Randomized Prediction Games for Adversarial Machine Learning](https://mlsanity.com/paper/1609.00804/) (2016)
- [Sequential Adversarial Anomaly Detection for One-Class Event Data](https://mlsanity.com/paper/1910.09161/) (2019)
- [Scholtes relaxation method for pessimistic bilevel optimization](https://mlsanity.com/paper/2110.13755/) (2021)
- [A fresh look at nonsmooth Levenberg--Marquardt methods with applications to bilevel optimization](https://mlsanity.com/paper/2305.19870/) (2023)
- [Gauss-Newton-type methods for bilevel optimization](https://mlsanity.com/paper/2003.03128/) (2020)
- [Levenberg-Marquardt method and partial exact penalty parameter selection in bilevel optimization](https://mlsanity.com/paper/2101.09521/) (2021)
- [Classification under strategic adversary manipulation using pessimistic bilevel optimisation](https://mlsanity.com/paper/2410.20284/) (2024)

## Abstract (arXiv)

Adversarial machine learning concerns situations in which learners face attacks from active adversaries. Such scenarios arise in applications such as spam email filtering, malware detection and fake image generation, where security methods must be actively updated to keep up with the everimproving generation of malicious data. Pessimistic Bilevel optimisation has been shown to be an effective method of training resilient classifiers against such adversaries. By modelling these scenarios as a game between the learner and the adversary, we anticipate how the adversary will modify their data and then train a resilient classifier accordingly. However, since existing pessimistic bilevel approaches feature an unrestricted adversary, the model is vulnerable to becoming overly pessimistic and unrealistic. When finding the optimal solution that defeats the classifier, it is possible that the adversary's data becomes nonsensical and loses its intended nature. Such an adversary will not properly reflect reality, and consequently, will lead to poor classifier performance when implemented on real-world data. By constructing a constrained pessimistic bilevel optimisation model, we restrict the adversary's movements and identify a solution that better reflects reality. We demonstrate through experiments that this model performs, on average, better than the existing approach.