aiqbench analysis
This research addresses a critical vulnerability in linear predictive models by introducing a detector-based switched framework that maintains robustness against stealthy false data injection attacks. By formulating adversarial risk as a convex optimization problem, the authors establish a clear trade-off between performance on clean and attacked data regimes without requiring precise knowledge of attack probabilities. The findings offer significant theoretical and practical value for securing machine learning systems deployed in safety-critical environments where undetectable perturbations are a primary threat.
Adversarial Training of Linear Models under Stealthy Attacks
arXiv:2608.25681v1 Announce Type: new Abstract: Predictive models are widely used in many fields, but are vulnerable to false data injection attacks. To address this, detection schemes and adversarial training have been proposed, but such approaches lack guarantees against stealthy attacks. We therefore propose a detector-based switched model, in which optimal attack strategies are stealthy. For linear prediction models, we derive a convex formulation of the resulting adversarial risk. The model incorporates protected features and introduces a hyperparameter modelling attack probability, enabling an explicit performance trade-off between clean and attacked data regimes. Numerical simulations on real and synthetic data show improved performance on partially attacked data, even for misspecified attack probabilities.
Abstract:Predictive models are widely used in many fields, but are vulnerable to false data injection attacks. To address this, detection schemes and adversarial training have been proposed, but such approaches lack guarantees against stealthy attacks. We therefore propose a detector-based switched model, in which optimal attack strategies are stealthy. For linear prediction models, we derive a convex formulation of the resulting adversarial risk. The model incorporates protected features and introduces a hyperparameter modelling attack probability, enabling an explicit performance trade-off between clean and attacked data regimes. Numerical simulations on real and synthetic data show improved performance on partially attacked data, even for misspecified attack probabilities.
This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible
Machine Learning (cs.LG); Cryptography and Security (cs.CR); Systems and Control (eess.SY)
arXiv:2608.25681 [cs.LG]
(or arXiv:2608.25681v1 [cs.LG] for this version)
https://doi.org/10.48550/arXiv.2608.25681 arXiv-issued DOI via DataCite (pending registration)
Full text under the publisher's open licence · 157 words
Related coverage
Why Backdooring Neural Networks is so Easy?
arXiv · Sep 30, 2026
Efficient Adversarial Attacks on High-dimensional Offline Bandits
arXiv · Jun 5, 2026
Provable one-poison backdoor attacks on linear models and ReLU neural networks
arXiv · Aug 28, 2026
SW-ProxyCE: Zero-Query Adversarial Transfer from Public EEG Encoders to Private Downstream Models
arXiv · Aug 20, 2026