An Improved Reject on Negative Impact Defense

Abstract

Causative attack in which the training samples have been attacked in order to mislead the learning of a classifier is a common scenario in adversarial learning. One of the countermeasures is called the data sanitization which removes suspect attack or noisy samples before training. The data sanitization can be categorized into classifier-independent and classifier-dependent methods. Classifier-independent methods measure the characteristics of the samples while classifiers are trained in classifier-dependent methods. Although the accuracy of classifier-dependent methods is higher, they are time-consumed in comparison with classifier-independent methods. This paper proposes a data sanitization method using both classifier-dependent and classifier-independent information. Not only one sample but a set of similar samples identified by the relative neighborhood graph are considered in Reject on Negative Impact method. The experimental results suggest that the performance of the proposed method is similar to the RONI but with less time complexity.