Adversarial Training of Linear Models under Stealthy Attacks

Lovisa Eriksson; Dave Zachariah; André M. H. Teixeira

cs.LGAug 26, 2026

Adversarial Training of Linear Models under Stealthy Attacks

Authors: Lovisa Eriksson, Dave Zachariah, André M. H. Teixeira

Organizations: Department of Information Technology, Uppsala University, Uppsala, Sweden

Abstract

Predictive models are widely used in many fields, but are vulnerable to false data injection attacks. To address this, detection schemes and adversarial training have been proposed, but such approaches lack guarantees against stealthy attacks. We therefore propose a detector-based switched model, in which optimal attack strategies are stealthy. For linear prediction models, we derive a convex formulation of the resulting adversarial risk. The model incorporates protected features and introduces a hyperparameter modelling attack probability, enabling an explicit performance trade-off between clean and attacked data regimes. Numerical simulations on real and synthetic data show improved performance on partially attacked data, even for misspecified attack probabilities.

Figures & tables

Panel of Figure 2 — Fig. 1 : (a) Risk versus attack probability $\gamma_{\text{test}}$ , including misspecified $\gamma_{\text{train}}=0.05$ . (b) Risk versus $\gamma_{\text{train}}$ , where red dots mark when the model is correctly specified and the dotted line is the correctly specified model from (a). Both (a) and (b) also show the standard switched model $f_{\theta_{n},\theta_{s}}$ , and the fully secure model $f_{\theta_{s},\theta_{s}}$ . Both cases set $\bar{\alpha}=0.01$ yielding an actual false alarm rate of 1.3%.

Panel of Figure 3 — Fig. 2 : (a) Risk versus attack probability $\gamma_{\text{test}}$ . (b) Same as (a) but also includes the standard switched model. In this case we set the bound $\bar{\alpha}$ yielding an actual false alarm rate of 0.01%.

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 448 papers

Robustness Cannot be Reduced to Regularization: Studying Adversarial Training Beyond the Linear Case
Jun 19, 2026David A. R. Robin, Rafael Pinot, Yann ChevaleyreAdversarial Training Two-Layer Neural Networks
LAMSADE, Dauphine · Universit´e Paris Dauphine PSL Research University · LPSM, Jussieu +1
On the Existence of Consistent Adversarial Attacks in High-Dimensional Linear Classification
Jun 14, 2025Matteo Vilucchio, Lenka Zdeborová, Bruno LoureiroAdversarial Attacks Adversarial Robustness
Information Learning and Physics Laboratory, École Polytechnique Fédérale de Lausanne (EPFL) · Statistical Physics of Computation Laboratory, École Polytechnique Fédérale de Lausanne (EPFL) · Département d’Informatique, École Normale Supérieure - PSL & CNRS, France
Adversarially Trained Linear Transformers Are Optimal Robust In-Context Learners for Gaussian Mixtures
Oct 6, 2026Soichiro KumanoAdversarial Training Transformer
LY Corporation

Jun 19, 2026J/K move · Enter open · S save

Robustness Cannot be Reduced to Regularization: Studying Adversarial Training Beyond the Linear Case

David A. R. Robin, Rafael Pinot, Yann Chevaleyre

LAMSADE, Dauphine · Universit´e Paris Dauphine PSL Research University · LPSM, Jussieu+1

Adversarial Training Two-Layer Neural Networks Neural Network Robustness Adversarial Robustness

Open paper AskPDF arXiv

The vulnerability of ML models to adversarial examples has recently emerged as a major concern. While adversarial training is one of the most effective countermeasures to this issue, its high computational cost remains an obstacle to practical deployment. Recent progress in reducing this cost has relied, in the case of linear models, on a formal equivalence between the adversarial risk and a simpler form of regularized risk. This enabled significantly more efficient training procedures, which naturally raises the question of whether such an equivalence can be extended beyond linear models. In this work, we formally show that no such equivalence is possible for two-layer networks. Our proofs proceed via a reduction to key properties that fundamentally separate the adversarial risk from any simple regularized risk which would only exhibit a weak form of data dependence. Beyond this setting, we provide empirical evidence on Wide-ResNets indicating that the same type of impossibility persists in deeper and more expressive architectures.

Abstract

Adversarial Attacks

Explore similar work

Robustness Cannot be Reduced to Regularization: Studying Adversarial Training Beyond the Linear Case

On the Existence of Consistent Adversarial Attacks in High-Dimensional Linear Classification

Adversarially Trained Linear Transformers Are Optimal Robust In-Context Learners for Gaussian Mixtures