Multi-Stage Dual-Perturbation Attack Targeting Transductive SVMs and the Corresponding Adversarial Training Defense Mechanism

The Transductive Support Vector Machine (TSVM) is an effective semi-supervised learning algorithm vulnerable to adversarial sample attacks. This paper proposes a new adversarial attack method called the Multi-Stage Dual-Perturbation Attack (MSDPA), specifically targeted at TSVMs. The MSDPA has two phases: initial adversarial samples are generated by an arbitrary range attack, and finer attacks are performed on critical features to induce the TSVM to generate false predictions. To improve the TSVM’s defense against MSDPAs, we incorporate adversarial training into the TSVM’s loss function to minimize the loss of both standard and adversarial samples during the training process. The improved TSVM loss function considers the adversarial samples’ effect and enhances the model’s adversarial robustness. Experimental results on several standard datasets show that our proposed adversarial defense-enhanced TSVM (adv-TSVM) performs better in classification accuracy and adversarial robustness than the native TSVM and other semi-supervised baseline algorithms, such as S3VM. This study provides a new solution to improve the defense capability of kernel methods in an adversarial setting.