Automatic machine learning vulnerability identification and retraining

Abstract

Techniques are disclosed relating to training a machine learning model to handle adversarial attacks. In some embodiments, a computer system perturbs, using a set of adversarial attack methods, a set of training examples used to train a machine learning model. In some embodiments, the computer system identifies, from among the perturbed set of training examples, a set of sparse perturbed training examples that are usable to train machine learning models to identify adversarial attacks, where the set of sparse perturbed training examples includes examples whose perturbations are below a perturbation threshold and whose classifications satisfy a classification difference threshold. In some embodiments, the computer system retrains, using the set of sparse perturbed training examples, the machine learning model. The disclosed techniques may advantageously enable a machine learning model to correctly classify data associated with adversarial attacks.