Combating Good Word Attacks on Statistical Spam Filters with Multiple Instance Learning

Statistical spam filters are known to be vulnerable to adversarial attacks. One such adversarial attack, known as the Good Word Attack, thwarts spam filters by appending to spam messages sets of “good ” words, which are common in legitimate e-mail but rare in spam. We present a counterattack strategy that first attempts to differentiate spam from legitimate e-mail in the input space, by transforming each email into a bag of multiple segments, and subsequently applies multiple instance logistic regression on the bags. We treat each segment in the bag as an instance. An e-mail is classified as spam if at least one instance in the corresponding bag is spam, and as legitimate if all the instances in it are legitimate. We show that a spam filter using our multiple instance counter-attack strategy stands up better to good word attacks than its single instance counterpart and the commonly practiced Bayesian filters. 1