Unified benchmarks assess data poisoning and backdoor attacks.
problem Unclear danger and effectiveness of data poisoning methods.
method Developed standardized benchmarks for data poisoning and backdoor attacks.
result Existing methods may not generalize to realistic settings.
Temporal threat model defends against data poisoning with timestamps.
problem Adversaries can poison more samples than expected, rendering existing defenses ineffective.
method Leverage timestamps to define earliness and duration metrics for temporal robustness.
result Temporal aggregation provides provable temporal robustness against data poisoning.
Paper shows data poisoning and Byzantine attacks are equivalent, impacting federated learning security.
problem Resilience of federated learning systems to adversarial attacks.
method Proved equivalence between data poisoning and Byzantine gradient attacks.
result Equivalence between data poisoning and Byzantine attacks in federated learning.
Research evaluates data poisoning attacks on regression learning and introduces a new defense strategy.
problem Data poisoning attacks on regression learning threaten model integrity in critical systems.
method Realistic scenarios, novel black-box attack, and evaluation on 26 datasets.
result Mean squared error (MSE) increases to 150% with only 2% poisoned samples.
This paper proposes a framework for certifying neural network defenses against data poisoning attacks.
problem Vulnerability of neural networks to data poisoning attacks.
method Random selection based defenses that average predictions on sub-datasets sampled from the training set.
result The certified radius of bagging derived by the framework is tighter than previous work.
New research shows Byzantine failures hurt generalization more than data poisoning in robust distributed learning.
problem Generalization in robust distributed learning algorithms under Byzantine failures vs. data poisoning.
method Algorithmic stability analysis of robust distributed learning algorithms.
result Byzantine failures yield strictly worse generalization rates than data poisoning.
Data poisoning attacks -- where an adversary can modify a small fraction of training data, with the goal of forcing the trained classifier to high loss -- are an important threat for machine learning in many applications. While a body of prior work has developed attacks and defenses, there is not much general understan…
We consider data poisoning attacks, a class of adversarial attacks on machine learning where an adversary has the power to alter a small fraction of the training data in order to make the trained classifier satisfy certain objectives. While there has been much prior work on data poisoning, most of it is in the offline …
Paper explores how poisoning data can increase privacy risks in machine learning models.
problem Increasing privacy risks of benign training samples through data poisoning attacks.
method Proposes generic and optimization-based attacks to amplify membership exposure.
result Demonstrates substantial increase in membership inference precision with minimal model performance degradation.
The Lethal Dose Conjecture limits how much poisoned data can be tolerated.
problem Limiting the impact of poisoned data in machine learning models.
method Theoretical analysis and provable defenses (DPA, FA) based on majority voting.
result DPA and FA are asymptotically optimal defenses against data poisoning.
We study data poisoning attacks in the online setting where training items arrive sequentially, and the attacker may perturb the current item to manipulate online learning. Importantly, the attacker has no knowledge of future training items nor the data generating distribution. We formulate online data poisoning attack…
Aggregation defenses improve deep learning models' robustness against data poisoning attacks.
problem Data poisoning attacks manipulate deep learning models with malicious training samples.
method Deep Partition Aggregation, efficiency improvements, data-to-complexity ratio, poisoning overfitting phenomenon.
result Aggregation defenses boost poisoning robustness through the poisoning overfitting phenomenon.
Data poisoning attacks can severely degrade FL models, especially targeting specific classes.
problem Data poisoning attacks against federated learning systems.
method Demonstrated targeted attacks on FL systems, analyzed attack longevity, and proposed a defense strategy.
result Data poisoning attacks can cause substantial drops in classification accuracy and recall with a small percentage of malicious participants.
Improved defense against data poisoning attacks by aggregating smaller subsets.
problem Mitigating the impact of poisoned data on model robustness.
method Finite Aggregation method that combines duplicates of smaller disjoint subsets for training.
result Consistent improvement in certified robustness bounds, up to 4.77% on GTSRB.
This paper evaluates targeted data poisoning attacks by focusing on the hardest samples, improving evaluation and defense strategies.
problem The effectiveness of targeted data poisoning attacks is often overestimated due to average evaluation methods.
method The paper introduces metrics to identify the hardest and easiest to poison samples based on clean model information.
result The proposed metrics reliably stratify samples by poisoning vulnerability, enabling rigorous worst-case evaluation and proactive defense.
Efficient active learning method defends against malicious mislabeling and data poisoning attacks.
problem Malicious mislabeling and data poisoning attacks on deep neural networks.
method Adversarial retraining and active learning with random sampling strategy.
result The proposed method achieves 89% accuracy with only one-third of the labeled data, significantly outperforming the baseline method.
MetaPoison poisons neural networks by learning to craft imperceptible changes to training data.
problem Data poisoning attacks on neural networks.
method MetaPoison uses meta-learning to approximate bilevel optimization for crafting poisons.
result MetaPoison outperforms previous methods and works in various scenarios.
Nowadays, collaborative filtering recommender systems have been widely deployed in many commercial companies to make profit. Neighbourhood-based collaborative filtering is common and effective. To date, despite its effectiveness, there has been little effort to explore their robustness and the impact of data poisoning …
Study defends shallow neural networks from data-poisoning attacks.
problem Protecting shallow neural networks from adversarial attacks during training.
method Developed a non-gradient stochastic algorithm for depth-2 neural networks, proving near-optimal trade-offs.
result Demonstrated improved performance over stochastic gradient descent under various data distributions.
Framework detects and mitigates data-poisoning attacks in causal effect estimation.
problem Vulnerability to append-only attacks in observational causal analyses.
method Develops a data-poisoning audit for augmented inverse-probability-weighted estimation.
result Proposes a greedy scan to compute exact worst-case movement at every append budget.
Paper proves mathematically that poisoning datasets can be detected.
problem Detecting data poisoning attacks in datasets.
method Mathematical definition and Conformal Separability Test.
result Dataset poisoning can be effectively detected.
Data poisoning attacks compromise the integrity of machine-learning models by introducing malicious training samples to influence the results during test time. In this work, we investigate backdoor data poisoning attack on deep neural networks (DNNs) by inserting a backdoor pattern in the training images. The resulting…
New defence against data-poisoning attacks in neural networks.
problem Data-poisoning attacks can evade existing defences and increase model efficacy.
method Proved geometric mechanism and identified near clone regime in input space.
result Regularisation and data augmentation reduce data fitting capacity and prevent poisoning.
Data poisoning attacks can manipulate recommender systems to recommend target items.
problem Attacks on recommender systems to influence top-N item recommendations.
method Formulated as an optimization problem, solved using influence function to select influential users.
result Effective data poisoning attacks that outperform existing methods.
Linear models can be poisoned by shifting a fraction of one class's data, revealing scaling laws and weight alignment.
problem Understanding and quantifying data poisoning in linear models.
method Analysis of ridge least squares with an unpenalized intercept, using resolvent techniques and random matrix theory.
result Closed-form limits for the poisoned score, revealing scaling laws and weight alignment with the poisoning direction.
This work develops secure distributed algorithms for machine learning to protect against data poisoning and network attacks.
problem Vulnerability of distributed machine learning algorithms to cyber threats.
method Game-theoretic framework to capture conflicting goals of a learner and an attacker, iterative distributed algorithm.
result Distributed SVM is prone to fail in different types of attacks, with impact depending on network structure and attack capabilities.
Researchers analyze backdoor data poisoning attacks and identify a memorization capacity parameter.
problem Understanding and mitigating backdoor data poisoning attacks in machine learning models.
method Formal theoretical framework, statistical and computational analysis, explicit constructions, and algorithm design.
result Identified a memorization capacity parameter to assess vulnerability to backdoor attacks and developed algorithms to detect and mitigate them.
In this paper, we proposed a general framework for data poisoning attacks to graph-based semi-supervised learning (G-SSL). In this framework, we first unify different tasks, goals, and constraints into a single formula for data poisoning attack in G-SSL, then we propose two specialized algorithms to efficiently solve t…
Researchers show how to secretly train models with hidden data, detect usage with high confidence.
problem Protecting training data from traceability in large language models.
method Gradient-based optimization to learn secret sequences absent from training data.
result Secret sequences can be learned by models without performance degradation, detectable with high confidence.
MGD improves ML training efficiency and accuracy.
problem Optimizing large-scale ML model training configurations.
method Metagradient descent and smooth model training.
result Significantly improved model performance and learning rate schedules.
Subpopulation attacks poison data to misclassify naturally distributed points.
problem Improving accuracy of machine learning predictions through adversarial data modification.
method Introducing a novel subpopulation attack framework, using influence functions and gradient optimization.
result Subpopulation attacks are effective and stealthy, making them difficult to defend against.
We study offline data poisoning attacks in contextual bandits, a class of reinforcement learning problems with important applications in online recommendation and adaptive medical treatment, among others. We provide a general attack framework based on convex optimization and show that by slightly manipulating rewards i…
Machine learning models trained on data from the outside world can be corrupted by data poisoning attacks that inject malicious points into the models' training sets. A common defense against these attacks is data sanitization: first filter out anomalous training points before training the model. In this paper, we deve…
Many machine learning systems rely on data collected in the wild from untrusted sources, exposing the learning algorithms to data poisoning. Attackers can inject malicious data in the training dataset to subvert the learning process, compromising the performance of the algorithm producing errors in a targeted or an ind…
Novel defense algorithm improves SVMs against data poisoning attacks.
problem Vulnerability of SVMs to targeted training data manipulations like poisoning attacks.
method Developed a weighted SVM using K-LID to de-emphasize suspicious data samples.
result Significant reduction in classification error rates (10% on average) with the proposed defense.
Knowledge graph embedding (KGE) is a technique for learning continuous embeddings for entities and relations in the knowledge graph.Due to its benefit to a variety of downstream tasks such as knowledge graph completion, question answering and recommendation, KGE has gained significant attention recently. Despite its ef…
Data taggants verify dataset ownership without harming models or requiring model internals.
problem Verifying dataset ownership without harming models or requiring model internals.
method Using pairs of out-of-distribution samples and random labels as secret keys, subtly altering a dataset to detect models trained on it.
result Data taggants reliably detect models trained on the protected dataset with high confidence, without compromising validation accuracy.
Recent work has identified that classification models implemented as neural networks are vulnerable to data-poisoning and Trojan attacks at training time. In this work, we show that these training-time vulnerabilities extend to deep reinforcement learning (DRL) agents and can be exploited by an adversary with access to…
New attack targets speech-based AI models via stock market data.
problem Vulnerabilities in speech-based AI models using LLMs.
method Backdoor attack using acoustic data poisoning.
result Shows possible vulnerabilities in speech-based transformers.
New approach to robustly reliable learners against instance-targeted attacks.
problem Addressing data poisoning attacks on robustly reliable learners.
method Defining regularized robustly reliable learners and efficient algorithms.
result Efficient algorithms for robustly reliable learners with sublinear runtime.
Researchers show how to manipulate Partial Dependence plots to deceive explanations of predictive models.
problem The robustness and trustworthiness of Partial Dependence (PD) explanations are compromised.
method Data poisoning using genetic and gradient algorithms to manipulate PD plots.
result PD explanations can be fooled and manipulated to mislead understanding of predictive models.
Detects training data usage with radioactive data technique.
problem Detecting if a dataset was used to train a model.
method Radioactive data technique that makes imperceptible changes to detect training data usage.
result Can detect training data usage with high confidence (p<10^-4) even with small amounts of radioactive data.
We consider distributed on-device learning with limited communication and security requirements. We propose a new robust distributed optimization algorithm with efficient communication and attack tolerance. The proposed algorithm has provable convergence and robustness under non-IID settings. Empirical results show tha…
Solving a bilevel optimization problem is at the core of several machine learning problems such as hyperparameter tuning, data denoising, meta- and few-shot learning, and training-data poisoning. Different from simultaneous or multi-objective optimization, the steepest descent direction for minimizing the upper-level c…
Fair machine learning models can be vulnerable to adversarial attacks that reduce their accuracy and fairness.
problem Fairness constraints in machine learning models can compromise their robustness against adversarial attacks.
method Analysis of data poisoning attacks on group-based fair machine learning models, focusing on equalized odds.
result Adversaries can significantly reduce the test accuracy of fair machine learning models and widen their fairness gap.
In this paper we use game theory to model poisoning attack scenarios. We prove the non-existence of pure strategy Nash Equilibrium in the attacker and defender game. We then propose a mixed extension of our game model and an algorithm to approximate the Nash Equilibrium strategy for the defender. We then demonstrate th…
New methods combat data poisoning attacks in bandit algorithms using limited verification.
problem Data poisoning attacks on bandit algorithms, especially in the UCB and ETC types.
method Verification-based mechanisms to restore optimal regret with limited verifications.
result A simple modified ETC type bandit algorithm can restore optimal regret with O(logT) verifications. Naive Bayes spam filters are highly susceptible to data poisoning attacks. Here, known spam sources/blacklisted IPs exploit the fact that their received emails will be treated as (ground truth) labeled spam examples, and used for classifier training (or re-training). The attacking source thus generates emails that will…