PA-GNN enhances GNN robustness against poisoning attacks using clean graph knowledge.
problem Improving robustness of GNNs against poisoning attacks.
method PA-GNN uses a penalized aggregation mechanism and meta-optimization to transfer robustness from clean graphs.
result PA-GNN significantly improves GNN robustness against poisoning attacks on real-world graphs.
UM-GNN improves GNN robustness against poisoning attacks.
problem Vulnerability of GNNs to poisoning attacks.
method UM-GNN uses epistemic uncertainties from message passing to build a surrogate predictor.
result UM-GNN achieves significantly improved robustness against poisoning attacks.
Poisoning attacks improve graph-based recommender system recommendations.
problem Designing effective poisoning attacks for graph-based recommender systems.
method Formulated as an optimization problem, solved with techniques to assign rating scores to fake users.
result Outperforms existing attacks for graph-based recommender systems, recommending target items to 580 times more normal users.
Indirect attacks can fool graph classifiers even with poisoned neighbors.
problem How to evaluate and defend graph convolutional neural networks against indirect adversarial attacks.
method Proposed a method to generate adversarial perturbations on a single node far from the target.
result 99% attack success rate within two-hops from the target in two datasets.
Unified framework for data poisoning attacks in graph-based semi-supervised learning.
problem Data poisoning attacks on graph-based semi-supervised learning.
method Unified formula for data poisoning attacks, specialized algorithms for regression and classification tasks.
result Data poisoning can be effective even with minimal perturbations.
New attacks manipulate knowledge graph embeddings by adding or deleting facts.
problem Lack of robustness of KGE to adversarial attacks.
method Data poisoning attack strategies to manipulate knowledge graph embeddings.
result Demonstrated effectiveness and efficiency of proposed attack strategies.
Adversarial attacks degrade node embeddings and downstream tasks.
problem Robustness of node embeddings to adversarial attacks.
method Graph poisoning to perturb network structure.
result Efficient adversarial perturbations degrade embeddings and tasks.
Paper tackles node injection attacks on graphs using reinforcement learning.
problem Tackles the problem of injecting adversarial nodes into real-world graph applications to reduce node classification performance.
method Uses reinforcement learning to sequentially modify the adversarial information of injected nodes.
result Demonstrates superior performance of the proposed method NIPA compared to existing methods.
Paper introduces a data poisoning attack on unsupervised node embedding methods.
problem Robustness of unsupervised node embedding methods against adversarial attacks.
method Data poisoning attack on DeepWalk and LINE methods.
result Data poisoning can significantly affect link prediction results by altering graph structures slightly.
Paper proves mathematically that poisoning datasets can be detected.
problem Detecting data poisoning attacks in datasets.
method Mathematical definition and Conformal Separability Test.
result Dataset poisoning can be effectively detected.
New attack method makes poisoned images transferable without access to victim model.
problem Injecting poisoned images into training data to mislead deep nets.
method Designing poison images to surround targeted images in feature space, using Dropout.
result Achieves over 50% transferable success with only 1% poisoning of training set.
New method defends RL agents from poisoning attacks without MDP knowledge.
problem Poisoning attacks on RL systems can cause learning failures.
method Generic poisoning framework for online RL, Vulnerability-Aware Adversarial Critic Poison (VA2C-P).
result Successfully prevents RL agents from learning good policies or converging to target policies.
Efficient poisoning attack converges to any target classifier with provable convergence.
problem Inducing a corrupted model that misbehaves in favor of an adversary.
method Online convex optimization to find poisoning points incrementally.
result Provably converges to any attainable target classifier.
This paper evaluates targeted data poisoning attacks by focusing on the hardest samples, improving evaluation and defense strategies.
problem The effectiveness of targeted data poisoning attacks is often overestimated due to average evaluation methods.
method The paper introduces metrics to identify the hardest and easiest to poison samples based on clean model information.
result The proposed metrics reliably stratify samples by poisoning vulnerability, enabling rigorous worst-case evaluation and proactive defense.
Linear models can be poisoned by shifting a fraction of one class's data, revealing scaling laws and weight alignment.
problem Understanding and quantifying data poisoning in linear models.
method Analysis of ridge least squares with an unpenalized intercept, using resolvent techniques and random matrix theory.
result Closed-form limits for the poisoned score, revealing scaling laws and weight alignment with the poisoning direction.
Unified benchmarks assess data poisoning and backdoor attacks.
problem Unclear danger and effectiveness of data poisoning methods.
method Developed standardized benchmarks for data poisoning and backdoor attacks.
result Existing methods may not generalize to realistic settings.
MetaPoison poisons neural networks by learning to craft imperceptible changes to training data.
problem Data poisoning attacks on neural networks.
method MetaPoison uses meta-learning to approximate bilevel optimization for crafting poisons.
result MetaPoison outperforms previous methods and works in various scenarios.
Bullseye Polytope improves clean-label poisoning attacks in transfer learning.
problem Poisoning neural networks with correctly labeled data.
method Creates poison images with centers close to target images in feature space.
result Improves attack success rate by 26.75% in end-to-end transfer learning.
Real-time anomaly detection for edge streams using MIDAS and MIDAS-F.
problem Detecting unusual behavior in dynamic graph edge streams.
method MIDAS-F focuses on microcluster anomalies, incorporating anomalies into internal states to reduce poisoning effect.
result MIDAS-F outperforms MIDAS in accuracy, with up to 62% higher ROC-AUC.
Temporal threat model defends against data poisoning with timestamps.
problem Adversaries can poison more samples than expected, rendering existing defenses ineffective.
method Leverage timestamps to define earliness and duration metrics for temporal robustness.
result Temporal aggregation provides provable temporal robustness against data poisoning.
Poisoning attack is identified as a severe security threat to machine learning algorithms. In many applications, for example, deep neural network (DNN) models collect public data as the inputs to perform re-training, where the input data can be poisoned. Although poisoning attack against support vector machines (SVM) h…
Data poisoning is an attack on machine learning models wherein the attacker adds examples to the training set to manipulate the behavior of the model at test time. This paper explores poisoning attacks on neural nets. The proposed attacks use "clean-labels"; they don't require the attacker to have any control over the …
Aggregation defenses improve deep learning models' robustness against data poisoning attacks.
problem Data poisoning attacks manipulate deep learning models with malicious training samples.
method Deep Partition Aggregation, efficiency improvements, data-to-complexity ratio, poisoning overfitting phenomenon.
result Aggregation defenses boost poisoning robustness through the poisoning overfitting phenomenon.
Paper models game theory for defending against data poisoning attacks.
problem Defending against data poisoning attacks using game theory.
method Modeling attacker-defender game, proving non-existence of pure Nash Equilibrium, proposing mixed strategy approach, and developing an algorithm to approximate Nash Equilibrium.
result Demonstrated effectiveness of mixed strategy defense in experiments.
Paper shows large models are vulnerable to poisoning attacks.
problem Vulnerability of large machine learning models to poisoning attacks.
method Analyzed isotropic random feature vectors and geometric median as robust gradient aggregator rule.
result Linear and logistic regressions with D≥169H2/P2 parameters are vulnerable to arbitrary manipulation by poisoners. Research evaluates data poisoning attacks on regression learning and introduces a new defense strategy.
problem Data poisoning attacks on regression learning threaten model integrity in critical systems.
method Realistic scenarios, novel black-box attack, and evaluation on 26 datasets.
result Mean squared error (MSE) increases to 150% with only 2% poisoned samples.
This paper proposes a framework for certifying neural network defenses against data poisoning attacks.
problem Vulnerability of neural networks to data poisoning attacks.
method Random selection based defenses that average predictions on sub-datasets sampled from the training set.
result The certified radius of bagging derived by the framework is tighter than previous work.
New defence against data-poisoning attacks in neural networks.
problem Data-poisoning attacks can evade existing defences and increase model efficacy.
method Proved geometric mechanism and identified near clone regime in input space.
result Regularisation and data augmentation reduce data fitting capacity and prevent poisoning.
Detects poisoned training samples in deep neural networks.
problem Data poisoning attacks on deep neural networks.
method Two approaches: parametric probability distributions and Bayesian deep neural networks.
result Uncertainty estimates from trained models can discriminate clean from poisoned samples.
Study defenses against data poisoning attacks in online learning.
problem Data poisoning attacks on machine learning models.
method Rigorous study of four standard defenses in both a powerful and a realistic threat model.
result The effectiveness of defenses depends on the ease of the learning problem.
Generative model creates poisoning attacks against machine learning classifiers.
problem Poisoning attacks degrade machine learning classifier performance.
method Generative Adversarial Net with generator, discriminator, and classifier components.
result Effectively compromises machine learning classifiers, including deep networks.
The Lethal Dose Conjecture limits how much poisoned data can be tolerated.
problem Limiting the impact of poisoned data in machine learning models.
method Theoretical analysis and provable defenses (DPA, FA) based on majority voting.
result DPA and FA are asymptotically optimal defenses against data poisoning.
FoolsGold defends federated learning from sybil-based poisoning attacks.
problem Sybil-based poisoning attacks in federated learning.
method Identifies poisoning sybils based on client update diversity.
result Exceeds state-of-the-art approaches in countering sybil-based attacks.
Paper studies autoencoder-based anomaly detectors' robustness to adversarial poisoning attacks.
problem Adversarial poisoning attacks on online-trained autoencoder-based anomaly detectors in ICSs.
method Proposes two algorithms for generating poison samples and evaluates them on synthetic and real-world ICS data.
result Autoencoder detectors are resilient to poisoning in the face of all relevant attacks in the SWaT dataset.
Improved defense against data poisoning attacks by aggregating smaller subsets.
problem Mitigating the impact of poisoned data on model robustness.
method Finite Aggregation method that combines duplicates of smaller disjoint subsets for training.
result Consistent improvement in certified robustness bounds, up to 4.77% on GTSRB.
Study online data poisoning attacks in sequential training data.
problem Manipulate sequential training data to influence online learning outcomes.
method Formulated as a stochastic optimal control problem, solved with model predictive control and deep reinforcement learning.
result Upper bounds the suboptimality of attacks due to unknown data generating distribution.
Paper explores how poisoning data can increase privacy risks in machine learning models.
problem Increasing privacy risks of benign training samples through data poisoning attacks.
method Proposes generic and optimization-based attacks to amplify membership exposure.
result Demonstrates substantial increase in membership inference precision with minimal model performance degradation.
FR-Train improves fair and robust AI training by detecting and reducing poisoned data.
problem Training AI models that are fair and robust in the presence of data bias and poisoning.
method Mutual information-based adversarial training with an additional discriminator.
result FR-Train maintains fairness and accuracy even in the presence of poisoned data.
Adversaries can poison online learning data to mislead models.
problem Adversarial attacks on online learning systems.
method Formalized problem into two settings, proposed optimization-based attack strategy, and three solution strategies.
result Demonstrated effectiveness of data poisoning attacks in online learning.
Paper introduces class-oriented poisoning attacks to improve adversarial availability attacks.
problem Improving adversarial availability attacks on neural networks.
method Gradient-based framework for crafting poisoned images at the class level.
result Demonstrated effectiveness of class-oriented poisoning attacks on various models and datasets.
Data poisoning attacks can severely degrade FL models, especially targeting specific classes.
problem Data poisoning attacks against federated learning systems.
method Demonstrated targeted attacks on FL systems, analyzed attack longevity, and proposed a defense strategy.
result Data poisoning attacks can cause substantial drops in classification accuracy and recall with a small percentage of malicious participants.
Poisoning attacks can undermine fairness in machine learning models.
problem Poisoning attacks can introduce classification disparities among different groups in data.
method Developed a gradient-based poisoning attack framework to target algorithmic fairness.
result Demonstrated the effectiveness of poisoning attacks in both white-box and black-box scenarios.
Many machine learning systems rely on data collected in the wild from untrusted sources, exposing the learning algorithms to data poisoning. Attackers can inject malicious data in the training dataset to subvert the learning process, compromising the performance of the algorithm producing errors in a targeted or an ind…
Researchers develop methods to protect reinforcement learning and control systems from policy poisoning attacks.
problem Attacks on reinforcement learning and control systems that manipulate learned policies.
method Unified framework for solving policy poisoning attacks, demonstrating global optimality and feasibility.
result Policy poisoning attacks are feasible and can be defended with a convex optimization approach.
Subpopulation attacks poison data to misclassify naturally distributed points.
problem Improving accuracy of machine learning predictions through adversarial data modification.
method Introducing a novel subpopulation attack framework, using influence functions and gradient optimization.
result Subpopulation attacks are effective and stealthy, making them difficult to defend against.
Deep Partition Aggregation defends against poisoning attacks with provable certificates.
problem Adversarial poisoning attacks corrupt classifier test-time behavior.
method Deep Partition Aggregation (DPA) is an ensemble method using hash partitions and base models trained on these partitions.
result DPA can certify >= 50% of test images against over 500 poison image insertions on MNIST, and nine insertions on CIFAR-10.
Regularization helps protect machine learning models from poisoning attacks.
problem Mitigating the impact of poisoned data on machine learning models.
method Distributionally-robust optimization using Wasserstein distance to find an upper bound for worst-case fitness.
result The regularizer is equal to the dual norm of the model parameters for regression models.
Regularisation improves ML classifier stability against poisoning attacks.
problem Poisoning attacks degrade ML algorithms' performance; current attacks ignore hyperparameters.
method Proposed a multiobjective bilevel optimisation problem to consider hyperparameter effects.
result L2 regularisation enhances learning algorithm stability and mitigates poisoning attacks.