Poisoning Attacks against Support Vector Machines

Abstract

We investigate a family of poisoning attacks against Support Vector Machines (SVM). Such attacks inject specially crafted training data that increases the SVM's test error. Central to the motivation for these attacks is the fact that most learning algorithms assume that their training data comes from a natural or well-behaved distribution. However, this assumption does not generally hold in security-sensitive settings. As we demonstrate, an intelligent adversary can, to some extent, predict the change of the SVM's decision function due to malicious input and use this ability to construct malicious data. The proposed attack uses a gradient ascent strategy in which the gradient is computed based on properties of the SVM's optimal solution. This method can be kernelized and enables the attack to be constructed in the input space even for non-linear kernels. We experimentally demonstrate that our gradient ascent procedure reliably identifies good local maxima of the non-convex validation error surface, which significantly increases the classifier's test error.

Appears in Proceedings of the 29th International Conference on Machine Learning (ICML 2012)

Cited by in corpus (215)

• On the Opportunities and Risks of Foundation Models
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Understanding Black-box Predictions via Influence Functions
• How To Backdoor Federated Learning
• The Hidden Vulnerability of Distributed Learning in Byzantium
• Security Evaluation of Pattern Classifiers under Attack
• Synthetic and Natural Noise Both Break Neural Machine Translation
• Analyzing Federated Learning through an Adversarial Lens
• Optimization Problems for Machine Learning: A Survey
• Can You Really Backdoor Federated Learning?
• Spectral Signatures in Backdoor Attacks
• On the (Statistical) Detection of Adversarial Examples
• Mitigating Sybils in Federated Learning Poisoning
• Black-box Adversarial Attacks with Limited Queries and Information
• Is feature selection secure against training data poisoning?
• Adversarial Feature Selection against Evasion Attacks
• Neural Trojans
• Support Vector Machines under Adversarial Label Contamination
• Adversarial Examples: Attacks and Defenses for Deep Learning
• Ditto: Fair and Robust Federated Learning Through Personalization
• Federated Learning for Healthcare Domain - Pipeline, Applications and Challenges
• Mitigating Adversarial Effects Through Randomization
• DARTS: Deceiving Autonomous Cars with Toxic Signs
• Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
• Byzantine-Robust Federated Machine Learning through Adaptive Model Averaging
• Edge Intelligence: Architectures, Challenges, and Applications
• Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detection
• Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
• Blind Backdoors in Deep Learning Models
• Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbation
• Terminal Brain Damage: Exposing the Graceless Degradation in Deep Neural Networks Under Hardware Fault Attacks
• Privacy in Deep Learning: A Survey
• Rethinking the Trigger of Backdoor Attack
• Practical Black-Box Attacks against Machine Learning
• MetaPoison: Practical General-purpose Clean-label Data Poisoning
• Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks
• Adversarial Attacks Against Deep Generative Models on Data: A Survey
• The Pitfalls of Simplicity Bias in Neural Networks
• Towards Adversarial Malware Detection: Lessons Learned from PDF-based Attacks
• Adversarial Samples on Android Malware Detection Systems for IoT Systems
• Explaining Vulnerabilities to Adversarial Machine Learning through Visual Analytics
• Randomized Prediction Games for Adversarial Machine Learning
• On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shaping
• The Limitations of Deep Learning in Adversarial Settings
• Training Data Influence Analysis and Estimation: A Survey
• You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completion
• CrypTen: Secure Multi-Party Computation Meets Machine Learning
• Security and Privacy Issues in Deep Learning
• DAWN: Dynamic Adversarial Watermarking of Neural Networks
• Attack-Resistant Federated Learning with Residual-based Reweighting
• Explanation-Guided Backdoor Poisoning Attacks Against Malware Classifiers
• Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attacks
• Stealing Hyperparameters in Machine Learning
• Data Poisoning Attacks Against Federated Learning Systems
• Enhanced Security and Privacy via Fragmented Federated Learning
• Poisoning Attacks with Generative Adversarial Nets
• RAB: Provable Robustness Against Backdoor Attacks
• Fault Sneaking Attack: a Stealthy Framework for Misleading Deep Neural Networks
• A Little Is Enough: Circumventing Defenses For Distributed Learning
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Label-Consistent Backdoor Attacks
• Arms Race in Adversarial Malware Detection: A Survey
• SAFELearning: Enable Backdoor Detectability In Federated Learning With Secure Aggregation
• Adversarial classification: An adversarial risk analysis approach
• Policy Teaching via Environment Poisoning: Training-time Adversarial Attacks against Reinforcement Learning
• Curie: A method for protecting SVM Classifier from Poisoning Attack
• Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching
• Living-Off-The-Land Command Detection Using Active Learning
• Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasures
• FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping
• Machine Learning Security against Data Poisoning: Are We There Yet?
• Radioactive data: tracing through training
• Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness
• Honest-but-Curious Nets: Sensitive Attributes of Private Inputs Can Be Secretly Coded into the Classifiers' Outputs
• Pixle: a fast and effective black-box attack based on rearranging pixels
• Bugs in our Pockets: The Risks of Client-Side Scanning
• Safeguarding connected autonomous vehicle communication: Protocols, intra- and inter-vehicular attacks and defenses
• Security Matters: A Survey on Adversarial Machine Learning
• A survey on Adversarial Recommender Systems: from Attack/Defense strategies to Generative Adversarial Networks
• Dynamic Adversarial Patch for Evading Object Detection Models
• A Theoretical Framework for Robustness of (Deep) Classifiers against Adversarial Examples
• Generalized Resilience and Robust Statistics
• The Threat of Adversarial Attacks on Machine Learning in Network Security -- A Survey
• Poisoning Attack against Estimating from Pairwise Comparisons
• Effectiveness of Distillation Attack and Countermeasure on Neural Network Watermarking
• Explainable Data Poison Attacks on Human Emotion Evaluation Systems based on EEG Signals
• Adversarial Detection of Flash Malware: Limitations and Open Issues
• Poisoning the Unlabeled Dataset of Semi-Supervised Learning
• Dataset Distillation
• Machine Teaching for Bayesian Learners in the Exponential Family
• Defend Data Poisoning Attacks on Voice Authentication
• Certified Data Removal from Machine Learning Models
• Action-Manipulation Attacks Against Stochastic Bandits: Attacks and Defense
• BAAAN: Backdoor Attacks Against Autoencoder and GAN-Based Machine Learning Models
• Wild Networks: Exposure of 5G Network Infrastructures to Adversarial Examples
• The Faults in Our Pi Stars: Security Issues and Open Challenges in Deep Reinforcement Learning
• Poisoning and Backdooring Contrastive Learning
• Adversarial Attacks on Linear Contextual Bandits
• PAC-learning in the presence of evasion adversaries
• Interpretable Deep Learning under Fire
• Adversarial Machine Learning in Wireless Communications using RF Data: A Review
• Byzantines can also Learn from History: Fall of Centered Clipping in Federated Learning
• A Formalization of Robustness for Deep Neural Networks
• Scratch that! An Evolution-based Adversarial Attack against Neural Networks
• Vulnerability-Aware Poisoning Mechanism for Online RL with Unknown Dynamics
• FedDebug: Systematic Debugging for Federated Learning Applications
• Learning to Confuse: Generating Training Time Adversarial Data with Auto-Encoder
• Federated Learning for Malware Detection in IoT Devices
• Security and Privacy for Artificial Intelligence: Opportunities and Challenges
• Orchestrating the Development Lifecycle of Machine Learning-Based IoT Applications: A Taxonomy and Survey
• Attacking Graph-based Classification via Manipulating the Graph Structure
• VerIDeep: Verifying Integrity of Deep Neural Networks through Sensitive-Sample Fingerprinting
• Deep Partition Aggregation: Provable Defense against General Poisoning Attacks
• Towards Security Threats of Deep Learning Systems: A Survey
• FooBaR: Fault Fooling Backdoor Attack on Neural Network Training
• Poisoning Attacks to Local Differential Privacy Protocols for Key-Value Data
• Manipulating a Learning Defender and Ways to Counteract
• Defending Against Backdoor Attacks in Natural Language Generation
• secml: A Python Library for Secure and Explainable Machine Learning
• Lower Bounds for Adversarially Robust PAC Learning
• A Marauder's Map of Security and Privacy in Machine Learning
• Adversarial Binaries for Authorship Identification
• Dimensionality reduction, regularization, and generalization in overparameterized regressions
• Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch
• Defense Against Reward Poisoning Attacks in Reinforcement Learning
• AIR5: Five Pillars of Artificial Intelligence Research
• Auxo: Efficient Federated Learning via Scalable Client Clustering
• An Optimal Control Approach to Sequential Machine Teaching
• Policy Teaching in Reinforcement Learning via Environment Poisoning Attacks
• Regularisation Can Mitigate Poisoning Attacks: A Novel Analysis Based on Multiobjective Bilevel Optimisation
• Hu-Fu: Hardware and Software Collaborative Attack Framework against Neural Networks
• Addressing Security and Privacy Challenges in Internet of Things
• Defending against Machine Learning based Inference Attacks via Adversarial Examples: Opportunities and Challenges
• Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Training
• Model-Targeted Poisoning Attacks with Provable Convergence
• Influence Function based Data Poisoning Attacks to Top-N Recommender Systems
• A Holistic Framework for Safeguarding of SMEs-A Case Study
• Mitigating Sybil Attacks on Differential Privacy based Federated Learning
• PAC learning with stable and private predictions
• Data Poisoning Attacks to Local Differential Privacy Protocols
• Advanced Evasion Attacks and Mitigations on Practical ML-Based Phishing Website Classifiers
• FedCom: A Byzantine-Robust Local Model Aggregation Rule Using Data Commitment for Federated Learning
• Why Adversarial Reprogramming Works, When It Fails, and How to Tell the Difference
• Built-in Vulnerabilities to Imperceptible Adversarial Perturbations
• Exploring Counterfactual Explanations Through the Lens of Adversarial Examples: A Theoretical and Empirical Analysis
• Adversarial Reinforcement Learning under Partial Observability in Autonomous Computer Network Defence
• Regularization Helps with Mitigating Poisoning Attacks: Distributionally-Robust Machine Learning Using the Wasserstein Distance
• Provable Robustness Against a Union of ${\ell }_0$ Adversarial Attacks
• Optimal Feature Manipulation Attacks Against Linear Regression
• Subset Scanning Over Neural Network Activations
• On the Robustness of Human Pose Estimation
• Robust Federated Learning with Attack-Adaptive Aggregation
• Detecting Adversarial Examples - A Lesson from Multimedia Forensics
• Data Poisoning Attacks in Contextual Bandits
• Compensating Supervision Incompleteness with Prior Knowledge in Semantic Image Interpretation
• Careful What You Wish For: on the Extraction of Adversarially Trained Models
• Fooling Adversarial Training with Inducing Noise
• PAC-Learning for Strategic Classification
• Learning under $p$-Tampering Attacks
• Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification
• Active Deep Learning Attacks under Strict Rate Limitations for Online API Calls
• Picket: Guarding Against Corrupted Data in Tabular Data during Learning and Inference
• High-Dimensional Robust Mean Estimation via Gradient Descent
• Disrupting Model Training with Adversarial Shortcuts
• Channels, Remote Estimation and Queueing Systems With A Utilization-Dependent Component: A Unifying Survey Of Recent Results
• Regularization Can Help Mitigate Poisoning Attacks... with the Right Hyperparameters
• Path classification by stochastic linear recurrent neural networks
• Grundy Distinguishes Treewidth from Pathwidth
• Abstraction and Symbolic Execution of Deep Neural Networks with Bayesian Approximation of Hidden Features
• Technologies for Trustworthy Machine Learning: A Survey in a Socio-Technical Context
• Poisoning Behavioral Malware Clustering
• Topological Detection of Trojaned Neural Networks
• Robust learning under clean-label attack
• Fast Machine Learning with Byzantine Workers and Servers
• An Investigation of Data Poisoning Defenses for Online Learning
• Reaching Data Confidentiality and Model Accountability on the CalTrain
• Outlier-Robust Sparse Estimation via Non-Convex Optimization
• Adequacy of the Gradient-Descent Method for Classifier Evasion Attacks
• Enhancing the Antidote: Improved Pointwise Certifications against Poisoning Attacks
• Towards Adversarial Configurations for Software Product Lines
• Virtuously Safe Reinforcement Learning
• Defending Distributed Classifiers Against Data Poisoning Attacks
• Pocket Diagnosis: Secure Federated Learning against Poisoning Attack in the Cloud
• Adversarial Deep Learning for Over-the-Air Spectrum Poisoning Attacks
• Investigating Robustness and Interpretability of Link Prediction via Adversarial Modifications
• De-Pois: An Attack-Agnostic Defense against Data Poisoning Attacks
• Federated Learning with Unreliable Clients: Performance Analysis and Mechanism Design
• Spinning Sequence-to-Sequence Models with Meta-Backdoors
• Defending Against Adversarial Denial-of-Service Data Poisoning Attacks
• Regret Bounds for LQ Adaptive Control Under Database Attacks (Extended Version)
• Statistical Query Lower Bounds for List-Decodable Linear Regression
• A Framework of Randomized Selection Based Certified Defenses Against Data Poisoning Attacks
• Technical Report: When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attacks
• Mitigation of Adversarial Attacks through Embedded Feature Selection
• Is Data Clustering in Adversarial Settings Secure?
• 10 Security and Privacy Problems in Large Foundation Models
• Classification Auto-Encoder based Detector against Diverse Data Poisoning Attacks
• On the adversarial robustness of robust estimators
• The House That Knows You: User Authentication Based on IoT Data
• The Effectiveness of Johnson-Lindenstrauss Transform for High Dimensional Optimization With Adversarial Outliers, and the Recovery
• ReLU Regression with Massart Noise
• Accumulative Poisoning Attacks on Real-time Data
• Extending Adversarial Attacks to Produce Adversarial Class Probability Distributions
• On the security relevance of weights in deep learning
• Adversarial Machine Learning for Cybersecurity and Computer Vision: Current Developments and Challenges
• Certifying Robustness to Programmable Data Bias in Decision Trees
• Widen The Backdoor To Let More Attackers In
• On the Security Risks of AutoML
• Poisoning Online Learning Filters: DDoS Attacks and Countermeasures
• Towards Quality Assurance of Software Product Lines with Adversarial Configurations
• Defending SVMs against Poisoning Attacks: the Hardness and DBSCAN Approach
• Security and Privacy Considerations for Machine Learning Models Deployed in the Government and Public Sector (white paper)
• A Separation Result Between Data-oblivious and Data-aware Poisoning Attacks
• Are You Tampering With My Data?