Is feature selection secure against training data poisoning?

Abstract

Learning in adversarial settings is becoming an important task for application domains where attackers may inject malicious data into the training set to subvert normal operation of data-driven technologies. Feature selection has been widely used in machine learning for security applications to improve generalization and computational efficiency, although it is not clear whether its use may be beneficial or even counterproductive when training data are poisoned by intelligent attackers. In this work, we shed light on this issue by providing a framework to investigate the robustness of popular feature selection methods, including LASSO, ridge regression and the elastic net. Our results on malware detection show that feature selection methods can be significantly compromised under attack (we can reduce LASSO to almost random choices of feature sets by careful insertion of less than 5% poisoned training samples), highlighting the need for specific countermeasures.

References in corpus (4)

• Scikit-learn: Machine Learning in Python
• Poisoning Attacks against Support Vector Machines
• Security Evaluation of Pattern Classifiers under Attack
• Adversarial Feature Selection against Evasion Attacks

Cited by in corpus (74)

• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Analyzing Federated Learning through an Adversarial Lens
• Adversarial Examples: Attacks and Defenses for Deep Learning
• A Berkeley View of Systems Challenges for AI
• Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detection
• Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
• Machine Learning for Security in Vehicular Networks: A Comprehensive Survey
• Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks
• AI Security for Geoscience and Remote Sensing: Challenges and Future Trends
• Randomized Prediction Games for Adversarial Machine Learning
• On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shaping
• Explanation-Guided Backdoor Poisoning Attacks Against Malware Classifiers
• Data Poisoning Attacks Against Federated Learning Systems
• Poisoning Attacks with Generative Adversarial Nets
• Fault Sneaking Attack: a Stealthy Framework for Misleading Deep Neural Networks
• Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization
• Arms Race in Adversarial Malware Detection: A Survey
• Policy Teaching via Environment Poisoning: Training-time Adversarial Attacks against Reinforcement Learning
• Defending against Backdoor Attack on Deep Neural Networks
• Adversarial Examples Make Strong Poisons
• On the Adversarial Robustness of LASSO Based Feature Selection
• Node Injection Attacks on Graphs via Reinforcement Learning
• Adversarial Attacks and Defenses in Physiological Computing: A Systematic Review
• A Theoretical Framework for Robustness of (Deep) Classifiers against Adversarial Examples
• Data Poisoning against Differentially-Private Learners: Attacks and Defenses
• Privacy Preservation in Federated Learning: An insightful survey from the GDPR Perspective
• ActiveClean: Interactive Data Cleaning While Learning Convex Loss Models
• Action-Manipulation Attacks Against Stochastic Bandits: Attacks and Defense
• Undistillable: Making A Nasty Teacher That CANNOT teach students
• Certified Robustness to Label-Flipping Attacks via Randomized Smoothing
• What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction
• Deep-Dup: An Adversarial Weight Duplication Attack Framework to Crush Deep Neural Network in Multi-Tenant FPGA
• DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips
• DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentations
• Interpretable Deep Learning under Fire
• Adversarial Attacks on Brain-Inspired Hyperdimensional Computing-Based Classifiers
• Attacking Graph-based Classification via Manipulating the Graph Structure
• VerIDeep: Verifying Integrity of Deep Neural Networks through Sensitive-Sample Fingerprinting
• Robust and Differentially Private Mean Estimation
• SPECTRE: Defending Against Backdoor Attacks Using Robust Statistics
• Towards Security Threats of Deep Learning Systems: A Survey
• FooBaR: Fault Fooling Backdoor Attack on Neural Network Training
• Bi-Level Poisoning Attack Model and Countermeasure for Appliance Consumption Data of Smart Homes
• Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Release
• Defense Against Reward Poisoning Attacks in Reinforcement Learning
• Regularisation Can Mitigate Poisoning Attacks: A Novel Analysis Based on Multiobjective Bilevel Optimisation
• Policy Teaching in Reinforcement Learning via Environment Poisoning Attacks
• Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Training
• Influence Function based Data Poisoning Attacks to Top-N Recommender Systems
• Unlearn What You Have Learned: Adaptive Crowd Teaching with Exponentially Decayed Memory Learners
• Omni: Automated Ensemble with Unexpected Models against Adversarial Evasion Attack
• Technologies for Trustworthy Machine Learning: A Survey in a Socio-Technical Context
• Regularization Can Help Mitigate Poisoning Attacks... with the Right Hyperparameters
• Elastic Net based Feature Ranking and Selection
• Going Grayscale: The Road to Understanding and Improving Unlearnable Examples
• Robust High-Dimensional Linear Regression
• Data Poisoning Attacks and Defenses to Crowdsourcing Systems
• Defending Regression Learners Against Poisoning Attacks
• The House That Knows You: User Authentication Based on IoT Data
• Classification Auto-Encoder based Detector against Diverse Data Poisoning Attacks
• A Framework of Randomized Selection Based Certified Defenses Against Data Poisoning Attacks
• Gradient-based Data Subversion Attack Against Binary Classifiers
• Defending Against Adversarial Denial-of-Service Data Poisoning Attacks
• Adversarial Poisoning Attacks and Defense for General Multi-Class Models Based On Synthetic Reduced Nearest Neighbors
• Accumulative Poisoning Attacks on Real-time Data
• Adversarial Machine Learning for Cybersecurity and Computer Vision: Current Developments and Challenges
• Widen The Backdoor To Let More Attackers In
• Are You Tampering With My Data?
• Poisoning Online Learning Filters: DDoS Attacks and Countermeasures
• A Separation Result Between Data-oblivious and Data-aware Poisoning Attacks
• Poisoning the Search Space in Neural Architecture Search