Regularization Can Help Mitigate Poisoning Attacks... with the Right Hyperparameters
arXiv:2105.10948
Abstract
Machine learning algorithms are vulnerable to poisoning attacks, where a fraction of the training data is manipulated to degrade the algorithms' performance. We show that current approaches, which typically assume that regularization hyperparameters remain constant, lead to an overly pessimistic view of the algorithms' robustness and of the impact of regularization. We propose a novel optimal attack formulation that considers the effect of the attack on the hyperparameters, modelling the attack as a \emph{minimax bilevel optimization problem}. This allows to formulate optimal attacks, select hyperparameters and evaluate robustness under worst case conditions. We apply this formulation to logistic regression using regularization, empirically show the limitations of previous strategies and evidence the benefits of using regularization to dampen the effect of poisoning attacks.
arXiv commentPublished at ICLR 2021 Workshop on Security and Safety in Machine Learning Systems. arXiv admin note: text overlap with arXiv:2003.00040
References in corpus (11)
- Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
- Understanding Black-box Predictions via Influence Functions
- Poisoning Attacks against Support Vector Machines
- Is feature selection secure against training data poisoning?
- Transferable Clean-Label Poisoning Attacks on Deep Neural Nets
- Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detection
- Stronger Data Poisoning Attacks Break Data Sanitization Defenses
- MetaPoison: Practical General-purpose Clean-label Data Poisoning
- Poisoning Attacks with Generative Adversarial Nets
- Training Set Debugging Using Trusted Items
- On the Iteration Complexity of Hypergradient Computation