Support Vector Machines under Adversarial Label Contamination

Abstract

Machine learning algorithms are increasingly being applied in security-related tasks such as spam and malware detection, although their security properties against deliberate attacks have not yet been widely understood. Intelligent and adaptive attackers may indeed exploit specific vulnerabilities exposed by machine learning techniques to violate system security. Being robust to adversarial data manipulation is thus an important, additional requirement for machine learning algorithms to successfully operate in adversarial settings. In this work, we evaluate the security of Support Vector Machines (SVMs) to well-crafted, adversarial label noise attacks. In particular, we consider an attacker that aims to maximize the SVM's classification error by flipping a number of labels in the training data. We formalize a corresponding optimal attack strategy, and solve it by means of heuristic approaches to keep the computational complexity tractable. We report an extensive experimental analysis on the effectiveness of the considered attacks against linear and non-linear SVMs, both on synthetic and real-world datasets. We finally argue that our approach can also provide useful insights for developing more secure SVM learning algorithms, and also novel techniques in a number of related research areas, such as semi-supervised and active learning.

References in corpus (4)

• Evasion Attacks against Machine Learning at Test Time
• Poisoning Attacks against Support Vector Machines
• Security Evaluation of Pattern Classifiers under Attack
• Security Analysis of Online Centroid Anomaly Detection

Cited by in corpus (41)

• Can You Really Backdoor Federated Learning?
• Spectral Signatures in Backdoor Attacks
• Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
• Evaluating Differentially Private Machine Learning in Practice
• Certified Defenses for Data Poisoning Attacks
• Backdoor Attacks against Transfer Learning with Pre-trained Deep Learning Models
• Launching Adversarial Attacks against Network Intrusion Detection Systems for IoT
• Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attacks
• Data Poisoning Attacks Against Federated Learning Systems
• Data Driven Exploratory Attacks on Black Box Classifiers in Adversarial Domains
• Label-Consistent Backdoor Attacks
• Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
• Responsible AI by Design in Practice
• A survey on Adversarial Recommender Systems: from Attack/Defense strategies to Generative Adversarial Networks
• Vulnerabilities of Connectionist AI Applications: Evaluation and Defence
• Adversarial Learning in Statistical Classification: A Comprehensive Review of Defenses Against Attacks
• Online Data Poisoning Attack
• Poison as a Cure: Detecting & Neutralizing Variable-Sized Backdoor Attacks in Deep Neural Networks
• Fisher-Bures Adversary Graph Convolutional Networks
• Towards Security Threats of Deep Learning Systems: A Survey
• Learning Discrete Distributions from Untrusted Batches
• Manipulating hidden-Markov-model inferences by corrupting batch data
• A Mathematical Programming approach to Binary Supervised Classification with Label Noise
• Model-Targeted Poisoning Attacks with Provable Convergence
• Adversarial Learning: A Critical Review and Active Learning Study
• Securing Contrastive mmWave-based Human Activity Recognition against Adversarial Label Flipping
• Revealing Perceptible Backdoors, without the Training Set, via the Maximum Achievable Misclassification Fraction Statistic
• A Backdoor Attack against 3D Point Cloud Classifiers
• Poison Attacks against Text Datasets with Conditional Adversarially Regularized Autoencoder
• Influence-Driven Data Poisoning in Graph-Based Semi-Supervised Classifiers
• Modular Learning Component Attacks: Today's Reality, Tomorrow's Challenge
• Reaching Data Confidentiality and Model Accountability on the CalTrain
• Making Paper Reviewing Robust to Bid Manipulation Attacks
• EagleEye: Attack-Agnostic Defense against Adversarial Inputs (Technical Report)
• Defending Distributed Classifiers Against Data Poisoning Attacks
• Classification Auto-Encoder based Detector against Diverse Data Poisoning Attacks
• Totally Deep Support Vector Machines
• Broadly Applicable Targeted Data Sample Omission Attacks
• A BIC-based Mixture Model Defense against Data Poisoning Attacks on Classifiers
• Reverse Engineering Imperceptible Backdoor Attacks on Deep Neural Networks for Detection and Training Set Cleansing
• Defending SVMs against Poisoning Attacks: the Hardness and DBSCAN Approach