Abstract:ABSTRACTMachine learning is increasingly being used for automated decisions in applications such as health care, finance, autonomous vehicles, and personalized recommendations. These critical applications require strong guarantees on both the integrity of the machine learning models and the privacy of the user data used to train these models. The area of adversarial machine learning studies the effect of adversarial attacks against machine learning models and aims to design robust defense algorithms. The main challenges in this space are the development of realistic adversarial models that consider the specifics of real-world applications, and the design of machine learning algorithms resilient against a wide range of threats. In this talk, we describe our work on creating a taxonomy of poisoning attacks against machine learning systems at training time. In light of recent software supply chain vulnerabilities revealed by the SolarWinds attack, the supply chain of machine learning development needs to be protected. First, we introduce our optimization approach to create poisoning availability attacks against linear regression and discuss robust defenses based on techniques from robust statistics [1]. Then, we discuss how an attacker with minimal knowledge of a machine learning classifier can inject backdoor poisoning attacks, by leveraging techniques from machine learning explainability [4]. We demonstrate these methods on several malware classifiers and show the challenges of designing robust defenses to protect against these attacks. We also define a new attack model called subpopulation poisoning, that requires a small set of poisoning points to impact the accuracy of the model on a targeted subpopulation [2]. We evaluate our poisoning attacks on multiple data modalities, including image, text, and tabular data. Finally, we highlight a surprising connection between machine learning integrity and privacy attacks, and show how poisoning attacks can be used for auditing the privacy of machine learning algorithms such as differentially private stochastic gradient descent [3].

Robustness, Efficiency, or Privacy: Pick Two in Machine Learning

On the Relevance of Byzantine Robust Optimization Against Data Poisoning

Collaborative Machine Learning: Schemes, Robustness, and Privacy

SecureML: A System for Scalable Privacy-Preserving Machine Learning

Machine Learning Integrity and Privacy in Adversarial Environments

Guaranteed Distributed Machine Learning: Privacy-preserving Empirical Risk Minimization

Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Ahead

On the Robustness of Distributed Machine Learning against Transfer Attacks

Towards the Science of Security and Privacy in Machine Learning

Trustworthy Distributed AI Systems: Robustness, Privacy, and Governance

Robustness Evaluation of Deep Unsupervised Learning Algorithms for Intrusion Detection Systems

With Great Dispersion Comes Greater Resilience: Efficient Poisoning Attacks and Defenses for Linear Regression Models

On the Conflict of Robustness and Learning in Collaborative Machine Learning

Machine Learning Robustness: A Primer

Improving Machine Learning Robustness via Adversarial Training

Secure Byzantine-Robust Machine Learning

Distributed Machine Learning and the Semblance of Trust

Privacy-Preserving Machine Learning: Methods, Challenges and Directions

Towards More Scalable and Robust Machine Learning

Efficient Dropout-resilient Aggregation for Privacy-preserving Machine Learning