Abstract:ABSTRACTMachine learning is increasingly being used for automated decisions in applications such as health care, finance, autonomous vehicles, and personalized recommendations. These critical applications require strong guarantees on both the integrity of the machine learning models and the privacy of the user data used to train these models. The area of adversarial machine learning studies the effect of adversarial attacks against machine learning models and aims to design robust defense algorithms. The main challenges in this space are the development of realistic adversarial models that consider the specifics of real-world applications, and the design of machine learning algorithms resilient against a wide range of threats. In this talk, we describe our work on creating a taxonomy of poisoning attacks against machine learning systems at training time. In light of recent software supply chain vulnerabilities revealed by the SolarWinds attack, the supply chain of machine learning development needs to be protected. First, we introduce our optimization approach to create poisoning availability attacks against linear regression and discuss robust defenses based on techniques from robust statistics [1]. Then, we discuss how an attacker with minimal knowledge of a machine learning classifier can inject backdoor poisoning attacks, by leveraging techniques from machine learning explainability [4]. We demonstrate these methods on several malware classifiers and show the challenges of designing robust defenses to protect against these attacks. We also define a new attack model called subpopulation poisoning, that requires a small set of poisoning points to impact the accuracy of the model on a targeted subpopulation [2]. We evaluate our poisoning attacks on multiple data modalities, including image, text, and tabular data. Finally, we highlight a surprising connection between machine learning integrity and privacy attacks, and show how poisoning attacks can be used for auditing the privacy of machine learning algorithms such as differentially private stochastic gradient descent [3].

Poisoning Attacks Against Machine Learning: Can Machine Learning Be Trustworthy?

Data Poisoning Attacks in Internet-of-Vehicle Networks: Taxonomy, State-of-The-Art, and Future Directions.

Threats to Training: A Survey of Poisoning Attacks and Defenses on Machine Learning Systems

Machine Learning Integrity and Privacy in Adversarial Environments

Analysis on Data Poisoning Attack Detection Using Machine Learning Techniques and Artificial Intelligence

Poisoning Attacks and Data Sanitization Mitigations for Machine Learning Models in Network Intrusion Detection Systems

Poisoning attacks and countermeasures in intelligent networks: Status quo and prospects

Detecting Poisoning Attacks on Machine Learning in IoT Environments

A Survey on Poisoning Attacks Against Supervised Machine Learning

A Flexible Poisoning Attack Against Machine Learning.

Poisoning Attacks on Machine Learning Models in Cyber Systems and Mitigation Strategies

Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning

Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning

Truth Serum: Poisoning Machine Learning Models to Reveal Their Secrets

Data Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses

With Great Dispersion Comes Greater Resilience: Efficient Poisoning Attacks and Defenses for Linear Regression Models

ML Attack Models: Adversarial Attacks and Data Poisoning Attacks

Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detection

Have You Poisoned My Data? Defending Neural Networks against Data Poisoning

Preventing Machine Learning Poisoning Attacks Using Authentication and Provenance

Assessing Vulnerabilities of Adversarial Learning Algorithm through Poisoning Attacks