Abstract:ABSTRACTMachine learning is increasingly being used for automated decisions in applications such as health care, finance, autonomous vehicles, and personalized recommendations. These critical applications require strong guarantees on both the integrity of the machine learning models and the privacy of the user data used to train these models. The area of adversarial machine learning studies the effect of adversarial attacks against machine learning models and aims to design robust defense algorithms. The main challenges in this space are the development of realistic adversarial models that consider the specifics of real-world applications, and the design of machine learning algorithms resilient against a wide range of threats. In this talk, we describe our work on creating a taxonomy of poisoning attacks against machine learning systems at training time. In light of recent software supply chain vulnerabilities revealed by the SolarWinds attack, the supply chain of machine learning development needs to be protected. First, we introduce our optimization approach to create poisoning availability attacks against linear regression and discuss robust defenses based on techniques from robust statistics [1]. Then, we discuss how an attacker with minimal knowledge of a machine learning classifier can inject backdoor poisoning attacks, by leveraging techniques from machine learning explainability [4]. We demonstrate these methods on several malware classifiers and show the challenges of designing robust defenses to protect against these attacks. We also define a new attack model called subpopulation poisoning, that requires a small set of poisoning points to impact the accuracy of the model on a targeted subpopulation [2]. We evaluate our poisoning attacks on multiple data modalities, including image, text, and tabular data. Finally, we highlight a surprising connection between machine learning integrity and privacy attacks, and show how poisoning attacks can be used for auditing the privacy of machine learning algorithms such as differentially private stochastic gradient descent [3].

Analysis on Data Poisoning Attack Detection Using Machine Learning Techniques and Artificial Intelligence

Data Poisoning Attacks in Internet-of-Vehicle Networks: Taxonomy, State-of-The-Art, and Future Directions.

A Survey on Poisoning Attacks Against Supervised Machine Learning

Data Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses

Threats to Training: A Survey of Poisoning Attacks and Defenses on Machine Learning Systems

Poisoning Attacks and Data Sanitization Mitigations for Machine Learning Models in Network Intrusion Detection Systems

Poisoning attacks and countermeasures in intelligent networks: Status quo and prospects

Poisoning Attacks Against Machine Learning: Can Machine Learning Be Trustworthy?

Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning

Data Poisoning Attacks on Regression Learning and Corresponding Defenses

ML Attack Models: Adversarial Attacks and Data Poisoning Attacks

Analysis of Label-Flip Poisoning Attack on Machine Learning Based Malware Detector

Detecting Poisoning Attacks on Machine Learning in IoT Environments

Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detection

Poisoning Attacks on Machine Learning Models in Cyber Systems and Mitigation Strategies

Defending Against Adversarial Denial-of-Service Data Poisoning Attacks

Certified Defenses for Data Poisoning Attacks

Machine Learning Integrity and Privacy in Adversarial Environments

Data Poisoning Attack Against Anomaly Detectors in Digital Twin-Based Networks.

A Flexible Poisoning Attack Against Machine Learning.

Stronger Data Poisoning Attacks Break Data Sanitization Defenses