Efficient Label Contamination Attacks Against Black-Box Learning Models

By Mengchen Zhao, Bo An, Wei Gao, Teng Zhang. 2017

74 citations recorded by the source corpus.

Label contamination attack (LCA) is an important type of data poisoning attack where an attacker manipulates the labels of training data to make the learned model beneficial to him. Existing work on LCA assumes that the attacker has full knowledge of the victim learning model, whereas the victim model is usually a black-box to the attacker. In this paper, we develop a Projected Gradient Ascent (PGA) algorithm to compute LCAs on a family of empirical risk minimizations and show that an attack on one victim model can also be effective on other victim models. This makes it possible that the attacker designs an attack against a substitute model and transfers it to a black-box victim model. Based on the observation of the transferability, we develop a defense algorithm to identify the data points that are most likely to be attacked. Empirical studies show that PGA significantly outperforms existing baselines and linear learning models are better substitute models than nonlinear ones.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Data Poisoning Attacks Against Federated Learning Systems (2020, methodology): “Several poisoning attacks were developed for popular ML models including SVM [6,12,44,45,50,52], regression [19], dimensionality reduction [51], linear classifiers [12,23,57], unsupervised learning [7], and more recently, neural networks [12,30,42,45,53,58].”
Data Poisoning Attacks on Multi-Task Relationship Learning (2018, methodology): “Inspired by (Li et al. 2016; Mei and Zhu 2015b; Xiao et al. 2015; Zhao et al. 2017), we use a projected gradient ascent method to solve our proposed bilevel problem.”
A Comprehensive Survey on Poisoning Attacks and Countermeasures in Machine Learning (2022, methodology): “[156] investigated efficient label manipulation method and its transferability against black-box models.”
On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shaping (2020, background): “Some scenarios consider limited knowledge of an attacker about the training data or the target model [22,29,49]; however, the attacker can exploit transferability to compute poisons by using auxiliary training data or surrogate models.”
A Survey on Security Threats and Defensive Techniques of Machine Learning: A Data Driven View (2018, background): “For example, in label contamination attack (LCA) [50], an attacker can significantly reduce the performance of SVM by flipping the labels of some training data.”
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses (2020, background): “[59] show that a projected gradient ascent approach to label flipping is effective in performing targeted or untargeted attacks even against black-box linear models ranging from SVM to logistic regression and LS-SVM.”