Adversarial Label Flips Attack on Support Vector Machines

By Han Xiao, Huang Xiao, Claudia Eckert. 2012

268 citations recorded by the source corpus.

To develop a robust classification algorithm in the adversarial setting, it is important to understand the adversary's strategy. We address the problem of label flips attack where an adversary contaminates the training set through flipping labels. By analyzing the objective of the adversary, we formulate an optimization framework for finding the label flips that maximize the classification error. An algorithm for attacking support vector machines is derived. Experiments demonstrate that the accuracy of classifiers is significantly degraded under the attack.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability, Statistical Learning Theory, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

In Statistical Learning Theory

In Signal Processing

Citations in the corpus

Certified Defenses for Data Poisoning Attacks (2017, background): “(2012) and later by a number of others (Xiao et al., 2012; 2015b; Newell et al., 2014; Mei and Zhu, 2015b; Burkard and Lagesse, 2017; Koh and Liang, 2017).”
Using Machine Teaching to Identify Optimal Training-Set Attacks on Machine Learners (2015, neutral): “Prior work in training-set attacks tends to utilize heuristic computational methods and lacks a unifying framework [27, 8, 24, 20, 26, 23].”
Support vector machines under adversarial label contamination (2015, methodology): “In this paper, we extend our work on adversarial label noise against SVMs [34, 35] by improving our previously-defined attacks (Sects.”
Generative Poisoning Attack Method Against Neural Networks (2017, methodology): “In the work, the entire parameter set of the original model is expressed as w ( o ) while w ( o ) k denotes only the parameters of layer k . ϕ () is the activation function, e.g., hyperbolic tangent (Tanh) or rectiﬁed linear unit (ReLU).”
SoK: Security and Privacy in Machine Learning (2018, background): “[57] fall under this class of approaches but derive the gradient ascent formulation differently, by relaxing a bilevel optimization problem (similarly to label flipping attacks like [39]).”
Data Poisoning Attacks Against Federated Learning Systems (2020, methodology): “Several poisoning attacks were developed for popular ML models including SVM [6,12,44,45,50,52], regression [19], dimensionality reduction [51], linear classifiers [12,23,57], unsupervised learning [7], and more recently, neural networks [12,30,42,45,53,58].”
Attacks on Machine Learning: Lurking Danger for Accountability (2019, methodology): “Attack [4] Convolutional Neural Network Supervised No Side-channel Attack [74] Training Data Extraction [18] Adversarial Examples [50, 52, 70] Recurrent Neural Network Supervised No Training Data Extraction [18] Classifier Evasion [3] Adversarial Examples [57] Support Vector Machine Supervised Yes/N”
Classification in the Presence of Label Noise: A Survey (2014, background): “in the food industry [13]–[16]) and maliciously induced by an adversary agent [17]–[26] is not considered.”
Robust Learning by Self-Transition for Handling Noisy Labels (2020, background): “In addition, data labels can be extremely complex even for experts [7] and adversarially manipulated by a label-flipping attack [41], thereby being vulnerable to label noise.”
Label-Consistent Backdoor Attacks (2019, background): “In these attacks, the adversary introduces outliers that force the model to learn a suboptimal decision boundary (Biggio et al., 2012; Xiao et al., 2012, 2015; Newell et al., 2014; Mei & Zhu, 2015; Steinhardt et al., 2017).”
A Comprehensive Survey on Poisoning Attacks and Countermeasures in Machine Learning (2022, background): “Similarly, the adversary in [134] aims to find a combination of label flips under a given budget so that the target model trained on such dataset will have maximal classification error.”
Datamodels: Predicting Predictions from Training Data (2022, background): “, brittleness to removing training examples) is substantively different than brittleness to mislabeling examples (as in label-flipping attacks (Koh & Liang, 2017; Xiao et al., 2012; Rosenfeld et al., 2020)).”
Machine Unlearning of Features and Labels (2021, background): “This attack strategy is more effective than inserting random labels and provides a performance degradation similar to other label-flip attacks [43, 62].”
On the Practicality of Integrity Attacks on Document-Level Sentiment Analysis (2014, background): “[34] extend this work by improving the adversarial label changing while additionally considering the effects on SVMs with non-linear kernel functions.”