Good Word Attacks on Statistical Spam Filters

By Daniel Lowd, Christopher Meek. 2005

329 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Natural Language Processing

Citations in the corpus

Towards the Science of Security and Privacy in Machine Learning (2016, background): “During inference, an adversary might introduce positively connotated words in spam emails to evade detection, thus creating a test distribution different from the one analyzed during training [29].”
Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (2017, background): “, words typically occurring in legitimate emails, randomly guessed from a ref105 erence vocabulary) [21, 34, 44].”
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks (2018, background): “Many of the early attacks on machine learning were exploratory attacks on network and host-based intrusion detection systems [43,41,15,14] or spam filters [44,29,30,23].”
Stealing Machine Learning Models via Prediction APIs (2016, methodology): “The latter line of work, initiated by Lowd and Meek [36], studies strategies for model evasion, in the context of spam or fraud detectors [9, 29, 36, 37, 55].”
Using Machine Teaching to Identify Optimal Training-Set Attacks on Machine Learners (2015, neutral): “We formalize this intuition as a trade-off between the attacker’s effort EA and risk RA, to be defined below.”
Machine Learning Models that Remember Too Much (2017, background): “They were first explored in the context of spam detection [28, 50, 51].”
Practical Evasion of a Learning-Based Classifier: A Case Study (2014, background): “Recent work has also witnessed several innovative applications of machine learning for detection of various kinds of security violations, e.g., drive-by-downloads [3], [4], malicious web pages [5], [6], compromised accounts and fake identities in social networks [7], [8], unwanted P2P traffic [9]…”
Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers (2013, background): “Similarly, in [45, 58], the authors describe some statistical attacks against spam filters aimed at understanding message features that are not correctly classified by the filters.”
The security of machine learning (2010, methodology): “[2002], Lowd and Meek [2005a], Wittel and Wu [2004], Lowd and Meek [2005b] Moore et al.”
Security Evaluation of Pattern Classifiers under Attack (2014, neutral): “F”
On Security and Sparsity of Linear Classifiers for Adversarial Settings (2016, background): “Adding or removing a term amounts to switching the value of the corresponding Boolean feature [3,4,8,9,12].”
Adversarial Feature Selection Against Evasion Attacks (2016, background): “, by misspelling bad words like “cheap” as “che@p”), and the exploitation code embedded in malware samples and network packets [5], [7], [10]–[12], [14]–[19].”
Security Evaluation of Support Vector Machines in Adversarial Environments (2014, background): “Examples of causative attacks include work in [14, 38, 40, 52, 58], while exploratory attacks can be found in [26, 31, 41, 47, 66].”
Security analysis of online centroid anomaly detection (2010, methodology): “…in the context of specific security and spam detection applications (Lowd and Meek, 2005a; Fogla et al., 2006; Fogla and Lee, 2006; Perdisci et al., 2006; Newsome et al., 2006; Nelson et al., 2008), which has motivated a recent work on taxonomization of such attacks (Barreno et al., 2006, 2008).”
Data Poisoning Attacks against Autoregressive Models (2016, background): “One canonical example is in the realm of spam detection (c.f., (Nelson et al. 2009) and (Lowd and Meek 2005)).”
SoK: Security and Privacy in Machine Learning (2018, background): “During inference, an adversary might introduce positively connotated words in spam emails to evade detection, thus creating a test distribution different from the one analyzed during training [70].”
Adversarial Label Flips Attack on Support Vector Machines (2012, background): “For example, in an exploratory attack, the adversary disguises the spam by adding unrelated words to evade the spam filter [9, 10, 14].”