ANTIDOTE: understanding and defending against poisoning of anomaly detectors

By Benjamin I. P. Rubinstein, Blaine Nelson, Ling Huang, Anthony D. Joseph, Shing-Hon Lau, Satish Rao, Nina Taft, J. Doug Tygar. 2009

428 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Safety, Robustness & Interpretability

Citations in the corpus

Towards the Science of Security and Privacy in Machine Learning (2016, background): “Rubinstein et al. [77] pull from robust statistics to build a PCA-based detection model robust to poisoning.”
Synthetic and Natural Noise Both Break Neural Machine Translation (2017, background): “The other side of the coin is to improve models’ robustness to adversarial examples (Globerson & Roweis, 2006; Cretu et al., 2008; Rubinstein et al., 2009; Chan et al., 2017).”
How To Backdoor Federated Learning (2018, background): “participated in training the model. 2 Related Work Attacks on training data. Traditional poisoning attacks compromise the training data to change a machine learning model’s behavior at inference time [2, 17, 34, 39]. Backdoor attacks change the model’s behavior only on speciﬁc adversary-chosen input”
Local Model Poisoning Attacks to Byzantine-Robust Federated Learning (2019, background): “Attacker’s goal: Like many studies on poisoning attacks [7, 8, 30, 33, 50, 62, 65], we consider an attacker’s goal is to manipulate the learnt global model such that it has a high error rate indiscriminately for testing examples.”
Attack of the Tails: Yes, You Really Can Backdoor Federated Learning (2020, methodology): “[52] study the effectiveness of such attacks in the context of a PCA-based anomaly detector and propose a defense based on techniques from robust statistics while Steinhardt et al.”
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks (2019, background): “Defenses against poisoning attack mostly focus on sanitizing the training set and removing poisoned samples [32], [33], [34], [35], [36], [37].”
Stronger data poisoning attacks break data sanitization defenses (2018, background): “s: data poisoning, data sanitization, anomaly detection, security 1. Introduction In high-stakes settings like autonomous driving (Gu et al., 2017), biometrics (Chen et al., 2017), and cybersecurity (Rubinstein et al., 2009; Suciu et al., 2018), it is crucial that . These authors contributed equally”
Mitigating Sybils in Federated Learning Poisoning (2018, background): “rrect) class label 7. overpower these honest clients and succeed in poisoning the model. Known defenses to poisoning attacks in a centralized context, such as robust losses [21] and anomaly detection [35], assume control of the clients or explicit observation of the training data. Neither of these a”
Certified Defenses for Data Poisoning Attacks (2017, background): “…data poisoning attacks; beyond linear classiﬁers, others have studied the LASSO (Xiao et al., 2015a), clustering (Biggio et al., 2013; 2014c), PCA (Rubinstein et al., 2009), topic modeling (Mei and Zhu, 2015a), collaborative ﬁltering (Li et al., 2016), neural networks (Yang et al., 2017), and…”
Stealing Machine Learning Models via Prediction APIs (2016, background): “In that context, a number of authors have considered strategies and defenses for poisoning attacks, that consist in injecting maliciously crafted samples into a model’s train or test data, so as to decrease the learned model’s accuracy [10,21,32,40,45].”
Biscotti: A Ledger for Private and Secure Peer-to-Peer Machine Learning (2018, methodology): “Similar to KRUM, AUROR [48] and ANTIDOTE [44] are alternative techniques to defend against poisoning that rely on anomaly detection.”
Machine Learning Models that Remember Too Much (2017, background): “Poisoning attacks [9, 18, 38, 57, 65] insert malicious data points into the training dataset to make the resulting model easier to evade.”
Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning (2018, methodology): “For instance, attackers can deliberately influence the training dataset to manipulate the results of a predictive model (in poisoning attacks [5], [40]–[42], [45], [47], [55]), cause misclassification of new data in the testing phase (in evasion attacks [3], [9], [21], [43], [44], [50], [51]) or inf”
Stealing Hyperparameters in Machine Learning (2018, background): “Existing studies have demonstrated poisoning attacks to worm signature generators [34], [41], [35], spam ﬁlters [31], [32], anomaly detectors [43], [24], SVMs [5], face recognition methods [4], as well as recommender systems [27], [57].”
Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization (2017, background): “Besides the extension and evaluation of this poisoning attack strategy to different deep learning architectures and nonparametric models, further research avenues include: the investigation of the existence of universal perturbations (not dependent on the initial attack point) for poisoning samples ”
Is Feature Selection Secure against Training Data Poisoning? (2015, methodology): “Work by Rubinstein et al. (2009) and Nelson et al. (2008) has shown the potential of poisoning attacks against PCAbased malicious traffic detectors and spam filters, and proposed robust techniques to mitigate their impact.”