Is Feature Selection Secure against Training Data Poisoning?

By Huang Xiao, Battista Biggio, Gavin Brown, Giorgio Fumera, Claudia Eckert, Fabio Roli. 2015

445 citations recorded by the source corpus.

Learning in adversarial settings is becoming an important task for application domains where attackers may inject malicious data into the training set to subvert normal operation of data-driven technologies. Feature selection has been widely used in machine learning for security applications to improve generalization and computational efficiency, although it is not clear whether its use may be beneficial or even counterproductive when training data are poisoned by intelligent attackers. In this work, we shed light on this issue by providing a framework to investigate the robustness of popular feature selection methods, including LASSO, ridge regression and the elastic net. Our results on malware detection show that feature selection methods can be significantly compromised under attack (we can reduce LASSO to almost random choices of feature sets by careful insertion of less than 5% poisoned training samples), highlighting the need for specific countermeasures.

Subfields: Artificial Intelligence, Computer Networks and Communications, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Safety, Robustness & Interpretability

Citations in the corpus

Towards the Science of Security and Privacy in Machine Learning (2016, methodology): “Later, Xiao et al. adapted the gradient ascent strategy introduced in [46] to feature selection algorithms like LASSO [50].”
Local Model Poisoning Attacks to Byzantine-Robust Federated Learning (2019, background): “Attacker’s goal: Like many studies on poisoning attacks [7, 8, 30, 33, 50, 62, 65], we consider an attacker’s goal is to manipulate the learnt global model such that it has a high error rate indiscriminately for testing examples.”
Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (2017, methodology): “This background paved the way to subsequent work that formalized poisoning attacks against more complex learning algorithms (including SVMs, ridge regression, and LASSO) as bilevel optimization problems [26, 29, 31].”
Data Poisoning against Differentially-Private Learners: Attacks and Defenses (2019, background): “[Biggio et al., 2012; Mei and Zhu, 2015; Xiao et al., 2015]) because the differentially-private learner produces a stochastic model, so the objective takes the expected value of C.”
Analyzing Federated Learning through an Adversarial Lens (2018, background): “…on an adversary which directly performs model poisoning instead of data poisoning (Biggio et al., 2012; Rubinstein et al., 2009; Mei & Zhu, 2015; Xiao et al., 2015; Mei & Zhu, 2015; Koh & Liang, 2017; Chen et al., 2017a; Jagielski et al., 2018) as the agents’ data is never shared with the…”
Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning (2017, methodology): “After presenting the details of the threat model above, we emphasize again the differences between this work and a long line of existing work studying poisoning attacks and defenses [10], [38], [12], [11], [68], [44], [9], [35], [70], [39], [61].”
Certified Defenses for Data Poisoning Attacks (2017, methodology): “Our contribution relates to the long line of work on data poisoning attacks; beyond linear classiﬁers, others have studied the LASSO (Xiao et al., 2015a), clustering (Biggio et al., 2013; 2014c), PCA (Rubinstein et al., 2009), topic modeling (Mei and Zhu, 2015a), collaborative ﬁltering (Li et al.,…”
Model-Reuse Attacks on Deep Learning Systems (2018, background): “(i) Poisoning attacks, in which the adversary pollutes the training data to eventually compromise the ML systems [9, 41, 61, 62].”
Attacking Graph-based Classification via Manipulating the Graph Structure (2019, background): “ne learning for non-graph data. In particular, studies have demonstrated that machine learning is vulnerable to adversarial examples [6, 12, 28, 31, 35, 42, 45, 48, 53, 55, 58, 71], poisoning attacks [7, 19, 32, 39, 70, 73], privacy attacks for users (e.g., model inversion attacks [20, 21], membersh”
Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization (2017, methodology): “In a poisoning attack, the attacker is assumed to control a fraction of the training data used by the learning algorithm, with the goal of subverting the entire learning process, or facilitate subsequent system evasion [8, 19, 23, 25, 32, 39].”
Data Poisoning Attacks on Factorization-Based Collaborative Filtering (2016, methodology): “The key optimization technique is to approximately compute implicit gradients of the solution of an optimization problem based on first-order KKT conditions.”
Adversarial Detection of Flash Malware: Limitations and Open Issues (2017, background): “In the remainder of this work we focus on classiﬁer evasion , while we refer the reader to [11], [22], [23], [35] for further details on classiﬁer poisoning .”
Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection (2017, background): “quently cause misclassification errors [7], [11], [25], [32], [34], [42], [43], [44], [45].”
On Security and Sparsity of Linear Classifiers for Adversarial Settings (2016, methodology): “…using the Elastic-net SVM. Finally, we think that an interesting extension of our work may be to investigate the trade-oﬀ between sparsity and security also in the context of classiﬁer poisoning (in which the attacker can contaminate the training data to mislead classiﬁer learning) [9,26,27].”
Adversarial Examples: Attacks and Defenses for Deep Learning (2017, background): “, training data poisoning) is another interesting topic and has been studied in [8], [16], [21], [98], [112], [142].”
ActiveClean: An Interactive Data Cleaning Framework For Modern Machine Learning (2016, background): “While data cleaning is an extensively studied problem, the high dimensionality of many models can amplify even a small amount of erroneous records [13], and the relative complexity (in comparison to SQL analytics) can make it difficult to trace the consequences of data error.”