Exploiting Machine Learning to Subvert Your Spam Filter

By Blaine Nelson, Marco Barreno, Fuching Jack Chi, Anthony D. Joseph, Benjamin I. P. Rubinstein, Udam Saini, Charles Sutton, J. Doug Tygar, Kai Xia. 2008

397 citations recorded by the source corpus.

Subfields: Safety, Robustness & Interpretability, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Safety, Robustness & Interpretability

In Privacy & Security

Citations in the corpus

Local Model Poisoning Attacks to Byzantine-Robust Federated Learning (2019, background): “, untargeted poisoning attacks [8, 30, 33, 50, 62, 65] and targeted poisoning attacks [3, 6, 13, 27, 37, 45, 51, 56].”
Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (2017, background): “Newsome et al. [82] devised an attack to mislead signature generation for malware detection; Nelson et al. [22] showed that spam ﬁlters can be compromised to misclassify legitimate email as spam, by learning spam emails containing good words during training; and Ru-binstein et al. [23] showed how…”
Mitigating Sybils in Federated Learning Poisoning (2018, background): “RONI [27] is ineffective in this setting since, at any given iteration, an honest gradient may update the model in an”
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks (2018, background): “Causative attacks, primarily using training data poisoning, soon followed, again targeting spam filtering [35] and network intrusion detection [11,12,36].”
Evasion Attacks against Machine Learning at Test Time (2013, methodology): “Machine learning is being increasingly used in security-sensitive applications such as spam filtering, malware detection, and network intrusion detection [3,5,9,11,14,15,16,19,21].”
Poisoning Attacks against Support Vector Machines (2012, methodology): “…the training data used by the learner; generally, an unrealistic assumption, but in real-world settings, an attacker could instead use a surrogate training set drawn from the same distribution (e.g., Nelson et al., 2008) and our approach yields a worstcase analysis of the attacker’s capabilities.”
Biscotti: A Ledger for Private and Secure Peer-to-Peer Machine Learning (2018, background): “Prior work has demonstrated that adversaries can attack the shared model through poisoning attacks [10, 40], in which an adversary contributes adversarial updates to influence shared model parameters.”
Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks (2018, background): “, 2012] or Bayesian classifiers [Nelson et al., 2008], poisoning attacks on Deep Neural Networks (DNN) have been rarely studied.”
When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attacks (2018, background): “For targeted poisoning, a spammer can trigger the filter against a specific legitimate email by crafting spam emails resembling the target [34].”
Stealing Hyperparameters in Machine Learning (2018, background): “Existing studies have demonstrated poisoning attacks to worm signature generators [34], [41], [35], spam filters [31], [32], anomaly detectors [43], [24], SVMs [5], face recognition methods [4], as well as recommender systems [27], [57].”
Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification (2017, background): “Various studies have demonstrated poisoning attacks to spam filter [16], support vector machines [1], deep neural networks [20], and recommender systems [10, 24].”
Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization (2017, background): “The first practical poisoning attacks against two-class classification algorithms have been proposed in [19, 26], in the context of spam filtering and anomaly detection.”
Is Feature Selection Secure against Training Data Poisoning? (2015, background): “…points into the training data to maximally compromise the output of the feature selection algorithm, or directly of the learning algorithm (Mei & Zhu, 2015; Biggio et al., 2012; Rubinstein et al., 2009; Nelson et al., 2008) (i.e., an availability, indiscriminate violation with causative influence).”
Practical Evasion of a Learning-Based Classifier: A Case Study (2014, background): “From an adversarial viewpoint, the more information about a learning-based system is available, the higher the chances become that the system can be successfully gamed.”
Security Evaluation of Pattern Classifiers under Attack (2014, methodology): “Many authors implicitly performed security evaluation as a what-if analysis, based on empirical simulation methods; however, they mainly focused on a specific application, classifier and attack, and devised ad hoc security evaluation procedures based on the exploitation of problem knowledge and heur”
On Security and Sparsity of Linear Classifiers for Adversarial Settings (2016, methodology): “For instance, the widely-used SpamAssassin anti-spam filter exploits a linear classifier [7,5].”