Misleading Learners: Co-opting Your Spam Filter

By Blaine Nelson, Marco Barreno, Fuching Jack Chi, Anthony D. Joseph, Benjamin I. P. Rubinstein, Udam Saini, Charles Sutton, J. Doug Tygar, Kai Xia. 2009

125 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Information Systems, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Information Systems

In Privacy & Security

Citations in the corpus

Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering (2018, neutral): “Defenses : General defenses against poisoning attacks on supervised learning methods were proposed by Nelson et al. (2009) and Baracaldo et al. (2017).”
Using Machine Teaching to Identify Optimal Training-Set Attacks on Machine Learners (2015, background): “Introduction The study on security threats to intelligent agents has a long history (Nelson et al. 2009; Tan, Killourhy, and Maxion 2002; Rubinstein et al. 2008; Barreno et al. 2010; Laskov and Lippmann 2010; Barreno et al. 2006; Dalvi et al. 2004; Liu and Chawla 2009; Biggio, Fumera, and Roli 2013;”
Stealing Hyperparameters in Machine Learning (2018, background): “Existing studies have demonstrated poisoning attacks to worm signature generators [34], [41], [35], spam filters [31], [32], anomaly detectors [43], [24], SVMs [5], face recognition methods [4], as well as recommender systems [27], [57].”
Adversarial Feature Selection Against Evasion Attacks (2016, background): “, a form of outlier detection) [6], [32], multiple classifier systems [33], and robust statistics [26].”
Support vector machines under adversarial label contamination (2015, background): “, a form of outlier detection) [5, 6, 28], multiple classifier systems [29], and robust statistics [7].”
Data Poisoning Attacks against Autoregressive Models (2016, background): “One canonical example is in the realm of spam detection (c.f., (Nelson et al. 2009) and (Lowd and Meek 2005)).”
Auror: defending against poisoning attacks in collaborative deep learning systems (2016, background): “Previous work has considered data sanitization to measure the negative impact of training dataset towards a trusted model [29, 32].”
Mitigating Poisoning Attacks on Machine Learning Models: A Data Provenance Based Approach (2017, methodology): “The closest related work is Reject On Negative Impact (RONI) methodology proposed by Nelson et al. in [13] and further enhanced in [15], where a calibration methodology to evaluate the performance of a model was included.”
Explicit Defense Actions Against Test-Set Attacks (2017, background): “, spam detection (Nelson et al. 2009; Lowd and Meek 2005), intrusion detection (Tan, Killourhy, and Maxion 2002)) and the attacker aims to have their bad (e.”
Unsupervised Learning Trojan (2014, methodology): “Some specific examples of the possible impact of this analysis are shown in the successful evasion of machine learning algorithms such as SpamBayes (Nelson et al., 2008, 2009).”
Behavior of Machine Learning Algorithms in Adversarial Environments (2010, result): “Portions of this dissertation have appeared in previously published works [Barreno et al., 2006, 2010, Nelson et al., 2008, 2009, 2010a, Rubinstein et al., 2009a].”
Analysis of Causative Attacks against SVMs Learning from Data Streams (2017, background): “The causative attack described in this paper has been further proven in a variety of applications such as spam ﬁlter-ing, network anomaly detection, and malware detection[8, 13, 10, 7].”
A Survey on Security Threats and Defensive Techniques of Machine Learning: A Data Driven View (2018, methodology): “For example, a Reject on Negative Impact (RONI) defensemethod was proposed to protect spam filters including SpamBayes,3 BogoFilter,4 the spam filter in Mozilla’s Thunderbird5 and the machine learning component of SpamAssassin6 [80].”
Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks (2019, background): “Existing works (which is primarily in multiclass classiﬁcation settings) aim to either detect stealing attacks (Juuti et al., 2019; Kesarwani et al., 2018; Nelson et al., 2009; Zheng et al., 2019) or perturb the posterior prediction.”
Adversarial machine learning (2019, methodology): “We now describe two attacks that we studied in prior work [47, 48, 57], and subsequently we discuss general perspectives and guidelines we developed for analyzing”
Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues (2013, background): “In other words, they should take into account how intrusive activities can evolve, and capture characteristics that are invariant with respect to such an evolution.”