Support Vector Machines Under Adversarial Label Noise

By Battista Biggio, Blaine Nelson, Pavel Laskov. 2011

420 citations recorded by the source corpus.

Subfields: Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Safety, Robustness & Interpretability

Citations in the corpus

Towards the Science of Security and Privacy in Machine Learning (2016, methodology): “In a similar approach, Biggio et al. limit the vulnerability of SVMs to training label manipulations by adding a regularization term to the loss function, which in turn reduces the model sensitivity to out-of-diagonal kernel matrix elements [44].”
Understanding Black-box Predictions via Influence Functions (2017, background): “Our case study is email spam classiﬁcation, which relies graphic (e.g., age, race, gender), administrative (e.g., length of hospital stay), or medical (e.g., test results). on user-provided labels and is also vulnerable to adversarial attack (Biggio et al., 2011).”
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks (2015, background): “More generally, attacks against machine learning models can be partitioned by execution time: during training [43], [44] or at test time [14] when the model is used to make predictions.”
Stronger data poisoning attacks break data sanitization defenses (2018, background): “In a typical label-flip attack, the attacker gets to change some fraction of the labels y of the training set but is unable to change the features x (Biggio et al., 2011; Xiao et al., 2012, 2015).”
Mitigating Sybils in Federated Learning Poisoning (2018, methodology): “In a poisoning attack [6], [25], an adversary meticulously creates adversarial training examples and inserts them into the training data set of an attacked model.”
Practical Black-Box Attacks against Machine Learning (2016, methodology): “ssiﬁers built using machine learning techniques distinct from DNNs like tree ensembles [21], random forests [40], and SVMs [40]. It has been demonstrated that attacks can be executed at training time [9] and test time [10]. A framework for securing binary classiﬁers (e.g., logistic regression, SVM) ”
The Limitations of Deep Learning in Adversarial Settings (2015, background): “Generally speaking, attacks against machine learning can be separated into two categories, depending on whether they are executed during training [8], [9] or at test time [5].”
Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples (2016, critical): “Unlike us, previous work in this ﬁeld assumed knowledge of the model architecture and parameters [6, 14].”
Learning kernel logistic regression in the presence of class label noise (2014, background): “Comparison of the different kernel set size at 30% level, averaged over 20 random runs. comparison with SVM serves the purpose of a baseline, i.e. to see how far would the gold-standard off-the-shelf method allow one to treat label noise as a normal part of any classification problem.”
Support vector machines under adversarial label contamination (2015, methodology): “In this paper, we extend our work on adversarial label noise against SVMs [34, 35] by improving our previously-defined attacks (Sects.”
SoK: Security and Privacy in Machine Learning (2018, background): “[37] observe that poisoning points classified with confidence by the model later further degrades the model’s performance during inference.”
Adversarial Label Flips Attack on Support Vector Machines (2012, methodology): “Recently, a label flips strategy based on heuristics is proposed to attack support vector machines (SVMs) [2].”
Using Trusted Data to Train Deep Networks on Labels Corrupted by Severe Noise (2018, background): “Accordingly, modeling, correcting, and learning with noisy labels has been well studied [14, 1, 2].”
Multiple Kernel Learning from Noisy Labels by Stochastic Programming (2012, background): “Notably, we do NOT assume the label noise of different examples are independent, a common assumption shared by most existing studies on learning from noisy labels (Biggio et al., 2011; Yang et al., 2010).”
Part-dependent Label Noise: Towards Instance-dependent Label Noise (2020, background): “Label noise models Currently, there are three typical label noise models, i.e., the random classiﬁ-cation noise (RCN) model [8, 44, 42], the class-conditional label noise (CCN) model [50, 67, 79], and the instance-dependent label noise (IDN) model [6, 9, 12].”
Privacy and Robustness in Federated Learning: Attacks and Defenses (2020, background): “Attacks conducted during the training phase attempt to learn, influence, or corrupt the FL model itself [51].”
Adversarial Preprocessing: Understanding and Preventing Image-Scaling Attacks in Machine Learning (2020, methodology): “As we are interested in investigating different scaling ratios, we sample the images such that we obtain 120 images for each of the following five intervals of ratios: [2,3), [3,4), [4,5), [5,7.”