Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
Cited by 216

The DOI matches its Crossref record; 5 of the 5 references it cites were found in a registry or an index.

Support vector machines under adversarial label contamination

Open access
Xiao, Huang, Biggio, Battista, Nelson, Blaine, Xiao, Han, Eckert, Claudia, Roli, Fabio·2015·Neurocomputing
DOI 10.1016/j.neucom.2014.08.081
Open this paper in CoChat — free account

Abstract

Machine learning algorithms are increasingly being applied in security-related tasks such as spam and malware detection, although their security properties against deliberate attacks have not yet been widely understood. Intelligent and adaptive attackers may indeed exploit specific vulnerabilities exposed by machine learning techniques to violate system security. Being robust to adversarial data manipulation is thus an important, additional requirement for machine learning algorithms to successfully operate in adversarial settings. In this work, we evaluate the security of Support Vector Machines (SVMs) to well-crafted, adversarial label noise attacks. In particular, we consider an attacker that aims to maximize the SVM?s classification error by flipping a number of labels in the training data. We formalize a corresponding optimal attack strategy, and solve it by means of heuristic approaches to keep the computational complexity tractable. We report an extensive experimental analysis on the effectiveness of the considered attacks against linear and non-linear SVMs, both on synthetic and real-world datasets. We finally argue that our approach can also provide useful insights for developing more secure SVM learning algorithms, and also novel techniques in a number of related research areas, such as semi-supervised and active learning.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1016/j.neucom.2014.08.081

Cites

5 of 5 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Show all 5 references

Research works printed but not linked: 34

  1. M. Barreno, B. Nelson, R. Sears, A.D. Joseph, J.D. Tygar, Can machine learning be secure? in: ASIACCS ׳06: Proceedings of the ACM Symposium on Information, Computer and Communication Security, ACM, NY, USA, 2006, pp. 16–25. · DOI · Paper page
  2. Barreno, 2010, The security of machine learning, Mach. Learn., 81, 121, 10.1007/s10994-010-5188-5 · DOI · Paper page
  3. Biggio, 2014, Security evaluation of pattern classifiers under attack, IEEE Trans. Knowl. Data Eng., 26, 984, 10.1109/TKDE.2013.57 · DOI · Paper page
  4. B. Nelson, M. Barreno, F.J. Chi, A.D. Joseph, B.I.P. Rubinstein, U. Saini, C. Sutton, J.D. Tygar, K. Xia, Exploiting machine learning to subvert your spam filter, in: 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats, USENIX Association, CA, USA, 2008, pp. 1–9.
  5. B. Nelson, M. Barreno, F. JackChi, A.D. Joseph, B.I.P. Rubinstein, U. Saini, C. Sutton, J.D. Tygar, K. Xia, Misleading learners: Co-opting your spam filter, in: Machine Learning in Cyber Trust, Springer US, 2009, pp. 17–51. · DOI
  6. B. Biggio, G. Fumera, F. Roli, L. Didaci, Poisoning adaptive biometric systems, in: G. Gimel׳farb, E. Hancock, A. Imiya, A. Kuijper, M. Kudo, S. Omachi, T. Windeatt, K. Yamada (Eds.), Structural, Syntactic, and Statistical Pattern Recognition, Lecture Notes in Computer Science, vol. 7626, Springer, Berlin, Heidelberg, 2012, pp. 417–425. · DOI
  7. B. Biggio, L. Didaci, G. Fumera, F. Roli, Poisoning attacks to compromise face templates, in: 6th IAPR International Conference on Biometrics, Madrid, Spain, 2013, pp. 1–7. · DOI
  8. M. Kloft, P. Laskov, Online anomaly detection under adversarial impact, in: 13th International Conference on Artificial Intelligence and Statistics, 2010, pp. 405–412.
  9. Kloft, 2012, Security analysis of online centroid anomaly detection, J. Mach. Learn. Res., 13, 3647
  10. B. Biggio, B. Nelson, P. Laskov, Poisoning attacks against support vector machines, in: J. Langford, J. Pineau (Eds.), 29th International Conference on Machine Learning, Omnipress, Edinburgh, Scotland, 2012.
  11. N. Dalvi, P. Domingos, Mausam, S. Sanghai, D. Verma, Adversarial classification, in: 10th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Seattle, 2004, pp. 99–108. · DOI · Paper page
  12. D. Lowd, C. Meek, Adversarial learning, in: A. Press (Ed.), Proceedings of the Eleventh ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), Chicago, IL, 2005, pp. 641–647. · DOI · Paper page
  13. Nelson, 2012, Query strategies for evading convex-inducing classifiers, J. Mach. Learn. Res., 13, 1293
  14. B. Biggio, I. Pillai, S.R. Bulò, D. Ariu, M. Pelillo, F. Roli, Is data clustering in adversarial settings secure?, in: Proceedings of the 2013 ACM Workshop on Artificial Intelligence and Security, ACM, NY, USA, 2013, pp. 87–98. · DOI
  15. Biggio, 2014, Poisoning complete-linkage hierarchical clustering, vol. 8621, 42
  16. A. Globerson, S.T. Roweis, Nightmare at test time: robust learning by feature deletion, in: W.W. Cohen, A. Moore (Eds.), Proceedings of the 23rd International Conference on Machine Learning, vol. 148, ACM, Pittsburgh, Pennsylvania, USA, 2006, pp. 353–360. · DOI · Paper page
  17. Brückner, 2012, Static prediction games for adversarial learning problems, J. Mach. Learn. Res., 13, 2617
  18. B. Biggio, G. Fumera, F. Roli, Design of robust classifiers for adversarial environments, in: IEEE International Conference on Systems, Man, and Cybernetics, 2011, pp. 977–982. · DOI
  19. Rodrigues, 2009, Robustness of multimodal biometric fusion methods against spoof attacks, J. Vis. Lang. Comput., 20, 169, 10.1016/j.jvlc.2009.01.010 · DOI
  20. A. Kolcz, C.H. Teo, Feature weighting for improved classifier robustness, in: 6th Conference on Email and Anti-Spam, Mountain View, CA, USA, 2009.
  21. B. Biggio, G. Fumera, F. Roli, Multiple classifier systems under attack, in: N.E. Gayar, J. Kittler, F. Roli (Eds.), 9th International Workshop on Multiple Classifier Systems, Lecture Notes in Computer Science, vol. 5997, Springer, Cairo, Egypt, 2010, pp. 74–83. · DOI
  22. Biggio, 2010, Multiple classifier systems for robust classifier design in adversarial environments, Int. J. Mach. Learn. Cybern., 1, 27, 10.1007/s13042-010-0007-7 · DOI · Paper page
  23. B. Biggio, I. Corona, G. Fumera, G. Giacinto, F. Roli, Bagging classifiers for fighting poisoning attacks in adversarial environments, in: C. Sansone, J. Kittler, F. Roli (Eds.), 10th International Workshop on Multiple Classifier Systems, Lecture Notes in Computer Science, vol. 6713, Springer-Verlag, Naples, Italy, 2011, pp. 350–359. · DOI
  24. Christmann, 2004, On robust properties of convex risk minimization methods for pattern recognition, J. Mach. Learn. Res., 5, 1007
  25. Kearns, 1993, Learning in the presence of malicious errors, SIAM J. Comput., 22, 807, 10.1137/0222052 · DOI · Paper page
  26. Frenay, 2014, Classification in the presence of label noise, IEEE Trans. Neural Netw. Learn. Syst., 35, 845, 10.1109/TNNLS.2013.2292894 · DOI · Paper page
  27. N. Bshouty, N. Eiron, E. Kushilevitz, Pac learning with nasty noise, in: O. Watanabe, T. Yokomori (Eds.), Algorithmic Learning Theory, Lecture Notes in Computer Science, vol. 1720, Springer, Berlin, Heidelberg, 1999, pp. 206–218. · DOI
  28. B. Biggio, B. Nelson, P. Laskov, Support vector machines under adversarial label noise, in: J. Mach. Learn. Res. – Proceedings of 3rd Asian Conference on Machine Learning, vol. 20, 2011, pp. 97–112.
  29. H. Xiao, H. Xiao, C.Eckert, Adversarial label flips attack on support vector machines, in: 20th European Conference on Artificial Intelligence, 2012. · DOI · Paper page
  30. G. Wang, T. Wang, H. Zheng, B.Y. Zhao, Man vs. machine: practical adversarial detection of malicious crowdsourcing workers, in: 23rd USENIX Security Symposium, USENIX Association, CA, 2014.
  31. C.P. Diehl, G. Cauwenberghs, SVM incremental learning, adaptation and optimization, in: International Journal Conference on Neural Networks, 2003, pp. 2685–2690. · DOI
  32. Scheinberg, 2006, An efficient implementation of an active set method for svms, J. Mach. Learn. Res., 7, 2237
  33. B. Nelson, B. Biggio, P. Laskov, Understanding the risk factors of learning in adversarial environments, in: 4th ACM Workshop on Artificial Intelligence and Security, AISec ׳11, Chicago, IL, USA, 2011, pp. 87–92. · doi:10.1145/2046684.2046698
  34. G. Stempfel, L. Ralaivola, Learning svms from sloppily labeled data, in: Proceedings of the 19th International Conference on Artificial Neural Networks: Part I, ICANN ׳09, Springer-Verlag, Berlin, Heidelberg, 2009, pp. 884–893. · DOI

Cited by

See all 216

Metadata

Authors
Xiao, H., Biggio, B., Nelson, B., Xiao, H., Eckert, C., & Roli, F.
Venue
Neurocomputing
Publisher
Elsevier BV
Published
2015-07
Volume
160
Pages
53-62
ISSN
0925-2312 (ISSN-L)
DOI
10.1016/j.neucom.2014.08.081
OpenAlex
W2107397716
Cited by
216
References
5
FWCI
11.57
Type
journal article
Language
en
Open access
green
Licence
  • www.elsevier.com/tdm/userlicense/1.0/ (tdm)
  • www.elsevier.com/legal/tdmrep-license (tdm)
Funders
  • Bundesministerium für Bildung und Forschung
  • Regione Autonoma della Sardegna

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

How to cite

Cite CoChat for the checks on this page, and the paper for its own findings.

This page
CoChat. (2026). Citation check: Support vector machines under adversarial label contamination. https://app.cochat.ai/papers/10.1016/j.neucom.2014.08.081
The paper
Xiao, H., Biggio, B., Nelson, B., Xiao, H., Eckert, C., & Roli, F. (2015). Support vector machines under adversarial label contamination. Neurocomputing. https://doi.org/10.1016/j.neucom.2014.08.081

Data sources

Bibliographic data: Semantic Scholar, OpenAlex, Crossref.

Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).

Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.