A Survey on Security Threats and Defensive Techniques of Machine Learning: A Data Driven View
Open accessAbstract
Machine learning is one of the most prevailing techniques in computer science, and it has been widely applied in image processing, natural language processing, pattern recognition, cybersecurity, and other fields. Regardless of successful applications of machine learning algorithms in many scenarios, e.g., facial recognition, malware detection, automatic driving, and intrusion detection, these algorithms and corresponding training data are vulnerable to a variety of security threats, inducing a significant performance decrease. Hence, it is vital to call for further attention regarding security threats and corresponding defensive techniques of machine learning, which motivates a comprehensive survey in this paper. Until now, researchers from academia and industry have found out many security threats against a variety of learning algorithms, including naive Bayes, logistic regression, decision tree, support vector machine (SVM), principle component analysis, clustering, and prevailing deep neural networks. Thus, we revisit existing security threats and give a systematic survey on them from two aspects, the training phase and the testing/inferring phase. After that, we categorize current defensive techniques of machine learning into four groups: security assessment mechanisms, countermeasures in the training phase, those in the testing or inferring phase, data security, and privacy. Finally, we provide five notable trends in the research on security threats and defensive techni…
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Liu et al summarize defense techniques in the training phase and the testing and inferring phase of the life cycle of machine learning, for example, data sanitization techniques against data poisoning attacks in the training phase and privacy-preserving techniques against privacy attacks in the testing or inferring phase.
“They also summarize the defense techniques in the training phase and the testing and inferring phase of the life cycle of machine learning, for example, data sanitization techniques against data poisoning attacks in the training phase and privacy-preserving techniques against privacy attacks in the testing or inferring phase.”
From Generative AI in medical practice: in-depth exploration of privacy and security challenges (2024) · cites this paper as [56]
The taxonomy classifies attacks into three categories: attacks targeting classifiers; attacks violating integrity, availability, and privacy; and attacks with or without specificity.
“The taxonomy classifies those attacks into three categories: (1) attacks targeting classifiers; (2) attacks violating integrity, availability, and privacy (ie, part of confidentiality); and (3) attacks with or without specificity.”
From Generative AI in medical practice: in-depth exploration of privacy and security challenges (2024) · cites this paper as [56]
Liu et al surveyed the security and privacy attacks related to machine learning and developed a taxonomy.
“Liu et al [56] surveyed the security and privacy attacks related to machine learning and developed a taxonomy.”
From Generative AI in medical practice: in-depth exploration of privacy and security challenges (2024) · cites this paper as [56]
Cites
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381 · see citing works
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
The Limitations of Deep Learning in Adversarial Settings
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., & Swami, A. (2016) · 2016 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2016.36 · Cited by 3,993 · see citing works
Universal Adversarial Perturbations
Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., & Frossard, P. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.17 · Cited by 2,680 · see citing works
RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response
Erlingsson, Ú., Pihur, V., & Korolova, A. (2014) · Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2660267.2660348 · Cited by 1,838 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security
Al-Garadi, M. A., Mohamed, A., Al-Ali, A. K., Du, X., Ali, I., & Guizani, M. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2988293 · Cited by 1,392 · see citing works
Generative AI in medical practice: in-depth exploration of privacy and security challenges
Chen, Y., & Esmaeilzadeh, P. (2024) · Journal of Medical Internet Research · doi:10.2196/53008 · Cited by 353 · see citing works
“Liu et al [56] surveyed the security and privacy attacks related to machine learning and developed a taxonomy.”
InfluentialThe relationship between trust in AI and trustworthy machine learning technologies
Toreini, E., Aitken, M., Coopamootoo, K., Elliott, K., Zelaya, C. G., & van Moorsel, A. (2020) · Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency · doi:10.1145/3351095.3372834 · Cited by 296 · see citing works
State-of-the-Art and Research Opportunities for Next-Generation Consumer Electronics
Wu, C. K., Cheng, C.-T., Uwate, Y., Chen, G., Mumtaz, S., & Tsang, K. F. (2023) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2022.3232478 · Cited by 227 · see citing works
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks
Doan, K., Lao, Y., Zhao, W., & Li, P. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01175 · Cited by 211 · see citing works
Self-citationCIoT-Net: a scalable cognitive IoT based smart city network architecture
Park, J.-H., Salim, M. M., Jo, J. H., Sicato, J. C. S., Rathore, S., & Park, J. H. (2019) · Human-centric Computing and Information Sciences · doi:10.1186/s13673-019-0190-9 · Cited by 121 · see citing works
Privacy and Security of Big Data in AI Systems: A Research and Standards Perspective
Dilmaghani, S., Brust, M. R., Danoy, G., Cassagnes, N., Pecero, J., & Bouvry, P. (2019) · 2019 IEEE International Conference on Big Data (Big Data) · doi:10.1109/bigdata47090.2019.9006283 · Cited by 111 · see citing works
Anomaly Detection for Cyber-Security Based on Convolution Neural Network : A survey
Alabadi, M., & Celik, Y. (2020) · 2020 International Congress on Human-Computer Interaction, Optimization and Robotic Applications (HORA) · doi:10.1109/hora49412.2020.9152899 · Cited by 55 · see citing works
Challenges and efforts in managing AI trustworthiness risks: a state of knowledge
Polemi, N., Praça, I., Kioskli, K., & Bécue, A. (2024) · Frontiers in Big Data · doi:10.3389/fdata.2024.1381163 · Cited by 46 · see citing works
- Authors
- Liu, Q., Li, P., Zhao, W., Cai, W., Yu, S., & Leung, V. C. M.
- Affiliations
- National University of Defense Technology (CN)
- University of British Columbia (CA)
- Deakin University (AU)
- Venue
- IEEE Access
- Published
- 2018
- Volume
- 6
- Pages
- 12103-12117
- ISSN
- 2169-3536 (ISSN-L)
- OpenAlex
- W2791319131
- Cited by
- 421
- References
- 6
- Citations by year
- 2026: 16 · 2025: 47 · 2024: 40 · 2023: 60 · 2022: 54 · 2021: 59 · 2020: 74 · 2019: 56 · 2018: 14 · 2012: 1
- FWCI
- 28.41
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Locations
- IEEE Access (publishedVersion)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Figshare (submittedVersion, cc-by)
- UTS ePRESS (University of Technology Sydney) (submittedVersion)
- Funders
- National Natural Science Foundation of China (61702539, 61728201)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- machine learning security, adversarial attacks, security threats, defensive techniques, data security, privacy preservation, deep neural network, support vector machine, decision tree, naive Bayes, logistic regression, principal component analysis
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
