Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
Open accessAbstract
As machine learning becomes widely used for automated decisions, attackers have strong incentives to manipulate the results and models generated by machine learning algorithms. In this paper, we perform the first systematic study of poisoning attacks and their countermeasures for linear regression models. In poisoning attacks, attackers deliberately influence the training data to manipulate the results of a predictive model. We propose a theoretically-grounded optimization framework specifically designed for linear regression and demonstrate its effectiveness on a range of datasets and models. We also introduce a fast statistical attack that requires limited knowledge of the training process. Finally, we design a new principled defense method that is highly resilient against all poisoning attacks. We provide formal guarantees about its convergence and an upper bound on the effect of poisoning attacks when the defense is deployed. We evaluate extensively our attacks and defenses on three realistic datasets from health care, loan assessment, and real estate domains.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Persistent, self-modifying memory introduces risks of silent state corruption, where malicious logic can propagate across future reasoning steps without clear provenance.
“Persistent, self-modifying memory further introduces risks of silent state corruption, where malicious logic can propagate across future reasoning steps without clear provenance (Jagielski et al., 2018;Li et al., 2022;Steinberger, Peter, 2025b).”
From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Jagielski et al., 2018
The Introduction says attackers can poison data used to update models, and the Adversarial model section says this can corrupt a model and alter its later predictions. The paper addresses regression learning, not persistent self-modifying memory; it does not establish propagation of malicious logic across reasoning steps or a lack of provenance. (LLM, conf=0.86)
Experimental — accuracy not yet measuredAnother detection-based defense mechanism uses Euclidean distance to expose any deviation in the model update parameters for each client.
“Another detection-based defense mechanism uses euclidean distance to expose any deviation in the model update parameters for each client [90].”
From Vulnerabilities in federated learning (2021) · cites this paper as [90]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
The Elements of Statistical Learning
Hastie, T., Tibshirani, R., & Friedman, J. (2009) · Springer Series in Statistics · doi:10.1007/978-0-387-84858-7 · Cited by 25,970 · see citing works
Fischler, M. A., & Bolles, R. C. (1981) · Communications of the ACM · doi:10.1145/358669.358692 · Cited by 25,893 · see citing works
The Elements of Statistical Learning: Data Mining, Inference, and Prediction
Lu, Z. Q. J. (2010) · Journal of the Royal Statistical Society Series A (Statistics in Society) · doi:10.1111/j.1467-985x.2010.00646_6.x · Cited by 12,904 · see citing works
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381 · see citing works
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859 · see citing works
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143 · see citing works
Robust estimation of a location parameter
Huber, P. J. (1964) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177703732 · Cited by 7,228 · see citing works
Robust principal component analysis?
Candès, E. J., Li, X., Ma, Y., & Wright, J. N. (2011) · Journal of the ACM · doi:10.1145/1970392.1970395 · Cited by 6,914 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
The Limitations of Deep Learning in Adversarial Settings
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., & Swami, A. (2016) · 2016 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2016.36 · Cited by 3,993 · see citing works
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks
Papernot, N., McDaniel, P. D., Wu, X., Jha, S., & Swami, A. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.41 · Cited by 3,123 · see citing works
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961 · see citing works
Evasion attacks against machine learning at test time
Biggio, B., Corona, I., Maiorca, D., Nelson, B. A., Srndic, N., Laskov, P., Giacinto, G., & Roli, F. (2013) · Cited by 1,658 · see citing works
Self-citationWild patterns: Ten years after the rise of adversarial machine learning
Biggio, B., & Roli, F. (2018) · Pattern Recognition · doi:10.1016/j.patcog.2018.07.023 · Cited by 1,563 · see citing works
Self-citationPoisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331 · see citing works
Self-citationHuang, L., Joseph, A. D., Nelson, B., Rubinstein, B. I. P., & Tygar, J. D. (2011) · Proceedings of the 4th ACM workshop on Security and artificial intelligence · doi:10.1145/2046684.2046692 · Cited by 1,194 · see citing works
Dalvi, N. N., Domingos, P. M., Mausam, Sanghai, S. K., & Verma, D. (2004) · Knowledge Discovery and Data Mining · doi:10.1145/1014052.1014066 · Cited by 1,085 · see citing works
BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
Gu, T., Dolan-Gavitt, B., & Garg, S. (2017) · arXiv · doi:10.48550/arxiv.1708.06733 · Cited by 1,061 · see citing works
Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
Chen, X., Liu, C., Li, B., Lu, K., & Song, D. (2017) · arXiv · doi:10.48550/arxiv.1712.05526 · Cited by 1,039 · see citing works
Self-citationCan machine learning be secure?
Barreno, M., Nelson, B. A., Sears, R., Joseph, A. D., & Tygar, J. D. (2006) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/1128817.1128824 · Cited by 852 · see citing works
Lowd, D., & Meek, C. (2005) · Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining · doi:10.1145/1081870.1081950 · Cited by 755 · see citing works
Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing.
Fredrikson, M., Lantz, E., Jha, S., Lin, S. M., Page, D., & Ristenpart, T. (2014) · PubMed · Cited by 658 · see citing works
Information geometry and alternating minimization procedures
Csiszár, I. (1984) · Medical Entomology and Zoology · Cited by 596 · see citing works
Huber, P. J. (2011) · International Encyclopedia of Statistical Science · doi:10.1007/978-3-642-04898-2_594 · Cited by 596 · see citing works
Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization
Muñoz-González, L., Biggio, B., Demontis, A., Paudice, A., Wongrassamee, V., Lupu, E. C., & Roli, F. (2017) · Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security · doi:10.1145/3128572.3140451 · Cited by 549 · see citing works
Self-citationSecurity Evaluation of Pattern Classifiers under Attack
Biggio, B., Fumera, G., & Roli, F. (2013) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2013.57 · Cited by 412 · see citing works
Self-citationSystematic Poisoning Attacks on and Defenses for Machine Learning in Healthcare
Kermani, M. M., Sur‐Kolay, S., Raghunathan, A., & Jha, N. K. (2014) · IEEE Journal of Biomedical and Health Informatics · doi:10.1109/jbhi.2014.2344095 · Cited by 383 · see citing works
Using Machine Teaching to Identify Optimal Training-Set Attacks on Machine Learners
Mei, S., & Zhu, X. (2015) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v29i1.9569 · Cited by 346 · see citing works
Learning in the Presence of Malicious Errors
Kearns, M. J., & Li, M. (1993) · SIAM Journal on Computing · doi:10.1137/0222052 · Cited by 340 · see citing works
Practical Evasion of a Learning-Based Classifier: A Case Study
Šrndić, N., & Laskov, P. (2014) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2014.20 · Cited by 340 · see citing works
ANTIDOTE: understanding and defending against poisoning of anomaly detectors
Rubinstein, B. I. P., Nelson, B., Huang, L., Joseph, A. D., Lau, S.-H., Rao, S., Taft, N., & Tygar, J. D. (2009) · Proceedings of the 9th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1644893.1644895 · Cited by 331 · see citing works
Exploiting machine learning to subvert your spam filter
Nelson, B. A., Barreno, M., Chi, F. J., Joseph, A. D., Rubinstein, B. I. P., Saini, U., Sutton, C. A., Tygar, J. D., & Xia, K. (2008) · Cited by 322 · see citing works
Is feature selection secure against training data poisoning?Preprint
Huang, X. X., Biggio, B., Gavin Brown, B., Fumera, G., Eckert, C. M., & Roli, F. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1804.07933 · Cited by 314 · see citing works
Self-citationXu, H., Caramanis, C., & Mannor, S. (2010) · IEEE Transactions on Information Theory · doi:10.1109/tit.2010.2048503 · Cited by 237 · see citing works
Data poisoning attacks on factorization-based collaborative filtering
Li, B., Wang, Y., Singh, A., & Vorobeychik, Y. (2016) · arXiv · doi:10.48550/arxiv.1608.08182 · Cited by 235 · see citing works
Self-citationCasting out Demons: Sanitizing Training Data for Anomaly Sensors
Cretu, G. F., Stavrou, A., Locasto, M. E., Stolfo, S. J., & Keromytis, A. D. (2008) · 2008 IEEE Symposium on Security and Privacy (sp 2008) · doi:10.1109/sp.2008.11 · Cited by 226 · see citing works
Data Poisoning Attacks against Autoregressive Models
Alfeld, S., Zhu, X., & Barford, P. (2016) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v30i1.10237 · Cited by 205 · see citing works
Paragraph: Thwarting Signature Learning by Training Maliciously
Newsome, J., Karp, B., & Song, D. X. (2006) · Lecture notes in computer science · doi:10.1007/11856214_5 · Cited by 200 · see citing works
Misleading worm signature generators using deliberate noise injection
Roberto Perdisci, A., Dagon, D., Lee, W., Fogla, P., & Sharif, M. (2006) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2006.26 · Cited by 189 · see citing works
Man vs. machine: practical adversarial detection of malicious crowdsourcing workers
Wang, G., Wang, T., Zhang, H., & Zhao, B. Y. (2014) · Cited by 142 · see citing works
Robust Logistic Regression and Classification
Feng, J., Xu, H., Mannor, S., & Yan, S. (2014) · neural information processing systems · Cited by 118 · see citing works
Robust Sparse Regression under Adversarial Corruption
Chen, Y., Caramanis, C., & Mannor, S. (2013) · Cited by 89 · see citing works
Robust Linear Regression Against Training Data Poisoning
Liu, C., Li, B., Vorobeychik, Y., & Oprea, A. (2017) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3128572.3140447 · Cited by 84 · see citing works
Self-citationSecurity Analysis of Online Centroid Anomaly DetectionPreprint
Kloft, M., & Laskov, P. (2010) · arXiv (Cornell University) · doi:10.48550/arxiv.1003.0078 · Cited by 83 · see citing works
Robust Statistics: Theory and Methods
Tyler, D. E. (2008) · Journal of the American Statistical Association · doi:10.1198/jasa.2008.s239 · Cited by 82 · see citing works
The Security of Latent Dirichlet Allocation
Mei, S., & Zhu, X. (2015) · Cited by 53 · see citing works
Limits of Learning-Based Signature Generation with Adversaries
Venkataraman, S., Blum, A. L., & Song, D. X. (2018) · Figshare · doi:10.1184/r1/6468965 · Cited by 51 · see citing works
On the Practicality of Integrity Attacks on Document-Level Sentiment Analysis
Newell, A., Potharaju, R., Xiang, L., & Nita-Rotaru, C. (2014) · doi:10.1145/2666652.2666661 · Cited by 46 · see citing works
Self-citationRobust High Dimensional Sparse Regression and Matching PursuitPreprint
Chen, Y., Caramanis, C., & Mannor, S. (2013) · arXiv (Cornell University) · doi:10.48550/arxiv.1301.2725 · Cited by 11 · see citing works
The dawn of artificial intelligence?
(2007) · Strategic Direction · doi:10.1108/02580540710724500 · Cited by 6 · see citing works
Flagged first, then by citations
2 of the 52 references couldn’t be matched to a known paper.
Research works printed but not linked: 1
- S. Hao, A. Kantchelian, B. Miller, V. Paxson, and N. Feamster. PREDA- TOR: Proactive recognition and elimination of domain abuse at time-of- registration. In Proceedings of the 23rd ACM Conference on Computer and Communications Security, CCS, 2016.
Cited by
Sorted by citations
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,486 · see citing works
Wild patterns: Ten years after the rise of adversarial machine learning
Biggio, B., & Roli, F. (2018) · Pattern Recognition · doi:10.1016/j.patcog.2018.07.023 · Cited by 1,563 · see citing works
Self-citationA survey on security and privacy of federated learning
Mothukuri, V., Parizi, R. M., Pouriyeh, S., Huang, Y., Dehghantanha, A., & Srivastava, G. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2020.10.007 · Cited by 1,480 · see citing works
Data Poisoning Attacks Against Federated Learning Systems
Tolpegin, V., Truex, S., Gursoy, M. E., & Liu, L. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58951-6_24 · Cited by 927 · see citing works
Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
Fang, M., Cao, X., Jia, J., & Gong, N. Z. (2019) · arXiv · doi:10.48550/arxiv.1911.11815 · Cited by 828 · see citing works
Machine learning pipeline for battery state-of-health estimation
Roman, D., Saxena, S., Robu, V., PECHT, M. G., & Flynn, D. (2021) · Nature Machine Intelligence · doi:10.1038/s42256-021-00312-3 · Cited by 689 · see citing works
Challenges in deploying machine learning: A survey of case studies
Paleyes, A., Urma, R.-G., & Lawrence, N. D. (2023) · ACM Computing Surveys · doi:10.1145/3533378 · Cited by 638 · see citing works
Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., & Backes, M. (2019) · Proceedings 2019 Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23119 · Cited by 852 · see citing works
Privacy and Robustness in Federated Learning: Attacks and Defenses
Lyu, L., Yu, H., Ma, X., Chen, C., Sun, L., Zhao, J., Yang, Q., & Yu, P. S. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3216981 · Cited by 548 · see citing works
ABS: Scanning Neural Networks for Back-doors by Artificial Brain Stimulation
Liu, Y., Lee, W., Tao, G., Ma, S., Aafer, Y., & Zhang, X. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363216 · Cited by 419 · see citing works
Machine Learning for Predicting Epileptic Seizures Using EEG Signals: A Review
Rasheed, K., Qayyum, A., Qadir, J., Sivathamboo, S., Kwan, P., Kuhlmann, L., O'Brien, T. J., & Razi, A. (2020) · IEEE Reviews in Biomedical Engineering · doi:10.1109/rbme.2020.3008792 · Cited by 417 · see citing works
Privacy preservation in federated learning: An insightful survey from the GDPR perspective
Truong, N., Sun, K., Wang, S., Guitton, F., & Guo, Y. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102402 · Cited by 399 · see citing works
ShieldFL: Mitigating Model Poisoning Attacks in Privacy-Preserving Federated Learning
Ma, Z., Ma, J., Miao, Y., Li, Y., & Deng, R. H. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3169918 · Cited by 371 · see citing works
Latent Backdoor Attacks on Deep Neural Networks
Yao, Y., Li, H., Zheng, H.-T., & Zhao, B. Y. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354209 · Cited by 370 · see citing works
Biscotti: A blockchain system for private and secure federated learning
Shayan, M., Fung, C., Yoon, C. J. M., & Beschastnikh, I. (2021) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2020.3044223 · Cited by 354 · see citing works
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., & Goldstein, T. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3162397 · Cited by 362 · see citing works
Self-citationChained Anomaly Detection Models for Federated Learning: An Intrusion Detection Case Study
Preuveneers, D., Rimmer, V., Tsingenopoulos, I., Spooren, J., Joosen, W., & Ilie-Zudor, E. (2018) · Applied Sciences · doi:10.3390/app8122663 · Cited by 323 · see citing works
Stahl, B. C. (2021) · Repository@Nottingham (University of Nottingham) · doi:10.1007/978-3-030-69978-9 · Cited by 71 · see citing works
Introduction to Computer Security
Mammeri, Z. (2024) · Cryptography · doi:10.1002/9781394207510.ch1 · Cited by 310 · see citing works
PoisonGAN: Generative Poisoning Attacks Against Federated Learning in Edge Computing Systems
Zhang, J., Chen, B., Cheng, X., Binh, H. T. T., & Yu, S. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3023126 · Cited by 291 · see citing works
A Comprehensive Survey on Poisoning Attacks and Countermeasures in Machine Learning
Tian, Z., Cui, L., Liang, J., & Yu, S. (2022) · ACM Computing Surveys · doi:10.1145/3551636 · Cited by 277 · see citing works
Shejwalkar, V., Houmansadr, A., Kairouz, P., & Ramage, D. (2022) · 2022 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp46214.2022.9833647 · Cited by 292 · see citing works
Trusting artificial intelligence in cybersecurity is a double-edged sword
Taddeo, M., McCutcheon, T., & Floridi, L. (2019) · Nature Machine Intelligence · doi:10.1038/s42256-019-0109-1 · Cited by 260 · see citing works
Vulnerabilities in federated learning
Bouacida, N., & Mohapatra, P. (2021) · IEEE Access · doi:10.1109/access.2021.3075203 · Cited by 248 · see citing works
AI-Based Intrusion Detection Systems for In-Vehicle Networks: A Survey
Rajapaksha, S., Kalutarage, H., Al-Kadri, M. O., Petrovski, A., Madzudzo, G., & Cheah, M. (2022) · ACM Computing Surveys · doi:10.1145/3570954 · Cited by 260 · see citing works
NIC: Detecting Adversarial Samples with Neural Network Invariant Checking
Ma, S., Liu, Y., Tao, G., Lee, W., & Zhang, X. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23415 · Cited by 247 · see citing works
Privacy Risks of Securing Machine Learning Models against Adversarial Examples
Song, L., Shokri, R., & Mittal, P. (2019) · Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3319535.3354211 · Cited by 229 · see citing works
Dynamic Backdoor Attacks Against Machine Learning Models
Salem, A., Wen, R., Michael Backes, A., Ma, S., & Zhang, Y. (2022) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp53844.2022.00049 · Cited by 227 · see citing works
Poisoning Attack in Federated Learning using Generative Adversarial Nets
Zhang, J., Chen, J., Wu, D., Chen, B., & Yu, S. (2019) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom/bigdatase.2019.00057 · Cited by 216 · see citing works
Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning AttacksPreprint
Demontis, A., Melis, M., Pintor, M., Jagielski, M., Biggio, B., Oprea, A., Nita-Rotaru, C., & Roli, F. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.02861 · Cited by 219 · see citing works
Self-citationVFChain: Enabling Verifiable and Auditable Federated Learning via Blockchain Systems
Peng, Z., Xu, J., Chu, X., Gao, S., Yao, Y., Gu, R., & Tang, Y. (2021) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2021.3050781 · Cited by 219 · see citing works
A Survey on Cyber–Physical Systems Security
Yu, Z., Gao, H., Cong, X., Wu, N., & Song, H. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3289625 · Cited by 219 · see citing works
When Machine Learning Meets Privacy in 6G: A Survey
Sun, Y., Liu, J., Wang, J., Cao, Y., & Kato, N. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.3011561 · Cited by 211 · see citing works
Enhancing Cyber-Resiliency of DER-Based Smart Grid: A Survey
Liu, M., Teng, F., Zhang, Z., Ge, P., Sun, M., Deng, R., Cheng, P., & Chen, J. (2024) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2024.3373008 · Cited by 219 · see citing works
Machine Learning Security: Threats, Countermeasures, and Evaluations
Xue, M., Yuan, C., Wu, H., Zhang, Y., & Liu, W. (2020) · IEEE Access · doi:10.1109/access.2020.2987435 · Cited by 197 · see citing works
Evaluating Adversarial Evasion Attacks in the Context of Wireless Communications
Flowers, B., Buehrer, R. M., & Headley, W. C. (2019) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2934069 · Cited by 184 · see citing works
A training-integrity privacy-preserving federated learning scheme with trusted execution environment
Chen, Y., Luo, F., Li, T., Xiang, T., Liu, Z., & Li, J. (2020) · Information Sciences · doi:10.1016/j.ins.2020.02.037 · Cited by 188 · see citing works
Stronger data poisoning attacks break data sanitization defenses
Koh, P. W., Steinhardt, J., & Liang, P. (2021) · Machine Learning · doi:10.1007/s10994-021-06119-y · Cited by 189 · see citing works
Decentralized Federated Learning: A Survey on Security and Privacy
Hallaji, E., Razavi‐Far, R., Saif, M., Wang, B., & Yang, Q. (2024) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2024.3362191 · Cited by 191 · see citing works
A Holistic Review of Cybersecurity and Reliability Perspectives in Smart Airports
Koroniotis, N., Moustafa, N., Schiliro, F., Gauravaram, P., & Janicke, H. (2020) · IEEE Access · doi:10.1109/access.2020.3036728 · Cited by 181 · see citing works
Artificial Intelligence Security: Threats and Countermeasures
Hu, Y., Kuang, W., Qin, Z., Li, K., Zhang, J., Gao, Y., Li, W., & Li, K. (2023) · ACM Computing Surveys · doi:10.1145/3487890 · Cited by 196 · see citing works
Blind Backdoors in Deep Learning ModelsPreprint
Bagdasaryan, E., & Shmatikov, V. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.03823 · Cited by 175 · see citing works
Adversarial Machine Learning-Industry Perspectives
Kumar, R. S. S., Nystrom, M., Lambert, J., Marshall, A. D., Goertzel, M., Comissoneru, A., Swann, M., & Xia, S. (2020) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw50608.2020.00028 · Cited by 223 · see citing works
Deep Model Poisoning Attack on Federated Learning
Zhou, X., Xu, M., Wu, Y., & Zheng, N. (2021) · Future Internet · doi:10.3390/fi13030073 · Cited by 170 · see citing works
CONTRA: Defending Against Poisoning Attacks in Federated Learning
Awan, S., Luo, B., & Li, F. (2021) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-88418-5_22 · Cited by 182 · see citing works
Label Sanitization Against Label Flipping Poisoning Attacks
Paudice, A., Muñoz-González, L., & Lupu, E. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-13453-2_1 · Cited by 167 · see citing works
Towards artificial intelligence enabled 6G: State of the art, challenges, and opportunities
Zhang, S., & Zhu, D. (2020) · Computer Networks · doi:10.1016/j.comnet.2020.107556 · Cited by 170 · see citing works
Artificial Intelligence Crime: An Overview of Malicious Use and Abuse of AI
Blauth, T. F., Gstrein, O. J., & Zwitter, A. (2022) · IEEE Access · doi:10.1109/access.2022.3191790 · Cited by 196 · see citing works
Preserving data privacy in machine learning systems
Mestari, S. Z. E., Lenzini, G., & Demirci, H. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103605 · Cited by 180 · see citing works
Adversarial machine learning :
Vassilev, A., Oprea, A., Fordyce, A. J., & Anderson, H. S. (2024) · doi:10.6028/nist.ai.100-2e2023 · Cited by 194 · see citing works
Self-citationStahl, B. C. (2021) · SpringerBriefs in research and innovation governance · doi:10.1007/978-3-030-69978-9_4 · Cited by 158 · see citing works
Vulnerability of Machine Learning Approaches Applied in IoT-Based Smart Grid: A Review
Zhang, Z., Liu, M., Sun, M., Deng, R., Cheng, P., Niyato, D. T., Chow, M., & Chen, J. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3349381 · Cited by 170 · see citing works
Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning
Salem, A., Bhattacharya, A., Backes, M., Fritz, M., & Zhang, Y. (2020) · Universität des Saarlandes · doi:10.22028/d291-47370 · Cited by 157 · see citing works
Local and Central Differential Privacy for Robustness and Privacy in Federated Learning
Naseri, M., Hayes, J., & De Cristofaro, E. (2022) · Proceedings 2022 Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.23054 · Cited by 188 · see citing works
LoMar: A Local Defense Against Poisoning Attack on Federated Learning
Li, X., Qu, Z., Zhao, S., Tang, B., Lu, Z., & Liu, Y. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3135422 · Cited by 152 · see citing works
Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive ReviewPreprint
Gao, Y., Doan, B. G., Zhang, Z., Ma, S., Zhang, J., Fu, A., Nepal, ., & Kim, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.10760 · Cited by 207 · see citing works
Influence Function based Data Poisoning Attacks to Top-N Recommender Systems
Fang, M., Gong, N. Z., & Liu, J. (2020) · International World Wide Web Conference (WWW) · doi:10.1145/3366423.3380072 · Cited by 151 · see citing works
Tight Arms Race: Overview of Current Malware Threats and Trends in Their Detection
Caviglione, L., Choraś, M., Corona, I., Janicki, A., Mazurczyk, W., Pawlicki, M., & Wasielewska, K. (2020) · IEEE Access · doi:10.1109/access.2020.3048319 · Cited by 153 · see citing works
BAFL: A Blockchain-Based Asynchronous Federated Learning Framework
Feng, L., Zhao, Y., Guo, S., Qiu, X., Li, W., & Yu, P. (2021) · IEEE Transactions on Computers · doi:10.1109/tc.2021.3072033 · Cited by 150 · see citing works
Attacking Graph-based Classification via Manipulating the Graph Structure
Wang, B., & Gong, N. Z. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354206 · Cited by 140 · see citing works
Adversarial XAI Methods in Cybersecurity
Kuppa, A., & Le‐Khac, N. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3117075 · Cited by 146 · see citing works
Helen: Maliciously Secure Coopetitive Learning for Linear Models
Zheng, W., Popa, R. A., Gonzalez, J. E., & Stoica, I. G. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00045 · Cited by 143 · see citing works
Poisoning Web-Scale Training Datasets is Practical
Carlini, N., Jagielski, M., Choquette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., & Tramèr, F. (2024) · 2024 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp54263.2024.00179 · Cited by 138 · see citing works
Self-citationPoisoning Web-Scale Training Datasets is Practical
Carlini, N., Jagielski, M., Choquette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., & Tramèr, F. (2023) · arXiv · doi:10.48550/arxiv.2302.10149 · Cited by 138 · see citing works
“…[54], [62], [86], [99], [106], [113], [26], [30], [37], [55], [56], [71], [80], [88], [91], [94], [101], [102], [115] [9], [20], [28], [34], [38], [40], [53], [72], [89], [100], [109]–[111], [29], [57], [65], [66], [73], [81] that first presumes an adversary can modify a training dataset, and…”
Self-citationVerSA: Verifiable Secure Aggregation for Cross-Device Federated Learning
Hahn, C., Kim, H.-D., Kim, M., & Hur, J. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3126323 · Cited by 131 · see citing works
Big Data Analytics for Large-scale Wireless Networks
Dai, H., Wong, R. C.-W., Wang, H. H., Zheng, Z., & Vasilakos, A. V. (2019) · ACM Computing Surveys · doi:10.1145/3337065 · Cited by 131 · see citing works
Uniting cyber security and machine learning: Advantages, challenges and future research
Wazid, M., Das, A. K., Chamola, V., & Park, Y. (2022) · ICT Express · doi:10.1016/j.icte.2022.04.007 · Cited by 130 · see citing works
Flash: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning
Rehman, M. U., Ahmadi, H., & Hassan, W. U. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00139 · Cited by 127 · see citing works
De-Pois: An Attack-Agnostic Defense against Data Poisoning Attacks
Chen, J., Zhang, X., Zhang, R., Wang, C., & Liu, L. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3080522 · Cited by 126 · see citing works
Wang, M. W. H., Goodman, J. M., & Allen, T. E. H. (2020) · Chemical Research in Toxicology · doi:10.1021/acs.chemrestox.0c00316 · Cited by 126 · see citing works
Poison Ink: Robust and Invisible Backdoor Attack
Zhang, J., Chen, D., Huang, Q., Liao, J., Zhang, W., Feng, H., Hua, G., & Yu, N. (2022) · IEEE Transactions on Image Processing · doi:10.1109/tip.2022.3201472 · Cited by 121 · see citing works
Data Security Issues in Deep Learning: Attacks, Countermeasures, and Opportunities
Xu, G., Li, H., Ren, H., Yang, K., & Deng, R. H. (2019) · IEEE Communications Magazine · doi:10.1109/mcom.001.1900091 · Cited by 118 · see citing works
Roldán-Gómez, J., Boubeta-Puig, J., Martínez, J. L., & Ortiz, G. (2020) · Expert Systems with Applications · doi:10.1016/j.eswa.2020.113251 · Cited by 117 · see citing works
Cryptanalytic Extraction of Neural Network Models
Carlini, N., Jagielski, M., & Mironov, I. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-56877-1_7 · Cited by 116 · see citing works
Self-citationSponge Examples: Energy-Latency Attacks on Neural Networks
Shumailov, I., Zhao, Y., Bates, D., Papernot, N., Mullins, R., & Anderson, R. (2021) · 2021 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp51992.2021.00024 · Cited by 125 · see citing works
A Survey of Privacy Risks and Mitigation Strategies in the Artificial Intelligence Life Cycle
Shahriar, S., Allana, S., Hazratifard, S. M., & Dara, R. (2023) · IEEE Access · doi:10.1109/access.2023.3287195 · Cited by 114 · see citing works
Bridging the “last mile” gap between AI implementation and operation: “data awareness” that matters
Cabitza, F., Campagner, A., & Balsano, C. (2020) · Annals of Translational Medicine · doi:10.21037/atm.2020.03.63 · Cited by 113 · see citing works
Chen, C., Sun, F., Zhang, M., & Ding, B. (2022) · Proceedings of the ACM Web Conference 2022 · doi:10.1145/3485447.3511997 · Cited by 110 · see citing works
FL-Defender: Combating targeted attacks in federated learning
Jebreel, N. M., & Domingo-Ferrer, J. (2023) · Knowledge-Based Systems · doi:10.1016/j.knosys.2022.110178 · Cited by 110 · see citing works
Robust Electricity Theft Detection Against Data Poisoning Attacks in Smart Grids
Takiddin, A., Ismail, M., Zafar, U., & Serpedin, E. (2020) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2020.3047864 · Cited by 106 · see citing works
Poisoning and Evasion Attacks Against Deep Learning Algorithms in Autonomous Vehicles
Jiang, W., Li, H., Liu, S., Luo, X., & Lu, R. (2020) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2020.2977378 · Cited by 107 · see citing works
Threats to Training: A Survey of Poisoning Attacks and Defenses on Machine Learning Systems
Wang, Z., Ma, J., Wang, X., Hu, J., Qin, Z., & Ren, K. (2022) · ACM Computing Surveys · doi:10.1145/3538707 · Cited by 107 · see citing works
Towards Security Threats of Deep Learning Systems: A Survey
He, Y., Meng, G., Chen, K., Hu, X., & He, J. (2020) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2020.3034721 · Cited by 114 · see citing works
Hidden Backdoors in Human-Centric Language Models
Li, S., Liu, H., Dong, T., Zhao, B. Z. H., Xue, M., Zhu, H., & Lu, J. (2021) · Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3460120.3484576 · Cited by 119 · see citing works
Distributed Machine Learning for UAV Swarms: Computing, Sensing, and Semantics
Ding, Y., Yang, Z., Pham, Q., Hu, Y., Zhang, Z., & Shikh‐Bahaei, M. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3341307 · Cited by 113 · see citing works
MetaPoison: Practical General-purpose Clean-label Data PoisoningPreprint
Huang, W., Geiping, J., Fowl, L., Taylor, G., & Goldstein, T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2004.00225 · Cited by 102 · see citing works
Artificial Intelligence Security Threat, Crime, and Forensics: Taxonomy and Open Issues
Jeong, D. (2020) · IEEE Access · doi:10.1109/access.2020.3029280 · Cited by 105 · see citing works
Towards Adversarial Malware Detection
Maiorca, D., Biggio, B., & Giacinto, G. (2019) · ACM Computing Surveys · doi:10.1145/3332184 · Cited by 106 · see citing works
Self-citationARCANE: An Efficient Architecture for Exact Machine Unlearning
Yan, H., Li, X., Guo, Z., Li, H., Li, F., & Lin, X. (2022) · Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/556 · Cited by 97 · see citing works
SocInf: Membership Inference Attacks on Social Media Health Data With Machine Learning
Liu, G., Wang, C., Peng, K., Huang, H., Li, Y., & Cheng, W. (2019) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2019.2916086 · Cited by 93 · see citing works
15 challenges for AI: Or what AI (currently) can’t do
Hagendorff, T., & Wezel, K. (2020) · AI & SOCIETY · doi:10.1007/s00146-019-00886-y · Cited by 113 · see citing works
Evading Anti-Malware Engines With Deep Reinforcement Learning
Fang, Z., Wang, J., Li, B., Wu, S., Zhou, Y., & Huang, H. (2019) · IEEE Access · doi:10.1109/access.2019.2908033 · Cited by 97 · see citing works
Self-citationSecurity in Brain-Computer Interfaces
Bernal, S. L., Celdrán, A. H., Pérez, G. M., Barros, M. T., & Balasubramaniam, S. (2021) · ACM Computing Surveys · doi:10.1145/3427376 · Cited by 98 · see citing works
Bridging Mode Connectivity in Loss Landscapes and Adversarial RobustnessPreprint
Zhao, P., Chen, P., Das, P., Ramamurthy, K. N., & Lin, X. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.00060 · Cited by 95 · see citing works
Membership Inference Attacks Against Adversarially Robust Deep Learning Models
Song, L., Shokri, R., & Mittal, P. (2019) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2019.00021 · Cited by 89 · see citing works
Privacy-Preserving Federated Learning via Functional Encryption, Revisited
Chang, Y., Zhang, K., Gong, J., & Qian, H. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3255171 · Cited by 93 · see citing works
Stealing Neural Networks via Timing Side ChannelsPreprint
Duddu, V., Samanta, D., Rao, D. V., & Bălaş, V. E. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1812.11720 · Cited by 115 · see citing works
Dunn, C., Moustafa, N., & Turnbull, B. (2020) · Sustainability · doi:10.3390/su12166434 · Cited by 87 · see citing works
Adversarial Attacks Against Deep Generative Models on Data: A Survey
Sun, H., Zhu, T., Zhang, Z., Jin, D., Xiong, P., & Zhou, W. (2023) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2021.3130903 · Cited by 90 · see citing works
Blockchain analytics and artificial intelligence
Dillenberger, D. N., Novotny, P., Zhang, Q., Jayachandran, P., Gupta, H., Hans, S., Verma, D., Chakraborty, S., Thomas, J. J., Walli, M. M., et al. (2019) · IBM Journal of Research and Development · doi:10.1147/jrd.2019.2900638 · Cited by 82 · see citing works
- Authors
- Jagielski, M., Oprea, A., Biggio, B., Liu, C., Nita-Rotaru, C., & Li, B.
- Affiliations
- Northeastern University (US)
- University of Cagliari (IT)
- University of California, Berkeley (US)
- Venue
- 2018 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2018-05
- Pages
- 19-35
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2962763344
- Cited by
- 861
- References
- 52
- Citations by year
- 2026: 50 · 2025: 114 · 2024: 133 · 2023: 146 · 2022: 120 · 2021: 132 · 2020: 98 · 2019: 54 · 2018: 14
- FWCI
- 30.43
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- UNICA IRIS Institutional Research Information System (University of Cagliari) (submittedVersion, public-domain)
- arXiv (Cornell University)
- Funders
- National Science Foundation (1238962, 1238959, 1239054, 1239166)
- European Commission (780788, EU-H2020, HORIZON2020, H2020)
- Defense Advanced Research Projects Agency (FA8750-17-2-0091, FA8750)
- Horizon 2020 Framework Programme (EU‐H2020, 780788)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- poisoning attacks, linear regression, adversarial learning, statistical attacks, optimization framework, convergence guarantees, health care, loan assessment, real estate
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
