The DOI matches its Crossref record; 50 of the 52 references it cites were found in a registry or an index.
Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
Open accessAbstract
As machine learning becomes widely used for automated decisions, attackers have strong incentives to manipulate the results and models generated by machine learning algorithms. In this paper, we perform the first systematic study of poisoning attacks and their countermeasures for linear regression models. In poisoning attacks, attackers deliberately influence the training data to manipulate the results of a predictive model. We propose a theoretically-grounded optimization framework specifically designed for linear regression and demonstrate its effectiveness on a range of datasets and models. We also introduce a fast statistical attack that requires limited knowledge of the training process. Finally, we design a new principled defense method that is highly resilient against all poisoning attacks. We provide formal guarantees about its convergence and an upper bound on the effect of poisoning attacks when the defense is deployed. We evaluate extensively our attacks and defenses on three realistic datasets from health care, loan assessment, and real estate domains.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Persistent, self-modifying memory further introduces risks of silent state corruption, where malicious logic can propagate across future reasoning steps without clear provenance (Jagielski et al., 2018;Li et al., 2022;Steinberger, Peter, 2025b).”
From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Jagielski et al., 2018
Experimental — accuracy not yet measuredIn the citing paper
“Another detection-based defense mechanism uses euclidean distance to expose any deviation in the model update parameters for each client [90].”
From Vulnerabilities in federated learning (2021) · cites this paper as [90]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
The Elements of Statistical Learning
Hastie, T., Tibshirani, R., & Friedman, J. (2009) · Springer Series in Statistics · doi:10.1007/978-0-387-84858-7 · Cited by 25,970
Fischler, M. A., & Bolles, R. C. (1981) · Communications of the ACM · doi:10.1145/358669.358692 · Cited by 25,893
The Elements of Statistical Learning: Data Mining, Inference, and Prediction
Lu, Z. Q. J. (2010) · Journal of the Royal Statistical Society Series A (Statistics in Society) · doi:10.1111/j.1467-985x.2010.00646_6.x · Cited by 12,916
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143
Robust estimation of a location parameter
Huber, P. J. (1964) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177703732 · Cited by 7,228
Robust principal component analysis?
Candès, E. J., Li, X., Ma, Y., & Wright, J. N. (2011) · Journal of the ACM · doi:10.1145/1970392.1970395 · Cited by 7,048
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
The Limitations of Deep Learning in Adversarial Settings
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., & Swami, A. (2016) · 2016 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2016.36 · Cited by 3,993
Flagged first, then by citations
2 of the 52 references couldn’t be matched to a known paper.
Research works printed but not linked: 6
- 0, Kaggle House Prices Advanced Regression Techniques
- kan, 0, Lending Club Loan Data
- hao, 2016, PREDA-TOR: Proactive recognition and elimination of domain abuse at time-of-registration, Proceedings of the 23rd ACM Conference on Computer and Communications Security
- faggella, 2016, Machine learning healthcare applications — 2017 and beyond
- 0, PharmGKB Downloads - IWPC Data
- srndic, 0, Mimicus - Contagio Dataset
Cited by
Sorted by citations
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,577
Wild patterns: Ten years after the rise of adversarial machine learning
Biggio, B., & Roli, F. (2018) · Pattern Recognition · doi:10.1016/j.patcog.2018.07.023 · Cited by 1,563
Self-citationA survey on security and privacy of federated learning
Mothukuri, V., Parizi, R. M., Pouriyeh, S., Huang, Y., Dehghantanha, A., & Srivastava, G. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2020.10.007 · Cited by 1,480
Data Poisoning Attacks Against Federated Learning Systems
Tolpegin, V., Truex, S., Gursoy, M. E., & Liu, L. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58951-6_24 · Cited by 927
Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
Fang, M., Cao, X., Jia, J., & Gong, N. Z. (2019) · arXiv · doi:10.48550/arxiv.1911.11815 · Cited by 828
Machine learning pipeline for battery state-of-health estimation
Roman, D., Saxena, S., Robu, V., PECHT, M. G., & Flynn, D. (2021) · Nature Machine Intelligence · doi:10.1038/s42256-021-00312-3 · Cited by 713
Challenges in deploying machine learning: A survey of case studies
Paleyes, A., Urma, R.-G., & Lawrence, N. D. (2023) · ACM Computing Surveys · doi:10.1145/3533378 · Cited by 638
Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., & Backes, M. (2019) · Proceedings 2019 Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23119 · Cited by 852
Privacy and Robustness in Federated Learning: Attacks and Defenses
Lyu, L., Yu, H., Ma, X., Chen, C., Sun, L., Zhao, J., Yang, Q., & Yu, P. S. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3216981 · Cited by 548
ABS: Scanning Neural Networks for Back-doors by Artificial Brain Stimulation
Liu, Y., Lee, W., Tao, G., Ma, S., Aafer, Y., & Zhang, X. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363216 · Cited by 439
Machine Learning for Predicting Epileptic Seizures Using EEG Signals: A Review
Rasheed, K., Qayyum, A., Qadir, J., Sivathamboo, S., Kwan, P., Kuhlmann, L., O'Brien, T. J., & Razi, A. (2020) · IEEE Reviews in Biomedical Engineering · doi:10.1109/rbme.2020.3008792 · Cited by 438
Privacy preservation in federated learning: An insightful survey from the GDPR perspective
Truong, N., Sun, K., Wang, S., Guitton, F., & Guo, Y. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102402 · Cited by 399
ShieldFL: Mitigating Model Poisoning Attacks in Privacy-Preserving Federated Learning
Ma, Z., Ma, J., Miao, Y., Li, Y., & Deng, R. H. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3169918 · Cited by 371
Latent Backdoor Attacks on Deep Neural Networks
Yao, Y., Li, H., Zheng, H.-T., & Zhao, B. Y. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354209 · Cited by 382
Biscotti: A blockchain system for private and secure federated learning
Shayan, M., Fung, C., Yoon, C. J. M., & Beschastnikh, I. (2021) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2020.3044223 · Cited by 354
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., & Goldstein, T. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3162397 · Cited by 362
Self-citationChained Anomaly Detection Models for Federated Learning: An Intrusion Detection Case Study
Preuveneers, D., Rimmer, V., Tsingenopoulos, I., Spooren, J., Joosen, W., & Ilie-Zudor, E. (2018) · Applied Sciences · doi:10.3390/app8122663 · Cited by 323
Artificial Intelligence for a Better Future
Stahl, B. C. (2021) · SpringerBriefs in research and innovation governance · doi:10.1007/978-3-030-69978-9 · Cited by 437
Introduction to Computer Security
Mammeri, Z. (2024) · Cryptography · doi:10.1002/9781394207510.ch1 · Cited by 309
PoisonGAN: Generative Poisoning Attacks Against Federated Learning in Edge Computing Systems
Zhang, J., Chen, B., Cheng, X., Binh, H. T. T., & Yu, S. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3023126 · Cited by 291
A Comprehensive Survey on Poisoning Attacks and Countermeasures in Machine Learning
Tian, Z., Cui, L., Liang, J., & Yu, S. (2022) · ACM Computing Surveys · doi:10.1145/3551636 · Cited by 293
Shejwalkar, V., Houmansadr, A., Kairouz, P., & Ramage, D. (2022) · 2022 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp46214.2022.9833647 · Cited by 292
Trusting artificial intelligence in cybersecurity is a double-edged sword
Taddeo, M., McCutcheon, T., & Floridi, L. (2019) · Nature Machine Intelligence · doi:10.1038/s42256-019-0109-1 · Cited by 299
Vulnerabilities in federated learning
Bouacida, N., & Mohapatra, P. (2021) · IEEE Access · doi:10.1109/access.2021.3075203 · Cited by 248
AI-Based Intrusion Detection Systems for In-Vehicle Networks: A Survey
Rajapaksha, S., Kalutarage, H., Al-Kadri, M. O., Petrovski, A., Madzudzo, G., & Cheah, M. (2022) · ACM Computing Surveys · doi:10.1145/3570954 · Cited by 278
NIC: Detecting Adversarial Samples with Neural Network Invariant Checking
Ma, S., Liu, Y., Tao, G., Lee, W., & Zhang, X. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23415 · Cited by 252
Privacy Risks of Securing Machine Learning Models against Adversarial Examples
Song, L., Shokri, R., & Mittal, P. (2019) · Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3319535.3354211 · Cited by 229
Dynamic Backdoor Attacks Against Machine Learning Models
Salem, A., Wen, R., Michael Backes, A., Ma, S., & Zhang, Y. (2022) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp53844.2022.00049 · Cited by 233
Poisoning Attack in Federated Learning using Generative Adversarial Nets
Zhang, J., Chen, J., Wu, D., Chen, B., & Yu, S. (2019) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom/bigdatase.2019.00057 · Cited by 216
Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning AttacksPreprint
Demontis, A., Melis, M., Pintor, M., Jagielski, M., Biggio, B., Oprea, A., Nita-Rotaru, C., & Roli, F. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.02861 · Cited by 219
Self-citationVFChain: Enabling Verifiable and Auditable Federated Learning via Blockchain Systems
Peng, Z., Xu, J., Chu, X., Gao, S., Yao, Y., Gu, R., & Tang, Y. (2021) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2021.3050781 · Cited by 219
A Survey on Cyber–Physical Systems Security
Yu, Z., Gao, H., Cong, X., Wu, N., & Song, H. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3289625 · Cited by 235
When Machine Learning Meets Privacy in 6G: A Survey
Sun, Y., Liu, J., Wang, J., Cao, Y., & Kato, N. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.3011561 · Cited by 211
Enhancing Cyber-Resiliency of DER-Based Smart Grid: A Survey
Liu, M., Teng, F., Zhang, Z., Ge, P., Sun, M., Deng, R., Cheng, P., & Chen, J. (2024) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2024.3373008 · Cited by 219
Machine Learning Security: Threats, Countermeasures, and Evaluations
Xue, M., Yuan, C., Wu, H., Zhang, Y., & Liu, W. (2020) · IEEE Access · doi:10.1109/access.2020.2987435 · Cited by 215
Evaluating Adversarial Evasion Attacks in the Context of Wireless Communications
Flowers, B., Buehrer, R. M., & Headley, W. C. (2019) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2934069 · Cited by 184
Stronger Data Poisoning Attacks Break Data Sanitization Defenses
Koh, P. W., Steinhardt, J., & Liang, P. (2018) · arXiv · doi:10.48550/arxiv.1811.00741 · Cited by 189
A training-integrity privacy-preserving federated learning scheme with trusted execution environment
Chen, Y., Luo, F., Li, T., Xiang, T., Liu, Z., & Li, J. (2020) · Information Sciences · doi:10.1016/j.ins.2020.02.037 · Cited by 194
Stronger data poisoning attacks break data sanitization defenses
Koh, P. W., Steinhardt, J., & Liang, P. (2021) · Machine Learning · doi:10.1007/s10994-021-06119-y · Cited by 257
Decentralized Federated Learning: A Survey on Security and Privacy
Hallaji, E., Razavi‐Far, R., Saif, M., Wang, B., & Yang, Q. (2024) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2024.3362191 · Cited by 204
A Holistic Review of Cybersecurity and Reliability Perspectives in Smart Airports
Koroniotis, N., Moustafa, N., Schiliro, F., Gauravaram, P., & Janicke, H. (2020) · IEEE Access · doi:10.1109/access.2020.3036728 · Cited by 181
Artificial Intelligence Security: Threats and Countermeasures
Hu, Y., Kuang, W., Qin, Z., Li, K., Zhang, J., Gao, Y., Li, W., & Li, K. (2023) · ACM Computing Surveys · doi:10.1145/3487890 · Cited by 196
Blind Backdoors in Deep Learning ModelsPreprint
Bagdasaryan, E., & Shmatikov, V. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.03823 · Cited by 193
Adversarial Machine Learning-Industry Perspectives
Kumar, R. S. S., Nystrom, M., Lambert, J., Marshall, A. D., Goertzel, M., Comissoneru, A., Swann, M., & Xia, S. (2020) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw50608.2020.00028 · Cited by 223
Deep Model Poisoning Attack on Federated Learning
Zhou, X., Xu, M., Wu, Y., & Zheng, N. (2021) · Future Internet · doi:10.3390/fi13030073 · Cited by 170
CONTRA: Defending Against Poisoning Attacks in Federated Learning
Awan, S., Luo, B., & Li, F. (2021) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-88418-5_22 · Cited by 182
Label Sanitization Against Label Flipping Poisoning Attacks
Paudice, A., Muñoz-González, L., & Lupu, E. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-13453-2_1 · Cited by 167
Towards artificial intelligence enabled 6G: State of the art, challenges, and opportunities
Zhang, S., & Zhu, D. (2020) · Computer Networks · doi:10.1016/j.comnet.2020.107556 · Cited by 176
Artificial Intelligence Crime: An Overview of Malicious Use and Abuse of AI
Blauth, T. F., Gstrein, O. J., & Zwitter, A. (2022) · IEEE Access · doi:10.1109/access.2022.3191790 · Cited by 228
Preserving data privacy in machine learning systems
Mestari, S. Z. E., Lenzini, G., & Demirci, H. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103605 · Cited by 195
Adversarial machine learning :
Vassilev, A., Oprea, A., Fordyce, A. J., & Anderson, H. S. (2024) · doi:10.6028/nist.ai.100-2e2023 · Cited by 230
Self-citationStahl, B. C. (2021) · SpringerBriefs in research and innovation governance · doi:10.1007/978-3-030-69978-9_4 · Cited by 197
Vulnerability of Machine Learning Approaches Applied in IoT-Based Smart Grid: A Review
Zhang, Z., Liu, M., Sun, M., Deng, R., Cheng, P., Niyato, D. T., Chow, M., & Chen, J. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3349381 · Cited by 170
Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning
Salem, A., Bhattacharya, A., Backes, M., Fritz, M., & Zhang, Y. (2020) · Universität des Saarlandes · doi:10.22028/d291-47370 · Cited by 157
Local and Central Differential Privacy for Robustness and Privacy in Federated Learning
Naseri, M., Hayes, J., & De Cristofaro, E. (2022) · Proceedings 2022 Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.23054 · Cited by 188
LoMar: A Local Defense Against Poisoning Attack on Federated Learning
Li, X., Qu, Z., Zhao, S., Tang, B., Lu, Z., & Liu, Y. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3135422 · Cited by 158
Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive ReviewPreprint
Gao, Y., Doan, B. G., Zhang, Z., Ma, S., Zhang, J., Fu, A., Nepal, ., & Kim, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.10760 · Cited by 276
Influence Function based Data Poisoning Attacks to Top-N Recommender Systems
Fang, M., Gong, N. Z., & Liu, J. (2020) · International World Wide Web Conference (WWW) · doi:10.1145/3366423.3380072 · Cited by 151
Tight Arms Race: Overview of Current Malware Threats and Trends in Their Detection
Caviglione, L., Choraś, M., Corona, I., Janicki, A., Mazurczyk, W., Pawlicki, M., & Wasielewska, K. (2020) · IEEE Access · doi:10.1109/access.2020.3048319 · Cited by 163
BAFL: A Blockchain-Based Asynchronous Federated Learning Framework
Feng, L., Zhao, Y., Guo, S., Qiu, X., Li, W., & Yu, P. (2021) · IEEE Transactions on Computers · doi:10.1109/tc.2021.3072033 · Cited by 150
Attacking Graph-based Classification via Manipulating the Graph Structure
Wang, B., & Gong, N. Z. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354206 · Cited by 140
Adversarial XAI Methods in Cybersecurity
Kuppa, A., & Le‐Khac, N. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3117075 · Cited by 151
Helen: Maliciously Secure Coopetitive Learning for Linear Models
Zheng, W., Popa, R. A., Gonzalez, J. E., & Stoica, I. G. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00045 · Cited by 150
Poisoning Web-Scale Training Datasets is Practical
Carlini, N., Jagielski, M., Choquette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., & Tramèr, F. (2024) · 2024 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp54263.2024.00179 · Cited by 138
Self-citationPoisoning Web-Scale Training Datasets is Practical
Carlini, N., Jagielski, M., Choquette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., & Tramèr, F. (2023) · arXiv · doi:10.48550/arxiv.2302.10149 · Cited by 138
“…[54], [62], [86], [99], [106], [113], [26], [30], [37], [55], [56], [71], [80], [88], [91], [94], [101], [102], [115] [9], [20], [28], [34], [38], [40], [53], [72], [89], [100], [109]–[111], [29], [57], [65], [66], [73], [81] that first presumes an adversary can modify a training dataset, and…”
Self-citationVerSA: Verifiable Secure Aggregation for Cross-Device Federated Learning
Hahn, C., Kim, H.-D., Kim, M., & Hur, J. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3126323 · Cited by 135
Big Data Analytics for Large-scale Wireless Networks
Dai, H., Wong, R. C.-W., Wang, H. H., Zheng, Z., & Vasilakos, A. V. (2019) · ACM Computing Surveys · doi:10.1145/3337065 · Cited by 131
Uniting cyber security and machine learning: Advantages, challenges and future research
Wazid, M., Das, A. K., Chamola, V., & Park, Y. (2022) · ICT Express · doi:10.1016/j.icte.2022.04.007 · Cited by 130
Flash: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning
Rehman, M. U., Ahmadi, H., & Hassan, W. U. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00139 · Cited by 146
De-Pois: An Attack-Agnostic Defense against Data Poisoning Attacks
Chen, J., Zhang, X., Zhang, R., Wang, C., & Liu, L. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3080522 · Cited by 133
Wang, M. W. H., Goodman, J. M., & Allen, T. E. H. (2020) · Chemical Research in Toxicology · doi:10.1021/acs.chemrestox.0c00316 · Cited by 133
Poison Ink: Robust and Invisible Backdoor Attack
Zhang, J., Chen, D., Huang, Q., Liao, J., Zhang, W., Feng, H., Hua, G., & Yu, N. (2022) · IEEE Transactions on Image Processing · doi:10.1109/tip.2022.3201472 · Cited by 132
Data Security Issues in Deep Learning: Attacks, Countermeasures, and Opportunities
Xu, G., Li, H., Ren, H., Yang, K., & Deng, R. H. (2019) · IEEE Communications Magazine · doi:10.1109/mcom.001.1900091 · Cited by 118
Roldán-Gómez, J., Boubeta-Puig, J., Martínez, J. L., & Ortiz, G. (2020) · Expert Systems with Applications · doi:10.1016/j.eswa.2020.113251 · Cited by 117
Cryptanalytic Extraction of Neural Network Models
Carlini, N., Jagielski, M., & Mironov, I. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-56877-1_7 · Cited by 132
Self-citationSponge Examples: Energy-Latency Attacks on Neural Networks
Shumailov, I., Zhao, Y., Bates, D., Papernot, N., Mullins, R., & Anderson, R. (2021) · 2021 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp51992.2021.00024 · Cited by 125
A Survey of Privacy Risks and Mitigation Strategies in the Artificial Intelligence Life Cycle
Shahriar, S., Allana, S., Hazratifard, S. M., & Dara, R. (2023) · IEEE Access · doi:10.1109/access.2023.3287195 · Cited by 114
Bridging the “last mile” gap between AI implementation and operation: “data awareness” that matters
Cabitza, F., Campagner, A., & Balsano, C. (2020) · Annals of Translational Medicine · doi:10.21037/atm.2020.03.63 · Cited by 113
Chen, C., Sun, F., Zhang, M., & Ding, B. (2022) · Proceedings of the ACM Web Conference 2022 · doi:10.1145/3485447.3511997 · Cited by 110
FL-Defender: Combating targeted attacks in federated learning
Jebreel, N. M., & Domingo-Ferrer, J. (2023) · Knowledge-Based Systems · doi:10.1016/j.knosys.2022.110178 · Cited by 110
Robust Electricity Theft Detection Against Data Poisoning Attacks in Smart Grids
Takiddin, A., Ismail, M., Zafar, U., & Serpedin, E. (2020) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2020.3047864 · Cited by 106
Poisoning and Evasion Attacks Against Deep Learning Algorithms in Autonomous Vehicles
Jiang, W., Li, H., Liu, S., Luo, X., & Lu, R. (2020) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2020.2977378 · Cited by 114
Threats to Training: A Survey of Poisoning Attacks and Defenses on Machine Learning Systems
Wang, Z., Ma, J., Wang, X., Hu, J., Qin, Z., & Ren, K. (2022) · ACM Computing Surveys · doi:10.1145/3538707 · Cited by 118
Towards Security Threats of Deep Learning Systems: A Survey
He, Y., Meng, G., Chen, K., Hu, X., & He, J. (2020) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2020.3034721 · Cited by 121
Hidden Backdoors in Human-Centric Language Models
Li, S., Liu, H., Dong, T., Zhao, B. Z. H., Xue, M., Zhu, H., & Lu, J. (2021) · Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3460120.3484576 · Cited by 119
Distributed Machine Learning for UAV Swarms: Computing, Sensing, and Semantics
Ding, Y., Yang, Z., Pham, Q., Hu, Y., Zhang, Z., & Shikh‐Bahaei, M. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3341307 · Cited by 123
MetaPoison: Practical General-purpose Clean-label Data PoisoningPreprint
Huang, W., Geiping, J., Fowl, L., Taylor, G., & Goldstein, T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2004.00225 · Cited by 102
Artificial Intelligence Security Threat, Crime, and Forensics: Taxonomy and Open Issues
Jeong, D. (2020) · IEEE Access · doi:10.1109/access.2020.3029280 · Cited by 108
Towards Adversarial Malware Detection
Maiorca, D., Biggio, B., & Giacinto, G. (2019) · ACM Computing Surveys · doi:10.1145/3332184 · Cited by 111
Self-citationARCANE: An Efficient Architecture for Exact Machine Unlearning
Yan, H., Li, X., Guo, Z., Li, H., Li, F., & Lin, X. (2022) · Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/556 · Cited by 97
SocInf: Membership Inference Attacks on Social Media Health Data With Machine Learning
Liu, G., Wang, C., Peng, K., Huang, H., Li, Y., & Cheng, W. (2019) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2019.2916086 · Cited by 96
15 challenges for AI: Or what AI (currently) can’t do
Hagendorff, T., & Wezel, K. (2020) · AI & SOCIETY · doi:10.1007/s00146-019-00886-y · Cited by 113
Evading Anti-Malware Engines With Deep Reinforcement Learning
Fang, Z., Wang, J., Li, B., Wu, S., Zhou, Y., & Huang, H. (2019) · IEEE Access · doi:10.1109/access.2019.2908033 · Cited by 97
Self-citationSecurity in Brain-Computer Interfaces
Bernal, S. L., Celdrán, A. H., Pérez, G. M., Barros, M. T., & Balasubramaniam, S. (2021) · ACM Computing Surveys · doi:10.1145/3427376 · Cited by 110
Bridging Mode Connectivity in Loss Landscapes and Adversarial RobustnessPreprint
Zhao, P., Chen, P., Das, P., Ramamurthy, K. N., & Lin, X. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.00060 · Cited by 140
Membership Inference Attacks Against Adversarially Robust Deep Learning Models
Song, L., Shokri, R., & Mittal, P. (2019) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2019.00021 · Cited by 99
Privacy-Preserving Federated Learning via Functional Encryption, Revisited
Chang, Y., Zhang, K., Gong, J., & Qian, H. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3255171 · Cited by 93
Stealing Neural Networks via Timing Side ChannelsPreprint
Duddu, V., Samanta, D., Rao, D. V., & Bălaş, V. E. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1812.11720 · Cited by 115
Dunn, C., Moustafa, N., & Turnbull, B. (2020) · Sustainability · doi:10.3390/su12166434 · Cited by 87
Adversarial Attacks Against Deep Generative Models on Data: A Survey
Sun, H., Zhu, T., Zhang, Z., Jin, D., Xiong, P., & Zhou, W. (2023) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2021.3130903 · Cited by 90
Metadata
- Authors
- Jagielski, M., Oprea, A., Biggio, B., Liu, C., Nita-Rotaru, C., & Li, B.
- Affiliations
- Northeastern University (US)
- University of Cagliari (IT)
- University of California, Berkeley (US)
- Venue
- 2018 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2018-05
- Pages
- 19-35
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2962763344
- Cited by
- 861
- References
- 52
- Citations by year
- 2026: 50 · 2025: 114 · 2024: 133 · 2023: 146 · 2022: 120 · 2021: 132 · 2020: 98 · 2019: 54 · 2018: 14
- FWCI
- 30.43
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- UNICA IRIS Institutional Research Information System (University of Cagliari) (submittedVersion, public-domain)
- arXiv (Cornell University)
- Funders
- National Science Foundation (1238962, 1238959, 1239054, 1239166)
- European Commission (780788, EU-H2020, HORIZON2020, H2020)
- Defense Advanced Research Projects Agency (FA8750-17-2-0091, FA8750)
- Horizon 2020 Framework Programme (EU‐H2020, 780788)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Keywords
- poisoning attacks, linear regression, adversarial learning, statistical attacks, optimization framework, convergence guarantees, health care, loan assessment, real estate
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
