Cited by 861Adversarial Robustness in Machine LearningPrivacy-Preserving Technologies in DataSecurity and Verification in Computing

The DOI matches its Crossref record; 50 of the 52 references it cites were found in a registry or an index.

Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning

Open access

Jagielski, Matthew, Oprea, Alina, Biggio, Battista, Liu, Chang, Nita-Rotaru, Cristina, Li, Bo·2018·2018 IEEE Symposium on Security and Privacy (SP)

DOI 10.1109/sp.2018.00057

Open this paper in CoChat — free account Open PDF

Abstract

As machine learning becomes widely used for automated decisions, attackers have strong incentives to manipulate the results and models generated by machine learning algorithms. In this paper, we perform the first systematic study of poisoning attacks and their countermeasures for linear regression models. In poisoning attacks, attackers deliberately influence the training data to manipulate the results of a predictive model. We propose a theoretically-grounded optimization framework specifically designed for linear regression and demonstrate its effectiveness on a range of datasets and models. We also introduce a fast statistical attack that requires limited knowledge of the training process. Finally, we design a new principled defense method that is highly resilient against all poisoning attacks. We provide formal guarantees about its convergence and an upper bound on the effect of poisoning attacks when the defense is deployed. We evaluate extensively our attacks and defenses on three realistic datasets from health care, loan assessment, and real estate domains.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

Integrity signals

Registry

Crossref · 10.1109/sp.2018.00057

Cites

50 of 50 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

The Elements of Statistical Learning
Hastie, T., Tibshirani, R., & Friedman, J. (2009) · Springer Series in Statistics · doi:10.1007/978-0-387-84858-7 · Cited by 25,970
Random sample consensus: A paradigm for model fitting with applications to image analysis and automated cartography
Fischler, M. A., & Bolles, R. C. (1981) · Communications of the ACM · doi:10.1145/358669.358692 · Cited by 25,893
The Elements of Statistical Learning: Data Mining, Inference, and Prediction
Lu, Z. Q. J. (2010) · Journal of the Royal Statistical Society Series A (Statistics in Society) · doi:10.1111/j.1467-985x.2010.00646_6.x · Cited by 12,916
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143
Robust estimation of a location parameter
Huber, P. J. (1964) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177703732 · Cited by 7,228
Robust principal component analysis?
Candès, E. J., Li, X., Ma, Y., & Wright, J. N. (2011) · Journal of the ACM · doi:10.1145/1970392.1970395 · Cited by 7,048
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
The Limitations of Deep Learning in Adversarial Settings
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., & Swami, A. (2016) · 2016 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2016.36 · Cited by 3,993

Flagged first, then by citations

Show all 52 references

2 of the 52 references couldn’t be matched to a known paper.

Research works printed but not linked: 6

0, Kaggle House Prices Advanced Regression Techniques
kan, 0, Lending Club Loan Data
hao, 2016, PREDA-TOR: Proactive recognition and elimination of domain abuse at time-of-registration, Proceedings of the 23rd ACM Conference on Computer and Communications Security
faggella, 2016, Machine learning healthcare applications — 2017 and beyond
0, PharmGKB Downloads - IWPC Data
srndic, 0, Mimicus - Contagio Dataset

Sorted by citations

Items 801–861 of 861

Reliable and Private Utility Signaling for Data Markets
Peng, L., Zhang, J., Wu, Y., Liu, W., Liu, J., Yan, Z., Ren, K., Zhang, L., & Qu, L. (2025) · Proceedings of the ACM on Management of Data · doi:10.1145/3769821
A Defense Against Label Flipping Attacks in Federated Learning Using Output Layer Gradients
Yu, M., & Gong, B. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-9849-3_36
Quantum-Enhanced SVM for Chronic Kidney Disease Prediction
Kiruthiga, P. J., & Stanly, H. (2026) · Lecture notes in networks and systems · doi:10.1007/978-981-96-8799-2_23
AL-HARIS: Advanced Layer for Hacked-Aware Resilient Intelligent Sentinel
Aman, B., Rachman, B., Irqsous, A., & Zumarah, B. (2026) · IPTC Summit on AI for the Energy Industry · doi:10.2523/iptc-25247-ms
The Indo-Pacific E-Gateways in Digital Economic Communities
Kumar, T. M. V. (2026) · Advances in 21st century human settlements · doi:10.1007/978-981-95-4824-8_1
Enhancing Federated Learning Security: Cluster-Based Strategies to Counter GAN-Poisoned Attacks
Nowroozi, E., Habibi, Y., Mughal, A. B., Saedi, M., & Jafari, M. (2026) · Springer eBooks · doi:10.1007/978-3-031-99447-0_16
Zeroth-order primal-dual alternating projection gradient algorithms for nonconvex minimax problems with coupled linear constraints
Zhang, H., Xu, Z., & Dai, Y.-H. (2026) · Mathematics of Computation · doi:10.1090/mcom/4196
Securing AI Systems Through Transparency: A CIA Triad-Based Analysis
Chung, E. Y., Hamilton, I., Morgan, L., Grillaert, K., & Scarpino, J. (2025) · Cyber Awareness and Research Symposium (CARS) · doi:10.1109/cars67163.2025.11337813
An In-model Spy in Edge Intelligence
Yang, F., Chen, P., Yan, Y., & Yang, Z. (2025) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1109/raid67961.2025.00023
CatPoison: Category-Oriented Knowledge Poisoning Attacks in Retrieval-Augmented Generation Systems
Mei, H., Du, Z., Cai, C., Cheng, C., & Chen, J. (2025) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom66490.2025.00254
Evaluating the Resilience of Graph Neural Network Architectures to Adversarial and Noisy Data in High-Stakes Construction Project Management
Toğan, V., Mostofi, F., & Tokdemir, O. B. (2026) · Journal of Construction Engineering and Management · doi:10.1061/jcemd4.coeng-17244
Designing SecureAI Curriculum for National Security Needs: The Illinois Tech Program of Study
Dawson, M. E., Ayed, A. B., Quaye, S., & Khan, A. H. (2026) · Education Sciences · doi:10.3390/educsci16020310
Data protection and security of machine learning models in market-neutral crypto-currency trading strategies
Левицька, Т. О., Копійка, О. С., & Пилипенко, Б. В. (2025) · Reporter of the Priazovskyi State Technical University Section Technical sciences · doi:10.31498/2225-6733.52.2025.350997
An Empirical Evaluation of Deep Neural Networks as Hash-Like Mappings Under Digital Signature Threat Models
Couder, J. O., Vonderhaar, L., & Ochoa, O. (2026) · IEEE International Conference on AI in Cybersecurity (ICAIC) · doi:10.1109/icaic67076.2026.11395773
Fortifying AI Systems: Emerging Threats and Security Countermeasures
Rahaman, H., Chatterjee, A., & Bhunia, S. (2026) · SN Computer Science · doi:10.1007/s42979-025-04658-y
Trust-Model-Based Method for Protecting Global Models in Federated Learning Systems
Krundyshev, V., Cheskidov, V. K., & Kalinin, M. (2025) · Automatic Control and Computer Sciences · doi:10.3103/s0146411625700762
Shielding Against Deception: Fortifying Deepfake Detectors Against Data Poisoning Attacks
Miller, I. J., Cai, C., Cutkosky, M. K., Fan, L., & Lin, D. (2025) · IEEE International Conference on Collaboration and Internet Computing (CIC) · doi:10.1109/cic67133.2025.00016
FABLE: Fairness Attack in Abusive Language Detection
Liang, Y., Cheng, L., Payani, A., & Shu, K. (2025) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata66926.2025.11401648
Overview of Poisoning Attacks and Defence Against Large AI Models
Hou, W., Wen, H., Mao, J., Luo, W., Zhang, P., & Xu, X. (2025) · IEEE International Conference on Artificial Intelligence, Computer Science and Information Processing (AICSIP) · doi:10.1109/aicsip65423.2025.11427220
Mitigating Big Data Pollution and AI Model Deterioration: A Dataset Core Approach with Blockchain-Based Verification
Sgantzos, K., & Ferrara, M. (2026) · WSEAS TRANSACTIONS ON BUSINESS AND ECONOMICS · doi:10.37394/23207.2026.23.11 · Cited by 1
Subtle Data Contamination in Visual AI: Covert Model Backdoors via Resampling Exploits
Jagga, R. T. R. (2025) · IEEE Global Conference on Wireless Computing and Networking (GCWCN) · doi:10.1109/gcwcn66157.2025.11448514
The Confidential Zero-Trust Framework for Securing Generative AI in Healthcare on Google Cloud: An Architectural Blueprint (Preprint)Preprint
Amanna, A., & Shinde, I. (2026) · doi:10.2196/preprints.95739
Robust Image Classification with Quaternion Monogenic Signal ConvNet Under Brightness Changes and Adversarial Attacks
Moya-Sánchez, E. U., García, O. H., Sánchez, A., Salazar-Colores, S., & Hazael, P. (2025) · Springer eBooks · doi:10.1007/978-981-95-0351-3_4
Datascience in support of cybersecurity operations : Adaptable, robust and explainable anomaly detection for security analysts
Dey, A. (2022) · theses.fr (ABES) · doi:10.70675/bbc1d3b6z9f35z4e71za7b8za73d0939f820
Adversarial attacks : a theoretical journey
Meunier, L. (2022) · theses.fr (ABES) · doi:10.70675/c792c77cz8c7bz4930za4fbz79b40c3d10d1
Security architectures for network slice management for 5G and beyond
Saad, S. B. (2023) · doi:10.70675/3d5f78d9z253az4af6zad99zee68fefb4e95
Ditto: An Adaptable and Highly Robust Invisible Backdoor Attack Towards Deep Neural Networks
Zhang, W., Zou, L., Xiong, Y., Shi, P., & He, X. (2026) · Electronics · doi:10.3390/electronics15081551
Learning-in-the-Middle: Explicit-Recursion Anomaly Detection for Critical Infrastructures
Ramezanifarkhani, T., & Teymoori, P. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-16165-9_9
Verifiable Privacy-Preserving Federated Learning Against Poisoning Attacks
Zhang, Y., Xue, H., & Wang, R. (2026) · International Conference on Cryptography, Network Security and Communication Technology (CNSCT) · doi:10.1145/3802927.3802963
Threat Landscape in Federated Learning
Li, K., Yuan, X., & Ni, W. (2026) · Springer series in reliability engineering · doi:10.1007/978-3-032-23959-4_2
Model Poisoning via Variational Graph Representations
Li, K., Yuan, X., & Ni, W. (2026) · Springer series in reliability engineering · doi:10.1007/978-3-032-23959-4_4
Robust Machine Learning Through Mathematical Foundations: Archive Functions and Dataset Core Theory for Adversarial Resilience
Ferrara, M. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-21811-7_24
Poisoning-Assisted Membership Inference in Federated Learning
Luan, X., Bi, Y., Zhang, K., Huang, Z., Su, Z., Luan, T. H., & Hu, B. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2026.3699355 · Cited by 1
A Novel Generative Artificial Intelligence-Empowered Data Poisoning Attack and Its Implications for Cybersecurity
Al-qudah, R., Al‐Amery, A., Khamayseh, Y., & Bhutta, M. N. M. (2026) · SN Computer Science · doi:10.1007/s42979-026-05104-3
AI-Enhanced Secure Software Development Lifecycle and Secure Requirements Engineering
Ramachandran, M. (2026) · Texts in computer science · doi:10.1007/978-3-032-17367-6_7
AI Security and Adversarial Defenses
Ramachandran, M. (2026) · Texts in computer science · doi:10.1007/978-3-032-17367-6_17
Robustness Certificates for Regression Models
Taheri, S., & Zamani, M. (2026) · IEEE Control Systems Letters · doi:10.1109/lcsys.2026.3706921
Ensemble Conformal Predictor (EnCP): A New Conformal Predictor with Robustness Guarantees Against Data Poisoning Attacks
Yang, Y., Li, Q., Feng, R., Shan, L., & Wang, B. (2026) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp63933.2026.00043
Cybersecurity Challenges in AI-Driven English Language Pedagogy
Elamadurthi, R. K., Suryanarayana, G., ChittibabuPutcha, & Chakraborty, A. (2025) · IEEE International Conference on Cybernetics, Cognition and Machine Learning Applications (ICCCMLA) · doi:10.1109/icccmla66092.2025.11580924
A Comprehensive Framework for Secure Multi-Agent Retrieval-Augmented Generation Systems
Ghouil, C., Aloui, R., Khalfaoui, N., Mhatli, S., Aldalbahi, A. S., & Llamas‐Garro, I. (2026) · International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc69287.2026.11579902
AI and the Changing Landscape of Financial Crimes: Understanding Emerging Threats and Building Strategic Responses
Walia, I. K., Tiwari, A., & Rao, K. A. (2026) · Springer eBooks · doi:10.1007/978-3-032-20889-7_7
Computationally Efficient Anomaly Detection and Exclusion for Practical and Robust Federated Learning
Zatsarenko, R., Korobeinikov, D., Chuprov, S., & Reznik, L. (2026) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn69566.2026.00055
TRACER: Temporal retrieval-augmented contextual evaluator for robustness in ML training
shin, J., Jang, J., Park, S., Lee, J., & Choi, D. (2026) · Expert Systems with Applications · doi:10.1016/j.eswa.2026.133668
Covert Attacks on Machine Learning Training in Passively Secure MPC
Jagielski, M., Rachuri, R., Scholl, P., & Escudero, D. (2026) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp68448.2026.00047 · Cited by 1
Self-citation
Enabling Adversarial Robustness in AI Models Through Kubeflow MLOps
Bouras, S., Korontanis, I., Makris, A., & Tserpes, K. (2026) · IEEE International Conference on Mobile Data Management (MDM) · doi:10.1109/mdm71479.2026.00094
Poisoning Attacks in Federated Learning: An Accountability- Oriented Survey with Centralized Learning as a Baseline
Mohammed, S., Alhadidi, D., & Ngom, A. (2026) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp6040133
Assessing Techniques for Reducing Cyber Risks and AI Applications
Alexander, C. A., & Wang, L. (2026) · Journal of Artificial Intelligence Research and Innovation · doi:10.29328/journal.jairi.1001024
A semantic firewall for proactive governance of synthetic tabular data in generative AI pipelines
Shehri, W. A. A. (2026) · Discover Artificial Intelligence · doi:10.1007/s44163-026-02015-3
Data security in large language models: risks, defense, and directions
Chen, K., Zhou, X., Yu, Y., Lin, Y., Chen, H., Cai, C., & Shen, L. (2026) · Journal of King Saud University - Computer and Information Sciences · doi:10.1007/s44443-026-01200-9 · Cited by 2
Exposing Vulnerabilities in AI-Based Malware Detectors: Adversarial, Backdoor, and Poisoning Attacks
Islam, A. U., Islam, A. B. M. R., & Perera, W. S. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-37274-1_3
Adaptive model poisoning detection in federated learning for EV charging networks: a blockchain-anchored explainable AI approach
Rahmati, M., & Rahmati, N. (2026) · Journal of Electrical Systems and Information Technology · doi:10.1186/s43067-026-00401-6
Auditable Feedback Filtering for Autonomous Agents: A Privacy-Preserving Defense Against Feedback Poisoning Using zk-Proofs, OPA, and Post-quantum Cryptography
Katikeri, R., Barla, R., & Vaid, A. (2026) · Communications in computer and information science · doi:10.1007/978-3-032-28460-0_25
Update Instability Score: Structural Validation for Secure AI Supply Chains
Chatterjee, A., Bhattacharjee, P., Arukh, S., Shet, N., Dayananda, P., & L, G. H. (2026) · IEEE International Conference on Electronics, Computing and Communication Technologies (CONECCT) · doi:10.1109/conecct68978.2026.11700631
Securing AI-Driven Systems for Environmental Sustainability in IoT Applications: A Lightweight Message-Authentication Scheme Against Telemetry Poisoning
Alsalem, A. O. (2026) · Sensors · doi:10.3390/s26196276
Analyzing Poisoning Attacks on Machine Learning Systems Built on IoT Data: A Case Study Using Temperature Data
Vuseghesa, F. K., Messai, M.-L., & Bentayeb, F. (2026) · SN Computer Science · doi:10.1007/s42979-026-05397-4
DIRECTIONAL TRANSFER IN CROSS-NETWORK INTRUSION DETECTION: A LAYERED ARCHITECTURE EVALUATED AGAINST MANDATORY CONTROLSPreprint
Esanov, O., & Nazarov, F. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.7607625
Securing artificial intelligence in human resource management: a systematic review and the AI-HRM cybersecurity architecture (AHCA)
Arif, S., & Fernández-Crehuet, J. M. (2026) · Information and Computer Security · doi:10.1108/ics-03-2026-0154
How ViT Backdoors Affect Post-hoc Explanations and What this Means for XAI-Based Defenses
Neuer, N. L., Noppel, M., & Wressnegger, C. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-42939-1_19
Analyzing Federated Learning through an Adversarial Lens
Bhagoji, A. N., Chakraborty, S., Mittal, P., & Calo, S. (2018) · arXiv · doi:10.48550/arxiv.1811.12470 · Cited by 703
Security and Privacy Issues in Deep Learning
Bae, H., Jang, J., Jung, D., Jang, H., Ha, H., Lee, H., & Yoon, S. (2018) · arXiv · doi:10.48550/arxiv.1807.11655 · Cited by 56
DeepObliviate: A Powerful Charm for Erasing Data Residual Memory in Deep Neural Networks
He, Y., Meng, G., Chen, K., He, J., & Hu, X. (2021) · arXiv · doi:10.48550/arxiv.2105.06209 · Cited by 9

Authors: Jagielski, M., Oprea, A., Biggio, B., Liu, C., Nita-Rotaru, C., & Li, B.
Affiliations: Northeastern University (US)
University of Cagliari (IT)
University of California, Berkeley (US)
ORCID: Jagielski, Matthew
Oprea, Alina
Biggio, Battista
Liu, Chang
Nita-Rotaru, Cristina
Venue: 2018 IEEE Symposium on Security and Privacy (SP)
Publisher: IEEE
Published: 2018-05
Pages: 19-35
ISSN: 1081-6011 (ISSN-L)
DOI: 10.1109/sp.2018.00057
OpenAlex: W2962763344
Cited by: 861
References: 52
Citations by year: 2026: 50 · 2025: 114 · 2024: 133 · 2023: 146 · 2022: 120 · 2021: 132 · 2020: 98 · 2019: 54 · 2018: 14
FWCI: 30.43
Type: conference paper
Language: en
Open access: bronze
doi.org
Locations: IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
arXiv (Cornell University) (submittedVersion)
UNICA IRIS Institutional Research Information System (University of Cagliari) (submittedVersion, public-domain)
arXiv (Cornell University)
Funders: National Science Foundation (1238962, 1238959, 1239054, 1239166)
European Commission (780788, EU-H2020, HORIZON2020, H2020)
Defense Advanced Research Projects Agency (FA8750-17-2-0091, FA8750)
Horizon 2020 Framework Programme (EU‐H2020, 780788)
Topics: Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
Keywords: poisoning attacks, linear regression, adversarial learning, statistical attacks, optimization framework, convergence guarantees, health care, loan assessment, real estate

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning

Abstract

Overview

Integrity signals

Verification

Claims the paper makes

Claims other papers make about this one

Self-check

Citations

Cites

Cited by

Related

Metadata

Record

About these checks