The DOI matches its Crossref record; 50 of the 52 references it cites were found in a registry or an index.
Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
Open accessAbstract
As machine learning becomes widely used for automated decisions, attackers have strong incentives to manipulate the results and models generated by machine learning algorithms. In this paper, we perform the first systematic study of poisoning attacks and their countermeasures for linear regression models. In poisoning attacks, attackers deliberately influence the training data to manipulate the results of a predictive model. We propose a theoretically-grounded optimization framework specifically designed for linear regression and demonstrate its effectiveness on a range of datasets and models. We also introduce a fast statistical attack that requires limited knowledge of the training process. Finally, we design a new principled defense method that is highly resilient against all poisoning attacks. We provide formal guarantees about its convergence and an upper bound on the effect of poisoning attacks when the defense is deployed. We evaluate extensively our attacks and defenses on three realistic datasets from health care, loan assessment, and real estate domains.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Persistent, self-modifying memory further introduces risks of silent state corruption, where malicious logic can propagate across future reasoning steps without clear provenance (Jagielski et al., 2018;Li et al., 2022;Steinberger, Peter, 2025b).”
From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Jagielski et al., 2018
Experimental — accuracy not yet measuredIn the citing paper
“Another detection-based defense mechanism uses euclidean distance to expose any deviation in the model update parameters for each client [90].”
From Vulnerabilities in federated learning (2021) · cites this paper as [90]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
The Elements of Statistical Learning
Hastie, T., Tibshirani, R., & Friedman, J. (2009) · Springer Series in Statistics · doi:10.1007/978-0-387-84858-7 · Cited by 25,970
Fischler, M. A., & Bolles, R. C. (1981) · Communications of the ACM · doi:10.1145/358669.358692 · Cited by 25,893
The Elements of Statistical Learning: Data Mining, Inference, and Prediction
Lu, Z. Q. J. (2010) · Journal of the Royal Statistical Society Series A (Statistics in Society) · doi:10.1111/j.1467-985x.2010.00646_6.x · Cited by 12,916
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143
Robust estimation of a location parameter
Huber, P. J. (1964) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177703732 · Cited by 7,228
Robust principal component analysis?
Candès, E. J., Li, X., Ma, Y., & Wright, J. N. (2011) · Journal of the ACM · doi:10.1145/1970392.1970395 · Cited by 7,048
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
The Limitations of Deep Learning in Adversarial Settings
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., & Swami, A. (2016) · 2016 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2016.36 · Cited by 3,993
Research works printed but not linked: 6
- 0, Kaggle House Prices Advanced Regression Techniques
- kan, 0, Lending Club Loan Data
- hao, 2016, PREDA-TOR: Proactive recognition and elimination of domain abuse at time-of-registration, Proceedings of the 23rd ACM Conference on Computer and Communications Security
- faggella, 2016, Machine learning healthcare applications — 2017 and beyond
- 0, PharmGKB Downloads - IWPC Data
- srndic, 0, Mimicus - Contagio Dataset
Cited by
Sorted by citations
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,577
Wild patterns: Ten years after the rise of adversarial machine learning
Biggio, B., & Roli, F. (2018) · Pattern Recognition · doi:10.1016/j.patcog.2018.07.023 · Cited by 1,563
Self-citationA survey on security and privacy of federated learning
Mothukuri, V., Parizi, R. M., Pouriyeh, S., Huang, Y., Dehghantanha, A., & Srivastava, G. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2020.10.007 · Cited by 1,480
Data Poisoning Attacks Against Federated Learning Systems
Tolpegin, V., Truex, S., Gursoy, M. E., & Liu, L. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58951-6_24 · Cited by 927
Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
Fang, M., Cao, X., Jia, J., & Gong, N. Z. (2019) · arXiv · doi:10.48550/arxiv.1911.11815 · Cited by 828
Metadata
- Authors
- Jagielski, M., Oprea, A., Biggio, B., Liu, C., Nita-Rotaru, C., & Li, B.
- Affiliations
- Northeastern University (US)
- University of Cagliari (IT)
- University of California, Berkeley (US)
- Venue
- 2018 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2018-05
- Pages
- 19-35
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2962763344
- Cited by
- 861
- References
- 52
- Citations by year
- 2026: 50 · 2025: 114 · 2024: 133 · 2023: 146 · 2022: 120 · 2021: 132 · 2020: 98 · 2019: 54 · 2018: 14
- FWCI
- 30.43
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- UNICA IRIS Institutional Research Information System (University of Cagliari) (submittedVersion, public-domain)
- arXiv (Cornell University)
- Funders
- National Science Foundation (1238962, 1238959, 1239054, 1239166)
- European Commission (780788, EU-H2020, HORIZON2020, H2020)
- Defense Advanced Research Projects Agency (FA8750-17-2-0091, FA8750)
- Horizon 2020 Framework Programme (EU‐H2020, 780788)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Keywords
- poisoning attacks, linear regression, adversarial learning, statistical attacks, optimization framework, convergence guarantees, health care, loan assessment, real estate
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
