The DOI matches its Crossref record; 49 of the 49 references it cites were found in a registry or an index.
Security Evaluation of Pattern Classifiers under Attack
Open accessAbstract
Pattern classification systems are commonly used in adversarial applications, like biometric authentication, network intrusion detection, and spam filtering, in which data can be purposely manipulated by humans to undermine their operation. As this adversarial scenario is not taken into account by classical design methods, pattern classification systems may exhibit vulnerabilities, whose exploitation may severely affect their performance, and consequently limit their practical utility. Extending pattern classification theory and design methods to adversarial settings is thus a novel and very relevant research direction, which has not yet been pursued in a systematic way. In this paper, we address one of the main open issues: evaluating at design phase the security of pattern classifiers, namely, the performance degradation under potential attacks they may incur during operation. We propose a framework for empirical evaluation of classifier security that formalizes and generalizes the main ideas proposed in the literature, and give examples of its use in three real applications. Reported results show that security evaluation can provide a more complete understanding of the classifier's behavior in adversarial environments, and lead to better design choices.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
An Introduction to the Bootstrap
Efron, B., & Tibshirani, R. J. (1994) · doi:10.1201/9780429246593 · Cited by 40,500
An Introduction to the Bootstrap
Efron, B., & Tibshirani, R. J. (1993) · doi:10.1007/978-1-4899-4541-9 · Cited by 21,230
Libsvm : A library for support vector machines
Ferrari, V. (2008) · Medical Entomology and Zoology · Cited by 10,122
Machine learning in automated text categorization
Sebastiani, F. (2002) · ACM Computing Surveys · doi:10.1145/505282.505283 · Cited by 7,926
Abe, S. (2001) · Springer eBooks · doi:10.1007/978-1-4471-0285-4 · Cited by 3,721
(1999) · doi:10.1162/089976600300015565 · Cited by 2,799
Support vector machines for spam categorization
Drucker, H., Wu, D., & Vapnik, V. N. (1999) · IEEE Transactions on Neural Networks · doi:10.1109/72.788645 · Cited by 1,471
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331
Self-citationAn Introduction to the Bootstrap.
Kimber, A., Efron, B., & Tibshirani, R. J. (1994) · The Statistician · doi:10.2307/2348146 · Cited by 1,245
Huang, L., Joseph, A. D., Nelson, B., Rubinstein, B. I. P., & Tygar, J. D. (2011) · Proceedings of the 4th ACM workshop on Security and artificial intelligence · doi:10.1145/2046684.2046692 · Cited by 1,194
Dalvi, N., Domingos, P., Mausam, Sanghai, S., & Verma, D. (2004) · Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining · doi:10.1145/1014052.1014066 · Cited by 887
Anomalous Payload-Based Network Intrusion Detection
Wang, K., & Stolfo, S. J. (2004) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-30143-1_11 · Cited by 842
Can machine learning be secure?
Barreno, M., Nelson, B., Sears, R., Joseph, A. D., & Tygar, J. D. (2006) · Proceedings of the 2006 ACM Symposium on Information, computer and communications security · doi:10.1145/1128817.1128824 · Cited by 836
The security of machine learning
Barreno, M., Nelson, B., Joseph, A. D., & Tygar, J. D. (2010) · Machine Learning · doi:10.1007/s10994-010-5188-5 · Cited by 817
Lowd, D., & Meek, C. (2005) · Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining · doi:10.1145/1081870.1081950 · Cited by 755
Likelihood Ratio-Based Biometric Score Fusion
Nandakumar, K., Chen, Y., Dass, S. C., & Jain, A. K. (2008) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2007.70796 · Cited by 516
Learning in the Presence of Malicious Errors
Kearns, M., & Li, M. (1993) · SIAM Journal on Computing · doi:10.1137/0222052 · Cited by 340
ANTIDOTE: understanding and defending against poisoning of anomaly detectors
Rubinstein, B. I. P., Nelson, B., Huang, L., Joseph, A. D., Lau, S.-H., Rao, S., Taft, N., & Tygar, J. D. (2009) · Proceedings of the 9th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1644893.1644895 · Cited by 331
Exploiting machine learning to subvert your spam filter
Nelson, B. A., Barreno, M., Chi, F. J., Joseph, A. D., Rubinstein, B. I. P., Saini, U., Sutton, C. A., Tygar, J. D., & Xia, K. (2008) · Cited by 322
Nightmare at test time: robust learning by feature deletion
Globerson, A., & Roweis, S. (2006) · Proceedings of the 23rd international conference on Machine learning - ICML '06 · doi:10.1145/1143844.1143889 · Cited by 309
Good Word Attacks on Statistical Spam Filters.
Lowd, D., & Meek, C. (2005) · Cited by 251
Using an Ensemble of One-Class SVM Classifiers to Harden Payload-based Anomaly Detection Systems
Perdisci, R., Gu, G., & Lee, W. (2006) · Sixth International Conference on Data Mining (ICDM'06) · doi:10.1109/icdm.2006.165 · Cited by 239
Casting out Demons: Sanitizing Training Data for Anomaly Sensors
Cretu, G. F., Stavrou, A., Locasto, M. E., Stolfo, S. J., & Keromytis, A. D. (2008) · 2008 IEEE Symposium on Security and Privacy (sp 2008) · doi:10.1109/sp.2008.11 · Cited by 226
Fogla, P., Sharif, M., Perdisci, R., et al. (2006) · Cited by 213
Paragraph: Thwarting Signature Learning by Training Maliciously
Newsome, J., Karp, B., & Song, D. (2006) · Lecture Notes in Computer Science · doi:10.1007/11856214_5 · Cited by 193
Multiple classifier systems for robust classifier design in adversarial environments
Biggio, B., Fumera, G., & Roli, F. (2010) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-010-0007-7 · Cited by 187
Self-citationOn Attacking Statistical Spam Filters.
Wittel, G. L., & Wu, S. F. (2004) · Cited by 180
Static prediction games for adversarial learning problems
Brückner, M., Kanzow, C., & Scheffer, T. (2012) · publish.UP (University of Potsdam) · doi:10.5555/2503308.2503326 · Cited by 162
Vulnerabilities in Biometric Encryption Systems
Adler, A. (2005) · Lecture Notes in Computer Science · doi:10.1007/11527923_114 · Cited by 159
Robustness of multimodal biometric fusion methods against spoof attacks
Rodrigues, R. N., Ling, L. L., & Govindaraju, V. (2009) · Journal of Visual Languages & Computing · doi:10.1016/j.jvlc.2009.01.010 · Cited by 153
Comparing Anomaly Detection Techniques for HTTP
Ingham, K. L., & Inoue, H. (2007) · Lecture notes in computer science · doi:10.1007/978-3-540-74320-0_3 · Cited by 128
Online Anomaly Detection under Adversarial Impact
Kloft, M., & Laskov, P. (2010) · Cited by 126
Machine learning in adversarial environments
Laskov, P., & Lippmann, R. (2010) · Machine Learning · doi:10.1007/s10994-010-5207-6 · Cited by 126
Learning to classify with missing and corrupted features
Dekel, O., Shamir, O., & Xiao, L. (2009) · Machine Learning · doi:10.1007/s10994-009-5124-8 · Cited by 126
Bagging Classifiers for Fighting Poisoning Attacks in Adversarial Classification Tasks
Biggio, B., Corona, I., Fumera, G., Giacinto, G., & Roli, F. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-21557-5_37 · Cited by 114
Self-citationA framework for the evaluation of intrusion detection systems
Cárdenas, Á. A., Baras, J. S., & Seamon, K. (2006) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2006.2 · Cited by 104
Feature weighting for improved classifier robustness
Kołcz, A., & Teo, C.-H. (2009) · ANU Open Research (Australian National University) · Cited by 102
A framework for generating data to simulate changing environments
Narasimhamurthy, A. M., & Kuncheva, L. I. (2007) · Conference on Artificial Intelligence for Applications · Cited by 78
A Multiple Instance Learning Strategy for Combating Good Word Attacks on Spam Filters
Jorgensen, Z., Zhou, Y., & Inge, M. (2008) · Cited by 69
Multimodal fusion vulnerability to non-zero effort (spoof) imposters
Johnson, P. A., Tan, B., & Schuckers, S. (2010) · IEEE International Workshop on Information Forensics and Security · doi:10.1109/wifs.2010.5711469 · Cited by 63
A framework for quantitative security analysis of machine learning
Laskov, P., & Kloft, M. (2009) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/1654988.1654990 · Cited by 62
Adversarial Pattern Classification Using Multiple Classifiers and Randomisation
Biggio, B., Fumera, G., & Roli, F. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-89689-0_54 · Cited by 57
Self-citationPoisoning Adaptive Biometric Systems
Biggio, B., Fumera, G., Roli, F., & Didaci, L. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-34166-3_46 · Cited by 50
Self-citationSculley, D., Wachman, G., & Brodley, C. E. (2006) · Cited by 41
Advanced Allergy Attacks: Does a Corpus Really Help?
Chung, S. P. H., & Mok, A. K. (2007) · Lecture notes in computer science · doi:10.1007/978-3-540-74320-0_13 · Cited by 41
Design of robust classifiers for adversarial environments
Biggio, B., Fumera, G., & Roli, F. (2011) · Conference proceedings/Conference proceedings - IEEE International Conference on Systems, Man, and Cybernetics · doi:10.1109/icsmc.2011.6083796 · Cited by 40
Self-citationMultiple Classifier Systems for Adversarial Classification Tasks
Biggio, B., Fumera, G., & Roli, F. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-02326-2_14 · Cited by 33
Self-citationRobustness of multi-modal biometric verification systems under realistic spoofing attacks
Biggio, B., Akthar, Z., Fumera, G., et al. (2011) · doi:10.1109/ijcb.2011.6117474 · Cited by 20
Self-citationRizzi, S. (2009) · Encyclopedia of Database Systems · doi:10.1007/978-0-387-39940-9_466 · Cited by 14
Cited by
The Limitations of Deep Learning in Adversarial Settings
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., & Swami, A. (2016) · 2016 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2016.36 · Cited by 3,993
Evasion Attacks against Machine Learning at Test Time
Biggio, B., Corona, I., Maiorca, D., Nelson, B., Šrndić, N., Laskov, P., Giacinto, G., & Roli, F. (2013) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-40994-3_25 · Cited by 890
Self-citationManipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
Jagielski, M., Oprea, A., Biggio, B., Liu, C., Nita-Rotaru, C., & Li, B. (2018) · 2018 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2018.00057 · Cited by 861
Self-citationAdversarial Robustness Toolbox v1.0.0
Nicolae, M.-I., Sinn, M., Tran, M. N., Buesser, B., Rawat, A., Wistuba, M., Zantedeschi, V., Baracaldo, N., Chen, B., Ludwig, H., et al. (2018) · arXiv · doi:10.48550/arxiv.1807.01069 · Cited by 594
Towards Making Systems Forget with Machine Unlearning
Cao, Y., & Yang, J. (2015) · 2015 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2015.35 · Cited by 622
Metadata
- Authors
- Biggio, B., Fumera, G., & Roli, F.
- Venue
- IEEE Transactions on Knowledge and Data Engineering
- Published
- 2014-04
- Volume
- 26
- Issue
- 4
- Pages
- 984-996
- ISSN
- 1041-4347 (ISSN-L)
- OpenAlex
- W2144906988
- Cited by
- 411
- References
- 49
- FWCI
- 20.61
- Type
- journal article
- Language
- en
- Open access
- green
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
