CoChat
Sign Up
Cited by 153Adversarial Robustness in Machine LearningPrivacy-Preserving Technologies in DataDigital Media Forensic Detection

Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning

Open access
Cinà, Antonio Emanuele, Grosse, Kathrin, Demontis, Ambra, Vascon, Sebastiano, Zellinger, Werner, Moser, Bernhard A., Oprea, Alina, Biggio, Battista +2 more·2023·ACM Computing Surveys
DOI 10.1145/3585385
Open this paper in CoChat — free accountOpen PDF

Abstract

The success of machine learning is fueled by the increasing availability of computing power and large training datasets. The training data is used to learn new models or update existing ones, assuming that it is sufficiently representative of the data that will be encountered at test time. This assumption is challenged by the threat of poisoning, an attack that manipulates the training data to compromise the model’s performance at test time. Although poisoning has been acknowledged as a relevant threat in industry applications, and a variety of different attacks and defenses have been proposed so far, a complete systematization and critical review of the field is still missing. In this survey, we provide a comprehensive systematization of poisoning attacks and defenses in machine learning, reviewing more than 100 papers published in the field in the past 15 years. We start by categorizing the current threat models and attacks and then organize existing defenses accordingly. While we focus mostly on computer-vision applications, we argue that our systematization also encompasses state-of-the-art attacks and defenses for other data modalities. Finally, we discuss existing resources for research in poisoning and shed light on the current limitations and open research questions in this research field.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1145/3585385

Cites

124 of 124 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Introducing just 3 percent poisoned data can escalate the test error from 12 percent to 23 percent in the IMDB sentiment dataset.

    “Another concern is poisoned data, which can drastically degrade model performance; for instance, experiments with the IMDB sentiment dataset have demonstrated that introducing just 3 percent poisoned data can escalate the test error from 12 percent to 23 percent [174, 175].”

    From Human-inspired Perspectives: A Survey on AI Long-term Memory (2024) · cites this paper as [175]

    The Introduction (page unavailable) says poisoning attacks manipulate training data to degrade test-time performance, supporting the general concern. Searches for IMDB, sentiment analysis, and the stated percentages found no passage reporting that 3% poisoned data raised test error from 12% to 23%. (LLM, conf=0.83)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

1 of the 125 references couldn’t be matched to a known paper.

Research works printed but not linked: 92

  1. Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. 2020. How to backdoor federated learning. In 23rd International Conference on AI and Statistics. PMLR, 2938-2948.
  2. Nathalie Baracaldo, Bryant Chen, Heiko Ludwig, Amir Safavi, and Rui Zhang. 2018. Detecting poisoning attacks on ML in IoT environments. In IEEE International Congress on Internet of Things. IEEE, 57-64.
  3. Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin B. Calo. 2019. Analyzing federated learning through an adversarial lens. In 36th International Conference on Machine Learning. PMLR, 634-643.
  4. Battista Biggio, Blaine Nelson, and Pavel Laskov. 2012. Poisoning attacks against support vector machines. In Inter- national Conference on Machine Learning.
  5. Battista Biggio, Ignazio Pillai, Samuel Rota Bulò, Davide Ariu, Marcello Pelillo, and Fabio Roli. 2013. Is data clustering in adversarial settings secure? In 6th ACM Workshop on Artificial Intelligence and Security 2013. ACM, 87-98.
  6. Battista Biggio, Konrad Rieck, Davide Ariu, Christian Wressnegger, Igino Corona, Giorgio Giacinto, and Fabio Roli. 2014. Poisoning behavioral malware clustering. In 7th ACM Workshop on Artificial Intelligence and Security. ACM, 27-36.
  7. Aleksandar Bojchevski and Stephan Günnemann. 2019. Adversarial attacks on node embeddings via graph poisoning. In International Conference on Machine Learning. 695-704.
  8. Chuanshuai Chen and Jiazhu Dai. 2020. Mitigating backdoor attacks in LSTM-based text classification sys. by back- door keyword identification. arXiv:2007.12070 (2020). · arXiv
  9. Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. 2017. ZOO: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In 10th ACM Workshop on AI and Security (AISec'17). 15-26.
  10. Ruoxin Chen, Zenan Li, Jie Li, Junchi Yan, and Chentao Wu. 2022. On collective robustness of bagging against data poisoning. In International Conference on Machine Learning.
  11. Xiaoyi Chen, Ahmed Salem, Michael Backes, Shiqing Ma, and Yang Zhang. 2021. BadNL: Backdoor attacks against NLP models. In International Conference on Machine Learning Workshop on Adversarial Machine Learning.
  12. Antonio Emanuele Cinà, Sebastiano Vascon, Ambra Demontis, Battista Biggio, Fabio Roli, and Marcello Pelillo. 2021. The hammer and the nut: Is bilevel optimization really needed to poison linear classifiers? In International Joint Conference on Neural Networks. IEEE, 1-8.
  13. G. F. Cretu, A. Stavrou, M. E. Locasto, S. J. Stolfo, and A. D. Keromytis. 2008. Casting out demons: Sanitizing training data for anomaly sensors. In IEEE Symposium on Security and Privacy. 81-95.
  14. Ambra Demontis, Battista Biggio, Giorgio Fumera, Giorgio Giacinto, and Fabio Roli. 2017. Infinity-norm support vector machines against adversarial label contamination. In Italian Conference on Cybersecurity (CEUR Workshop Proceedings, Vol. 1816). CEUR-WS.org, 106-115.
  15. Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, and Fabio Roli. 2019. Why do adversarial attacks transfer? Explaining transferability of evasion and poisoning attacks. In USENIX Security Symposium. USENIX Association, 321-338.
  16. Ilias Diakonikolas, Gautam Kamath, Daniel Kane, Jerry Li, Jacob Steinhardt, and Alistair Stewart. 2019. Sever: A robust meta-algorithm for stochastic optimization. In International Conference on Machine Learning. PMLR, 1596-1606.
  17. Justin Domke. 2012. Generic methods for optimization-based modeling. In 15th International Conference on Artificial Intelligence and Statistics. JMLR, 318-326.
  18. Min Du, Ruoxi Jia, and Dawn Song. 2020. Robust anomaly detection and backdoor attack detection via differential privacy. In International Conference on Learning Representations.
  19. Ji Feng, Qi-Zhi Cai, and Zhi-Hua Zhou. 2019. Learning to confuse: Generating training time adversarial data with auto-encoder. In NeurIPS.
  20. Jiashi Feng, Huan Xu, Shie Mannor, and Shuicheng Yan. 2014. Robust logistic regression and classification. In Inter- national Conference on Advances in Neural Information Processing Systems. 253-261.
  21. Luca Franceschi, Paolo Frasconi, Saverio Salzo, Riccardo Grazzi, and Massimiliano Pontil. 2018. Bilevel programming for hyperparameter optimization and meta-learning. In International Conference on Machine Learning, Vol. 80. PMLR, 1563-1572.
  22. Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C. Ranasinghe, and Surya Nepal. 2019. Strip: A defence against trojan attacks on deep neural networks. In Computer Security Applications Conference. 113-125.
  23. Jonas Geiping, Liam H. Fowl, W. Ronny Huang, Wojciech Czaja, Gavin Taylor, Michael Moeller, and Tom Goldstein. 2021. Witches' brew: Industrial scale data poisoning via gradient matching. In International Conference on Learning Representations. OpenReview.
  24. Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In International Conference on Learning Representations 2015.
  25. Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. BadNets: Identifying vulnerabilities in the ML model supply chain. arXiv (2017).
  26. Junfeng Guo, Ang Li, and Cong Liu. 2022. AEVA: Black-box backdoor detection using adversarial extreme value analysis. In International Conference on Learning Representations.
  27. Yi Han, David Hubczenko, Paul Montague, Olivier De Vel, Tamas Abraham, Benjamin I. P. Rubinstein, Christopher Leckie, Tansu Alpcan, and Sarah Erfani. 2020. Adversarial reinforcement learning under partial observability in autonomous computer network defence. In International Joint Conference on Neural Networks. IEEE, 1-8.
  28. Jonathan Hayase, Weihao Kong, Raghav Somani, and Sewoong Oh. 2021. SPECTRE: Defending against backdoor attacks using robust statistics. In International Conference on Machine Learning. PMLR, 4129-4139.
  29. Jamie Hayes and Olga Ohrimenko. 2018. Contamination attacks and mitigation in multi-party ML. Adv. Neural Inf. Proc Syst. 31 (2018), 6604-6615.
  30. Xiaoling Hu, Xiao Lin, Michael Cogswell, Yi Yao, Susmit Jha, and Chao Chen. 2022. Trigger hunting with a topological prior for trojan detection. In International Conference on Learning Representations.
  31. Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. 2022. Backdoor defense via decoupling the training process. In International Conference on Learning Representations.
  32. W. Ronny Huang, Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein. 2020. MetaPoison: Practical general- purpose clean-label data poisoning. In International Conference on Advances in Neural Information Processing Systems.
  33. Matthew Jagielski, Alina Oprea, Battista Biggio, Chang Liu, Cristina Nita-Rotaru, and Bo Li. 2018. Manipulating ML: Poisoning attacks and countermeasures for regression learning. In IEEE Symposium on Security and Privacy. IEEE, 19-35.
  34. Mojan Javaheripi, Mohammad Samragh, Gregory Fields, Tara Javidi, and Farinaz Koushanfar. 2020. CLEANN: Accel- erated trojan shield for embedded neural networks. In IEEE/ACM International Conference on Computer Aided Design. IEEE, 1-9.
  35. Marius Kloft and Pavel Laskov. 2010. Online anomaly detection under adversarial impact. In International Conference on Artificial Intelligence and Statistics. JMLR, 405-412.
  36. Pang Wei Koh and Percy Liang. 2017. Understanding black-box predictions via influence functions. In International Conference on Machine Learning. PMLR, 1885-1894.
  37. Alexander Levine and Soheil Feizi. 2021. Deep partition aggregation: Provable defenses against general poisoning attacks. In International Conference on Learning Representations.
  38. Lisha Li, Kevin Jamieson, Giulia DeSalvo, Afshin Rostamizadeh, and Ameet Talwalkar. 2017. Hyperband: A novel bandit-based approach to hyperparameter optimization. J. Mach. Learn. Res. 18, 1 (2017), 6765-6816.
  39. Chang Liu, Bo Li, Yevgeniy Vorobeychik, and Alina Oprea. 2017. Robust linear regression against training data poisoning. In 10th ACM Workshop on Artificial Intelligence and Security. ACM, 91-102.
  40. Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018. Fine-pruning: Defending against backdooring attacks on deep neural networks. In International Symposium on Research in Attacks, Intrusions, and Defenses. Springer, 273-294.
  41. Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018. Tro- janing attack on neural networks. In Network and Distributed System Security Symposium. 45-48.
  42. Jonathan Lorraine, Paul Vicol, and David Duvenaud. 2020. Optimizing millions of hyperparameters by implicit dif- ferentiation. In International Conference on AI and Statistics. PMLR, 1540-1552.
  43. Dougal Maclaurin, David Duvenaud, and Ryan P. Adams. 2015. Gradient-based hyperparameter optimization through reversible learning. In 32nd International Conference on Machine Learning. JMLR, 2113-2122.
  44. Shike Mei and Xiaojin Zhu. 2015. Using machine teaching to identify optimal training-set attacks on machine learn- ers. In AAAI Conference on Artificial Intelligence. 2871-2877.
  45. Marco Melis, Ambra Demontis, Maura Pintor, Angelo Sotgiu, and Battista Biggio. 2019. secml: A Python library for secure and explainable ML. arXiv:1912.10013 (2019). · arXiv
  46. Luis Muñoz-González, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C. Lupu, and Fabio Roli. 2017. Towards poisoning of deep learning algorithms with back-gradient optimization. In 10th ACM Workshop on Artificial Intelligence and Security. ACM, 27-38.
  47. Blaine Nelson, Marco Barreno, Fuching Jack Chi, Anthony D. Joseph, Benjamin I. P. Rubinstein, Udam Saini, Charles Sutton, J. D. Tygar, and Kai Xia. 2009. Misleading learners: Co-opting your spam filter. In ML in Cyber Trust. Springer, 17-51.
  48. Blaine Nelson, Marco Barreno, Fuching Jack Chi, Anthony D. Joseph, Benjamin I. P. Rubinstein, Udam Saini, Charles Sutton, J. Doug Tygar, and Kai Xia. 2008. Exploiting ML to subvert your spam filter. In USENIX Workshop on Large- Scale Exploits and Emergent Threats. USENIX, 1-9.
  49. Tuan Anh Nguyen and Anh Tran. 2020. Input-aware dynamic backdoor attack. In International Conference on Ad- vances in Neural Information Processing Systems.
  50. Tuan Anh Nguyen and Anh Tuan Tran. 2021. WaNet-Imperceptible warping-based backdoor attack. In International Conference on Learning Representations. OpenReview.net.
  51. Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. 2016. Transferability in ML: From phenomena to black-box attacks using adversarial samples. arXiv:1605.07277 (2016). · arXiv
  52. Nicolas Papernot, Patrick D. McDaniel, Ian J. Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. 2017. Practical black-box attacks against ML. In ACM Asia Conference on Computer and Communications Security. ACM, 506-519.
  53. Andrea Paudice, Luis Muñoz-González, and Emil C. Lupu. 2018. Label sanitization against label flipping poisoning attacks. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Springer, 5-15.
  54. Ximing Qiao, Yukun Yang, and Hai Li. 2019. Defending neural backdoors via generative distribution modeling. In International Conference on Advances in Neural Information Processing Systems. 14004-14013.
  55. Amin Rakhsha, Goran Radanovic, Rati Devidze, Xiaojin Zhu, and Adish Singla. 2020. Policy teaching via environment poisoning: Training-time adversarial attacks against reinforcement learning. In International Conference on Machine Learning. PMLR, 7974-7984.
  56. Elan Rosenfeld, Ezra Winston, Pradeep Ravikumar, and Zico Kolter. 2020. Certified robustness to label-flipping at- tacks via randomized smoothing. In International Conference on Machine Learning. PMLR, 8230-8241.
  57. Ahmed Salem, Rui Wen, Michael Backes, Shiqing Ma, and Yang Zhang. 2020. Dynamic backdoor attacks against ML models. arXiv (2020).
  58. Avi Schwarzschild, Micah Goldblum, Arjun Gupta, John P. Dickerson, and Tom Goldstein. 2021. Just how toxic is data poisoning? A unified benchmark for backdoor and data poisoning attacks. In International Conference on Machine Learning. PMLR, 9389-9398.
  59. Giorgio Severi, Jim Meyer, Scott Coull, and Alina Oprea. 2021. Explanation-guided backdoor poisoning attacks against malware classifiers. In USENIX Security Symposium.
  60. Ali Shafahi, W. Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Gold- stein. 2018. Poison frogs! Targeted clean-label poisoning attacks on neural networks. In International Conference on Advances in Neural Information Processing Systems. 6106-6116.
  61. Shawn Shan, Arjun Nitin Bhagoji, Haitao Zheng, and Ben Y. Zhao. 2022. Traceback of targeted data poisoning attacks in neural networks. In USENIX Security Symposium. USENIX Association.
  62. David Solans, Battista Biggio, and Carlos Castillo. 2020. Poisoning attacks on algorithmic fairness. In European Con- ference on Machine Learning (ECML) and European Conference on Principles and Practice of Knowledge Discovery in Databases (PKDD). Springer, 162-177.
  63. Ezekiel Soremekun, Sakshi Udeshi, Sudipta Chattopadhyay, and Andreas Zeller. 2020. Exposing backdoors in robust ML models. arXiv (2020).
  64. Jacob Steinhardt, Pang Wei Koh, and Percy Liang. 2017. Certified defenses for data poisoning attacks. In International Conference on Neural Information Processing Systems. 3517-3529.
  65. Octavian Suciu, Radu Marginean, Yigitcan Kaya, Hal Daume III, and Tudor Dumitras. 2018. When does ML FAIL? Generalized transferability for evasion and poisoning attacks. In USENIX Security Symposium. 1299-1316.
  66. Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu. 2020. Data poisoning attacks against federated learning sytems. In European Symposium on Research in Computer Security. Springer, 480-501.
  67. Brandon Tran, Jerry Li, and Aleksander Mądry. 2018. Spectral signatures in backdoor attacks. In Conference on Neural Information Processing Systems. 8011-8021.
  68. Sakshi Udeshi, Shanshan Peng, Gerald Woo, Lionell Loh, Louth Rawshan, and Sudipta Chattopadhyay. 2019. Model agnostic defence against backdoor attacks in ML. arXiv:1908.02203 (2019). · arXiv
  69. Akshaj Kumar Veldanda, Kang Liu, Benjamin Tan, Prashanth Krishnamurthy, Farshad Khorrami, Ramesh Karri, Bren- dan Dolan-Gavitt, and Siddharth Garg. 2021. NNoculation: Catching BadNets in the wild. In 14th ACM Workshop on AI and Security. 49-60.
  70. Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. 2019. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In IEEE Symposium on Security and Privacy, S&P. IEEE, 707-723.
  71. Wenxiao Wang, Alexander J. Levine, and Soheil Feizi. 2022. Improved certified defenses against data poisoning with (deterministic) finite aggregation. In International Conference on Machine Learning. PMLR, 22769-22783.
  72. Emily Wenger, Josephine Passananti, Arjun Nitin Bhagoji, Yuanshun Yao, Haitao Zheng, and Ben Y. Zhao. 2021. Backdoor attacks against deep learning sys. in the physical world. In IEEE/CVF International Conference on Computer Vision. 6202-6211.
  73. Dongxian Wu and Yisen Wang. 2021. Adversarial neuron pruning purifies backdoored deep models. In International Conference on Neural Information Processing Systems.
  74. Zhaohan Xi, Ren Pang, Shouling Ji, and Ting Wang. 2021. Graph backdoor. In USENIX Security Symposium. 1523-1540.
  75. Zhen Xiang, David Miller, and George Kesidis. 2022. Post-training detection of backdoor attacks for two-class and multi-attack scenarios. In International Conference on Learning Representations.
  76. Zhen Xiang, David J. Miller, and George Kesidis. 2019. A benchmark study of backdoor data poisoning defenses for deep neural network classifiers and a novel defense. In IEEE 29th International Workshop on Machine Learning for Signal Processing. IEEE, 1-6.
  77. Huang Xiao, Battista Biggio, Gavin Brown, Giorgio Fumera, Claudia Eckert, and Fabio Roli. 2015. Is feature selection secure against training data poisoning? In 32nd International Conference on Machine Learning. JMLR, 1689-1698.
  78. Han Xiao, Huang Xiao, and Claudia Eckert. 2012. Adversarial label flips attack on support vector machines. In 20th European Conference on Artificial Intelligence. Including Prestigious Applications of AI. IOS Press, 870-875.
  79. Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. 2020. DBA: Distributed backdoor attacks against federated learning. In International Conference on Learning Representations. OpenReview.
  80. Hang Xu, Rundong Wang, Lev Raizman, and Zinovi Rabinovich. 2021. Transferable environment poisoning: Training- time attack on reinforcement learning. In 20th International Conference on Autonomous Agents and MultiAgent Sys- tems. 1398-1406.
  81. Xiaojun Xu, Qi Wang, Huichen Li, Nikita Borisov, Carl A. Gunter, and Bo Li. 2021. Detecting AI trojans using meta neural analysis. In IEEE Symposium on Security and Privacy. IEEE, 103-120.
  82. Yu Yang, Tian Yu Liu, and Baharan Mirzasoleiman. 2022. Not All poisons are created equal: Robust training against data poisoning. In International Conference on Machine Learning. PMLR, 25154-25165.
  83. Kota Yoshida and Takeshi Fujino. 2020. Disabling backdoor and identifying poison data by using knowledge distilla- tion in backdoor attacks on deep neural networks. In 13th ACM Workshop on AI and Security. 117-127.
  84. Steven R. Young, Derek C. Rose, Thomas P. Karnowski, Seung-Hwan Lim, and Robert M. Patton. 2015. Optimizing deep learning hyper-parameters through an evolutionary algorithm. In Workshop on Machine Learning in High- performance Computing Environments. 1-5.
  85. Yi Zeng, Si Chen, Won Park, Zhuoqing Mao, Ming Jin, and Ruoxi Jia. 2022. Adversarial unlearning of backdoors via implicit hypergradient. In International Conference on Learning Representations.
  86. Xuezhou Zhang, Yuzhe Ma, Adish Singla, and Xiaojin Zhu. 2020. Adaptive reward-poisoning attacks against rein- forcement learning. In International Conference on Machine Learning. PMLR, 11225-11234.
  87. Zaixi Zhang, Jinyuan Jia, Binghui Wang, and Neil Zhenqiang Gong. 2021. Backdoor attacks to graph neural networks. In 26th ACM Symposium on Access Control Models and Technologies. ACM, 15-26.
  88. Pu Zhao, Pin-Yu Chen, Payel Das, Karthikeyan Natesan Ramamurthy, and Xue Lin. 2020. Bridging mode connectivity in loss landscapes and adversarial robustness. In International Conference on Learning Representations.
  89. Ying Zhao, Junjun Chen, Jiale Zhang, Di Wu, Jian Teng, and Shui Yu. 2019. PDGAN: A novel poisoning defense method in federated learning using generative adversarial network. In International Conference on Algorithms and Architectures for Parallel Processing. Springer, 595-609.
  90. Chen Zhu, W. Ronny Huang, Hengduo Li, Gavin Taylor, Christoph Studer, and Tom Goldstein. 2019. Transferable clean-label poisoning attacks on deep neural nets. In 36th International Conference on Machine Learning. PMLR, 7614-7623.
  91. Liuwan Zhu, Rui Ning, Cong Wang, Chunsheng Xin, and Hongyi Wu. 2020. Gangsweep: Sweep out neural backdoors by GAN. In 28th ACM International Conference on Multimedia. 3173-3181.
  92. Daniel Zügner and Stephan Günnemann. 2019. Adversarial attacks on graph neural networks via meta learning. In International Conference on Learning Representations. OpenReview.net.

Cited by

Sorted by citations

Related

Authors
Cinà, A. E., Grosse, K., Demontis, A., Vascon, S., Zellinger, W., Moser, B. A., Oprea, A., Biggio, B., Pelillo, M., & Roli, F.
Affiliations
  • DAIS, Ca’ Foscari University of Venice, Italy
  • École Polytechnique Fédérale de Lausanne (CH)
  • University of Cagliari (IT)
  • Ca' Foscari University of Venice (IT)
  • Software Competence Center Hagenberg (Austria) (AT)
  • Northeastern University (US)
  • University of Genoa (IT)
ORCID
Venue
ACM Computing Surveys
Publisher
Association for Computing Machinery (ACM)
Published
2023-07-13
Volume
55
Issue
13s
Pages
1-39
ISSN
  • 0360-0300 (ISSN-L)
  • 1557-7341
DOI
10.1145/3585385
OpenAlex
W4322736917
Cited by
152
References
125
Citations by year
2026: 34 · 2025: 55 · 2024: 47 · 2023: 12 · 2022: 4
FWCI
13.95
Type
journal article
Language
en
Open access
Licence
www.acm.org/publications/policies/copyright_policy#Background (vor)
Locations
  • ACM Computing Surveys (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • UNICA IRIS Institutional Research Information System (University of Cagliari) (submittedVersion, other-oa)
  • ARCA (Università Ca' Foscari Venezia) (submittedVersion, other-oa)
  • Infoscience (Ecole Polytechnique Fédérale de Lausanne) (submittedVersion, cc-by-nc-nd)
  • CINECA IRIS Institutial Research Information System (University of Genoa) (submittedVersion)
  • arXiv (Cornell University)
Funders
  • PRIN 2017 project RexLearn (2017TWNMH2)
  • Italian Ministry of Education, University and Research
  • EU’s Horizon Europe research and innovation program under the project ELSA (101070617)
  • “TrustML: Towards Machine Learning that Humans Can Trust,” (F73C22001320007)
  • Fondazione di Sardegna; the NRRP MUR program funded by the EU - NGEU under the project SERICS (PE00000014)
  • COMET Programme managed by FFG in the COMET Module S3AI
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
Keywords
data poisoning, machine learning security, poisoning attacks, poisoning defense, threat model, computer vision, adversarial learning

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review