Data Poisoning Attacks against Autoregressive Models
Open accessAbstract
Forecasting models play a key role in money-making ventures in many different markets. Such models are often trained on data from various sources, some of which may be untrustworthy.An actor in a given market may be incentivised to drive predictions in a certain direction to their own benefit.Prior analyses of intelligent adversaries in a machine-learning context have focused on regression and classification.In this paper we address the non-iid setting of time series forecasting.We consider a forecaster, Bob, using a fixed, known model and a recursive forecasting method.An adversary, Alice, aims to pull Bob's forecasts toward her desired target series, and may exercise limited influence on the initial values fed into Bob's model.We consider the class of linear autoregressive models, and a flexible framework of encoding Alice's desires and constraints.We describe a method of calculating Alice's optimal attack that is computationally tractable, and empirically demonstrate its effectiveness compared to random and greedy baselines on synthetic and real-world time series data.We conclude by discussing defensive strategies in the face of Alice-like adversaries.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Previous research on poisoning attacks focuses on scenarios where training samples are collected in a centralized location or sent to a centralized location via a distributed network.
“However, previous researches on poisoning attacks focus on the scenarios that training samples are collected in a centralized location, or the training samples are sent to a centralized location via a distributed network, e.g., support vector machines [5], autoregressive models [1] and collaborative filtering [13].”
From Data Poisoning Attacks on Federated Machine Learning (2022) · cites this paper as [1]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Matplotlib: a 2D graphics environment
Hunter, J. D. (2007) · Computing in Science & Engineering · doi:10.1109/mcse.2007.55 · Cited by 39,249 · see citing works
Time Series Analysis Forecasting and Control.
Bartholomew, D. J., Box, G. E. P., & Jenkins, G. M. (1971) · Operational Research Quarterly (1970-1977) · doi:10.2307/3008255 · Cited by 6,872 · see citing works
Evasion attacks against machine learning at test time
Biggio, B., Corona, I., Maiorca, D., Nelson, B. A., Srndic, N., Laskov, P., Giacinto, G., & Roli, F. (2013) · Cited by 1,658 · see citing works
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331 · see citing works
Foundations of Machine Learning
Mohri, M., Rostamizadeh, A., & Talwalkar, A. (2018) · doi:10.7551/mitpress/10290.001.0001 · Cited by 1,122 · see citing works
Foundations of Machine Learning
(2012) · The MIT Press eBooks · doi:10.7551/mitpress/8291.003.0006 · Cited by 1,102 · see citing works
Dalvi, N. N., Domingos, P. M., Mausam, Sanghai, S. K., & Verma, D. (2004) · Knowledge Discovery and Data Mining · doi:10.1145/1014052.1014066 · Cited by 1,085 · see citing works
Can machine learning be secure?
Barreno, M., Nelson, B. A., Sears, R., Joseph, A. D., & Tygar, J. D. (2006) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/1128817.1128824 · Cited by 852 · see citing works
The security of machine learning
Barreno, M., Nelson, B. A., Joseph, A. D., & Tygar, J. D. (2010) · Machine Learning · doi:10.1007/s10994-010-5188-5 · Cited by 839 · see citing works
An Empirical Comparison of Machine Learning Models for Time Series Forecasting
Ahmed, N. K., Atiya, A. F., Gayar, N. E., & El‐Shishiny, H. (2010) · Econometric Reviews · doi:10.1080/07474938.2010.481556 · Cited by 795 · see citing works
Machine Learning Strategies for Time Series Forecasting
Bontempi, G., Taieb, S. B., & Borgne, Y. L. (2013) · Lecture notes in business information processing · doi:10.1007/978-3-642-36318-4_3 · Cited by 568 · see citing works
Using Machine Teaching to Identify Optimal Training-Set Attacks on Machine Learners
Mei, S., & Zhu, X. (2015) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v29i1.9569 · Cited by 346 · see citing works
Self-citationGood Word Attacks on Statistical Spam Filters.
Lowd, D., & Meek, C. (2005) · Cited by 240 · see citing works
Stackelberg games for adversarial prediction problems
Brückner, M., & Scheffer, T. (2011) · Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining · doi:10.1145/2020408.2020495 · Cited by 229 · see citing works
Machine Teaching: An Inverse Problem to Machine Learning and an Approach Toward Optimal Education
Zhu, X. (2015) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v29i1.9761 · Cited by 221 · see citing works
Self-citationSupport vector machines under adversarial label contamination
Huang, X. X., Biggio, B., Nelson, B. A., Xiao, H., Eckert, C. M., & Roli, F. (2015) · Neurocomputing · doi:10.1016/j.neucom.2014.08.081 · Cited by 220 · see citing works
Undermining an Anomaly-Based Intrusion Detection System Using Common Exploits
Tan, K. M. C., Killourhy, K. S., & Maxion, R. A. (2002) · Lecture notes in computer science · doi:10.1007/3-540-36084-0_4 · Cited by 215 · see citing works
Adversarial Label Flips Attack on Support Vector Machines
Xiao, H., Huang, X. X., & Claudia, E. (2012) · Frontiers in artificial intelligence and applications · doi:10.3233/978-1-61499-098-7-870 · Cited by 180 · see citing works
Static prediction games for adversarial learning problems
Brückner, M., Kanzow, C., & Scheffer, T. (2012) · publish.UP (University of Potsdam) · Cited by 163 · see citing works
Security Evaluation of Support Vector Machines in Adversarial Environments
Biggio, B., Corona, I., Nelson, B. A., Rubinstein, B. I. P., Maiorca, D., Fumera, G., Giacinto, G., & Roli, F. (2014) · Springer eBooks · doi:10.1007/978-3-319-02300-7_4 · Cited by 116 · see citing works
Misleading Learners: Co-opting Your Spam Filter
Nelson, B. A., Barreno, M., Chi, F. J., Joseph, A. D., Rubinstein, B. I. P., Saini, U., Sutton, C. A., Tygar, J. D., & Xia, K. (2009) · Springer eBooks · doi:10.1007/978-0-387-88735-7_2 · Cited by 113 · see citing works
A framework for quantitative security analysis of machine learning
Laskov, P., & Kloft, M. (2009) · doi:10.1145/1654988.1654990 · Cited by 66 · see citing works
Nash Equilibria of Static Prediction Games
Brückner, M., & Scheffer, T. (2009) · Cited by 62 · see citing works
A Game Theoretical Model for Adversarial Learning
Liu, W., & Chawla, S. (2009) · IEEE ... International Conference on Data Mining workshops · doi:10.1109/icdmw.2009.9 · Cited by 62 · see citing works
The Security of Latent Dirichlet Allocation
Mei, S., & Zhu, X. (2015) · Cited by 53 · see citing works
Self-citationUndermining an Anomaly-Based Intrusion Detection System Using Common Exploits
Tan, K.-Y., Killourhy, K. S., & Maxion, R. A. (2002) · Cited by 11 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Adversarial Examples: Attacks and Defenses for Deep Learning
Yuan, X., He, P., Zhu, Q., & Li, X. (2019) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2018.2886017 · Cited by 1,733 · see citing works
A Survey on Federated Learning Systems: Vision, Hype and Reality for Data Privacy and Protection
Li, Q., Wen, Z., Wu, Z., Hu, S., Wang, N., Li, Y., Liu, X., & He, B. (2023) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2021.3124599 · Cited by 1,407 · see citing works
Machine Learning Testing: Survey, Landscapes and Horizons
Zhang, J. M., Harman, M., Ma, L., & Liu, Y. (2022) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2019.2962027 · Cited by 897 · see citing works
Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
Jagielski, M., Oprea, A., Biggio, B., Liu, C., Nita-Rotaru, C., & Li, B. (2018) · 2018 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2018.00057 · Cited by 861 · see citing works
Attack of the tails: Yes, you really can backdoor federated learning
Wang, H., Sreenivasan, K., Rajput, S., Vishwakarma, H., Agarwal, S., Sohn, J.-Y., Lee, K., & Papailiopoulos, D. (2020) · arXiv · doi:10.48550/arxiv.2007.05084 · Cited by 406 · see citing works
Data Poisoning Attacks on Federated Machine Learning
Sun, G., Cong, Y., Dong, J., Wang, Q., Lyu, L., & Liu, J. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3128646 · Cited by 310 · see citing works
Local and Central Differential Privacy for Robustness and Privacy in Federated Learning
Naseri, M., Hayes, J., & De Cristofaro, E. (2022) · Proceedings 2022 Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.23054 · Cited by 188 · see citing works
Reviewing Federated Machine Learning and Its Use in Diseases Prediction
Moshawrab, M., Adda, M., Bouzouane, A., Ibrahim, H., & Raad, A. (2023) · Sensors · doi:10.3390/s23042112 · Cited by 114 · see citing works
Towards Data Poisoning Attacks in Crowd Sensing Systems
Miao, C., Li, Q., Xiao, H., Jiang, W., Huai, M., & Su, L. (2018) · Proceedings of the Eighteenth ACM International Symposium on Mobile Ad Hoc Networking and Computing · doi:10.1145/3209582.3209594 · Cited by 77 · see citing works
DeepPayload: Black-box Backdoor Attack on Deep Learning Models through Neural Payload Injection
Li, Y., Hua, J., Wang, H., Chen, C., & Liu, Y. (2021) · 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE) · doi:10.1109/icse43902.2021.00035 · Cited by 75 · see citing works
Secure and robust machine learning for healthcare: A survey
Qayyum, A., Qadir, J., Bilal, M., & Al-Fuqaha, A. (2021) · IEEE Reviews in Biomedical Engineering · doi:10.1109/rbme.2020.3013489 · Cited by 59 · see citing works
- Authors
- Alfeld, S., Zhu, X., & Barford, P.
- Affiliations
- University of Wisconsin–Madison (US)
- Venue
- Proceedings of the AAAI Conference on Artificial Intelligence
- Published
- 2016-02-21
- Volume
- 30
- Issue
- 1
- ISSN
- 2159-5399 (ISSN-L)
- 2374-3468
- OpenAlex
- W2557044351
- Cited by
- 205
- References
- 26
- Citations by year
- 2026: 2 · 2025: 10 · 2024: 14 · 2023: 25 · 2022: 22 · 2021: 32 · 2020: 37 · 2019: 27 · 2018: 23 · 2017: 11 · 2016: 2
- FWCI
- 11.31
- Type
- conference paper
- Language
- en
- Open access
- diamond
- doi.org
- Locations
- Proceedings of the AAAI Conference on Artificial Intelligence (publishedVersion)
- AAAI Publications (The Association for the Advancement of Artificial Intelligence (AAAI)) (submittedVersion)
- Funders
- National Science Foundation (0953219)
- Wisconsin Alumni Research Foundation
- University of Wisconsin-Madison
- Air Force Research Laboratory (FA8750- 12-2-0328)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Keywords
- data poisoning, autoregressive models, time series forecasting, adversarial learning, recursive forecasting, non-IID data, linear autoregressive models, adversarial defense
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
