Poisoning Attacks against Support Vector Machines
Open accessAbstract
We investigate a family of poisoning attacks against Support Vector Machines (SVM). Such attacks inject specially crafted training data that increases the SVM's test error. Central to the motivation for these attacks is the fact that most learning algorithms assume that their training data comes from a natural or well-behaved distribution. However, this assumption does not generally hold in security-sensitive settings. As we demonstrate, an intelligent adversary can, to some extent, predict the change of the SVM's decision function due to malicious input and use this ability to construct malicious data. The proposed attack uses a gradient ascent strategy in which the gradient is computed based on properties of the SVM's optimal solution. This method can be kernelized and enables the attack to be constructed in the input space even for non-linear kernels. We experimentally demonstrate that our gradient ascent procedure reliably identifies good local maxima of the non-convex validation error surface, which significantly increases the classifier's test error.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
AI security has remained largely model-centric, focused on single-agent attack surfaces and adversarial samples.
“AI security, by contrast, has remained largely model-centric, focused on single-agent attack surfaces and adversarial samples (Biggio et al., 2012;Szegedy et al., 2014;Zou et al., 2023).”
From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Biggio et al., 2012
The Introduction (p. 2) examines an attack by one adversary against an SVM using a crafted data point, supporting this paper as an example of model-focused security research. The paper does not establish that AI security as a field has remained largely model-centric or focused on single-agent attacks, and its crafted inputs are poisoning data rather than necessarily the broader category of adversarial samples. (LLM, conf=0.86)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
No references could be resolved yet.
Research works printed but not linked: 21
- Barreno, Marco, Nelson, Blaine, Sears, Russell, Joseph, Anthony D., and Tygar, J. D. Can machine learning be secure? In Proceedings of the ACM Symposium on Information, Computer and Communications Security (ASIACCS) , pp. 16-25, 2006.
- Barreno, Marco, Nelson, Blaine, Joseph, Anthony D., and Tygar, J. D. The security of machine learning. Machine Learning , 81(2):121-148, November 2010.
- Biggio, Battista, Fumera, Giorgio, and Roli, Fabio. Multiple classifier systems for robust classifier design in adversarial environments. International Journal of Machine Learning and Cybernetics , 1(1):27-41, 2010.
- Bolton, Richard J. and Hand, David J. Statistical fraud detection: A review. Journal of Statistical Science , 17 (3):235-255, 2002.
- Br¨ uckner, Michael and Scheffer, Tobias. Nash equilibria of static prediction games. In Advances in Neural Information Processing Systems (NIPS) , pp. 171-179. 2009.
- Cauwenberghs, Gert and Poggio, Tomaso. Incremental and decremental support vector machine learning. In Leen, T.K., Diettrich, T.G., and Tresp, V. (eds.), Advances in Neural Information Processing Systems 13 , pp. 409-415, 2001.
- Cova, M., Kruegel, C., and Vigna, G. Detection and analysis of drive-by-download attacks and malicious JavaScript code. In International Conference on World Wide Web (WWW) , pp. 281-290, 2010.
- Curtsinger, C., Livshits, B., Zorn, B., and Seifert, C. ZOZZLE: Fast and precise in-browser JavaScript malware detection. In USENIX Security Symposium , pp. 33-48, 2011.
- Dekel, O., Shamir, O., and Xiao, L. Learning to classify with missing and corrupted features. Machine Learning , 81(2):149-178, 2010.
- Forrest, Stephanie, Hofmeyr, Steven A., Somayaji, Anil, and Longstaff, Thomas A. A sense of self for unix processes. In Proceedings of the IEEE Symposium on Security and Privacy , pp. 120-128, 1996.
- Globerson, A. and Roweis, S. Nightmare at test time: Robust learning by feature deletion. In International Conference on Machine Learning (ICML) , pp. 353-360, 2006.
- Kloft, Marius and Laskov, Pavel. Online anomaly detection under adversarial impact. In Proceedings of the 13th International Conference on Artificial Intelligence and Statistics (AISTATS) , 2010.
- Laskov, Pavel and ˇ Srndi´ c, Nedim. Static detection of malicious JavaScript-bearing PDF documents. In Proceedings of the Annual Computer Security Applications Conference (ACSAC) , December 2011.
- LeCun, Y., Jackel, L., Bottou, L., Brunot, A., Cortes, C., Denker, J., Drucker, H., Guyon, I., M¨ uller, U., S¨ ackinger, E., Simard, P., and Vapnik, V. Comparison of learning algorithms for handwritten digit recognition. In Int'l Conf. on Artificial Neural Networks , pp. 53-60, 1995.
- L¨ utkepohl, Helmut. Handbook of matrices . John Wiley & Sons, 1996.
- Meyer, Tony A. and Whateley, Brendon. SpamBayes: Effective open-source, Bayesian based, email classification system. In Proceedings of the Conference on Email and Anti-Spam (CEAS) , July 2004.
- Nelson, Blaine, Barreno, Marco, Chi, Fuching Jack, Joseph, Anthony D., Rubinstein, Benjamin I. P., Saini, Udam, Sutton, Charles, Tygar, J. D., and Xia, Kai. Exploiting machine learning to subvert your spam filter. In Proceedings of the 1st USENIX Workshop on LargeScale Exploits and Emergent Threats (LEET) , pp. 1-9, 2008.
- Rieck, K., Kr¨ uger, T., and Dewald, A. Cujo: Efficient detection and prevention of drive-by-download attacks. In Proceedings of the Annual Computer Security Applications Conference (ACSAC) , pp. 31-39, 2010.
- Rubinstein, Benjamin I. P., Nelson, Blaine, Huang, Ling, Joseph, Anthony D., hon Lau, Shing, Rao, Satish, Taft, Nina, and Tygar, J. D. ANTIDOTE: Understanding and defending against poisoning of anomaly detectors. In Proceedings of the 9th ACM SIGCOMM Conference on Internet Measurement (IMC) , pp. 1-14, 2009.
- Stolfo, Salvatore J., Hershkop, Shlomo, Wang, Ke, Nimeskern, Olivier, and Hu, Chia-Wei. A behaviorbased approach to securing email systems. In Mathematical Methods, Models and Architectures for Computer Networks Security . Springer-Verlag, 2003.
- Teo, C.H., Globerson, A., Roweis, S., and Smola, A. Convex learning with invariances. In Advances in Neural Information Proccessing Systems (NIPS) , pp. 1489-1496, 2008.
Cited by
Sorted by citations
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772 · see citing works
The Limitations of Deep Learning in Adversarial Settings
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., & Swami, A. (2016) · 2016 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2016.36 · Cited by 3,993 · see citing works
On the Opportunities and Risks of Foundation Models
Bommasani, R., Hudson, D. A., Adeli, E., Altman, R., Arora, S., von Arx, S., Bernstein, M. S., Bohg, J., Bosselut, A., Brunskill, E., et al. (2021) · arXiv · doi:10.48550/arxiv.2108.07258 · Cited by 2,676 · see citing works
Adversarial Examples: Attacks and Defenses for Deep Learning
Yuan, X., He, P., Zhu, Q., & Li, X. (2019) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2018.2886017 · Cited by 1,733 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
A survey on security and privacy of federated learning
Mothukuri, V., Parizi, R. M., Pouriyeh, S., Huang, Y., Dehghantanha, A., & Srivastava, G. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2020.10.007 · Cited by 1,480 · see citing works
Huang, L., Joseph, A. D., Nelson, B., Rubinstein, B. I. P., & Tygar, J. D. (2011) · Proceedings of the 4th ACM workshop on Security and artificial intelligence · doi:10.1145/2046684.2046692 · Cited by 1,194 · see citing works
Self-citationData Poisoning Attacks Against Federated Learning Systems
Tolpegin, V., Truex, S., Gursoy, M. E., & Liu, L. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58951-6_24 · Cited by 927 · see citing works
FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping
Cao, X., Fang, M., Liu, J., & Gong, N. Z. (2021) · Proceedings 2021 Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24434 · Cited by 999 · see citing works
Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
Jagielski, M., Oprea, A., Biggio, B., Liu, C., Nita-Rotaru, C., & Li, B. (2018) · 2018 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2018.00057 · Cited by 861 · see citing works
Self-citationBourtoule, L., Chandrasekaran, V., Choquette-Choo, C. A., Jia, H., Travers, A., Zhang, B., Lie, D., & Papernot, N. (2021) · 2021 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40001.2021.00019 · Cited by 810 · see citing works
DÏoT: A Federated Self-learning Anomaly Detection System for IoT
Nguyen, T. D., Marchal, S., Miettinen, M., Fereidooni, H., Asokan, N., & Sadeghi, A.-R. (2019) · 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs.2019.00080 · Cited by 663 · see citing works
Towards Making Systems Forget with Machine Unlearning
Cao, Y., & Yang, J. (2015) · 2015 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2015.35 · Cited by 622 · see citing works
Manipulating the Byzantine: Optimizing Model Poisoning Attacks and Defenses for Federated Learning
Shejwalkar, V., & Houmansadr, A. (2021) · Proceedings 2021 Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24498 · Cited by 615 · see citing works
Privacy and Robustness in Federated Learning: Attacks and Defenses
Lyu, L., Yu, H., Ma, X., Chen, C., Sun, L., Zhao, J., Yang, Q., & Yu, P. S. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3216981 · Cited by 548 · see citing works
Machine Learning Models that Remember Too Much
Song, C., Ristenpart, T., & Shmatikov, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134077 · Cited by 526 · see citing works
Lyu, L., Yu, H., Zhao, J., & Yang, Q. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-63076-8_1 · Cited by 444 · see citing works
Attack of the tails: Yes, you really can backdoor federated learning
Wang, H., Sreenivasan, K., Rajput, S., Vishwakarma, H., Agarwal, S., Sohn, J.-Y., Lee, K., & Papailiopoulos, D. (2020) · arXiv · doi:10.48550/arxiv.2007.05084 · Cited by 406 · see citing works
Mitigating Sybils in Federated Learning Poisoning
Fung, C., Yoon, C. J. M., & Beschastnikh, I. (2018) · arXiv · doi:10.48550/arxiv.1808.04866 · Cited by 385 · see citing works
Privacy preservation in federated learning: An insightful survey from the GDPR perspective
Truong, N., Sun, K., Wang, S., Guitton, F., & Guo, Y. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102402 · Cited by 399 · see citing works
Biscotti: A blockchain system for private and secure federated learning
Shayan, M., Fung, C., Yoon, C. J. M., & Beschastnikh, I. (2021) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2020.3044223 · Cited by 354 · see citing works
Privacy-Enhanced Federated Learning Against Poisoning Adversaries
Liu, X., Li, H., Xu, G., Chen, Z., Huang, X., & Lu, R. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3108434 · Cited by 351 · see citing works
Using Machine Teaching to Identify Optimal Training-Set Attacks on Machine Learners
Mei, S., & Zhu, X. (2015) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v29i1.9569 · Cited by 346 · see citing works
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., & Goldstein, T. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3162397 · Cited by 362 · see citing works
Chained Anomaly Detection Models for Federated Learning: An Intrusion Detection Case Study
Preuveneers, D., Rimmer, V., Tsingenopoulos, I., Spooren, J., Joosen, W., & Ilie-Zudor, E. (2018) · Applied Sciences · doi:10.3390/app8122663 · Cited by 323 · see citing works
DeepInspect: A Black-box Trojan Detection and Mitigation Framework for Deep Neural Networks
Chen, H., Fu, C., Zhao, J., & Koushanfar, F. (2019) · Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/647 · Cited by 314 · see citing works
Data Poisoning Attacks on Federated Machine Learning
Sun, G., Cong, Y., Dong, J., Wang, Q., Lyu, L., & Liu, J. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3128646 · Cited by 310 · see citing works
PoisonGAN: Generative Poisoning Attacks Against Federated Learning in Edge Computing Systems
Zhang, J., Chen, B., Cheng, X., Binh, H. T. T., & Yu, S. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3023126 · Cited by 291 · see citing works
Federated learning in a medical context: A systematic literature review
Pfitzner, B., Steckhan, N., & Arnrich, B. (2021) · ACM Transactions on Internet Technology · doi:10.1145/3412357 · Cited by 288 · see citing works
Shejwalkar, V., Houmansadr, A., Kairouz, P., & Ramage, D. (2022) · 2022 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp46214.2022.9833647 · Cited by 292 · see citing works
Understanding Distributed Poisoning Attack in Federated Learning
Cao, D., Chang, S., Lin, Z., Liu, G., & Sun, D. (2019) · 2019 IEEE 25th International Conference on Parallel and Distributed Systems (ICPADS) · doi:10.1109/icpads47876.2019.00042 · Cited by 285 · see citing works
Liu, Y., Xie, Y., & Srivastava, A. (2017) · 2017 IEEE International Conference on Computer Design (ICCD) · doi:10.1109/iccd.2017.16 · Cited by 241 · see citing works
A <scp>uror</scp>: defending against poisoning attacks in collaborative deep learning systems
Shen, S., Tople, S., & Saxena, P. (2016) · Proceedings of the 32nd Annual Conference on Computer Security Applications · doi:10.1145/2991079.2991125 · Cited by 228 · see citing works
Data Poisoning Attacks against Autoregressive Models
Alfeld, S., Zhu, X., & Barford, P. (2016) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v30i1.10237 · Cited by 205 · see citing works
When Machine Learning Meets Privacy in 6G: A Survey
Sun, Y., Liu, J., Wang, J., Cao, Y., & Kato, N. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.3011561 · Cited by 211 · see citing works
Poisoning attacks in federated learning: A survey
Xia, G., Chen, J., Yu, C., & Ma, J. (2023) · IEEE Access · doi:10.1109/access.2023.3238823 · Cited by 212 · see citing works
Wang, T., Zhu, J.-Y., Torralba, A., & Efros, A. A. (2018) · arXiv · doi:10.48550/arxiv.1811.10959 · Cited by 194 · see citing works
Privacy Risks of General-Purpose Language Models
Pan, X., Zhang, M., Ji, S., & Yang, M. (2020) · 2020 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40000.2020.00095 · Cited by 188 · see citing works
Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Data
Yu, N., Skripniuk, V., Abdelnabi, S., & Fritz, M. (2021) · 2021 IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01418 · Cited by 195 · see citing works
Deep Model Poisoning Attack on Federated Learning
Zhou, X., Xu, M., Wu, Y., & Zheng, N. (2021) · Future Internet · doi:10.3390/fi13030073 · Cited by 170 · see citing works
CONTRA: Defending Against Poisoning Attacks in Federated Learning
Awan, S., Luo, B., & Li, F. (2021) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-88418-5_22 · Cited by 182 · see citing works
The Curse of Recursion: Training on Generated Data Makes Models Forget
Shumailov, I., Shumaylov, Z., Zhao, Y., Gal, Y., Papernot, N., & Anderson, R. (2023) · arXiv · doi:10.48550/arxiv.2305.17493 · Cited by 151 · see citing works
Local and Central Differential Privacy for Robustness and Privacy in Federated Learning
Naseri, M., Hayes, J., & De Cristofaro, E. (2022) · Proceedings 2022 Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.23054 · Cited by 188 · see citing works
Poisoning Web-Scale Training Datasets is Practical
Carlini, N., Jagielski, M., Choquette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., & Tramèr, F. (2024) · 2024 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp54263.2024.00179 · Cited by 138 · see citing works
PyTorchFI: A Runtime Perturbation Tool for DNNs
Mahmoud, A., Aggarwal, N., Nobbe, A., Vicarte, J. R. S., Adve, S. V., Fletcher, C. W., Frosio, I., & Hari, S. K. S. (2020) · 2020 50th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W) · doi:10.1109/dsn-w50199.2020.00014 · Cited by 140 · see citing works
Poisoning Web-Scale Training Datasets is Practical
Carlini, N., Jagielski, M., Choquette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., & Tramèr, F. (2023) · arXiv · doi:10.48550/arxiv.2302.10149 · Cited by 138 · see citing works
“Uncurated training datasets are prime targets for poisoning attacks [6].”
BackgroundConcealed Data Poisoning Attacks on NLP Models
Wallace, E., Zhao, T., Feng, S., & Singh, S. (2021) · Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies · doi:10.18653/v1/2021.naacl-main.13 · Cited by 115 · see citing works
Mitigating Poisoning Attacks on Machine Learning Models: A Data Provenance Based Approach
Baracaldo, N., Chen, B., Ludwig, H., & Safavi, J. A. (2017) · Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security · doi:10.1145/3128572.3140450 · Cited by 108 · see citing works
FL-Defender: Combating targeted attacks in federated learning
Jebreel, N. M., & Domingo-Ferrer, J. (2023) · Knowledge-Based Systems · doi:10.1016/j.knosys.2022.110178 · Cited by 110 · see citing works
Privacy in Deep Learning: A Survey
Mireshghallah, F., Taram, M., Vepakomma, P., Singh, A., Raskar, R., & Esmaeilzadeh, H. (2020) · arXiv · doi:10.48550/arxiv.2004.12254 · Cited by 106 · see citing works
An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defences
Guo, W., Tondi, B., & Barni, M. (2022) · IEEE Open Journal of Signal Processing · doi:10.1109/ojsp.2022.3190213 · Cited by 91 · see citing works
Subpopulation Data Poisoning Attacks
Jagielski, M., Severi, G., Pousette Harger, N., & Oprea, A. (2021) · Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3460120.3485368 · Cited by 86 · see citing works
Towards Data Poisoning Attacks in Crowd Sensing Systems
Miao, C., Li, Q., Xiao, H., Jiang, W., Huai, M., & Su, L. (2018) · Proceedings of the Eighteenth ACM International Symposium on Mobile Ad Hoc Networking and Computing · doi:10.1145/3209582.3209594 · Cited by 77 · see citing works
Adversarial Label-Flipping Attack and Defense for Graph Neural Networks
Zhang, M., Hu, L., Shi, C., & Wang, X. (2020) · 2020 IEEE International Conference on Data Mining (ICDM) · doi:10.1109/icdm50108.2020.00088 · Cited by 74 · see citing works
A robust analysis of adversarial attacks on federated learning environments
Nair, A. K., Raj, E. D., & Sahoo, J. (2023) · Computer Standards & Interfaces · doi:10.1016/j.csi.2023.103723 · Cited by 70 · see citing works
Hard to Forget: Poisoning Attacks on Certified Machine Unlearning
Marchant, N. G., Rubinstein, B. I. P., & Alfeld, S. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i7.20736 · Cited by 64 · see citing works
“Following standard threat models in the data poisoning literature (Biggio, Nelson, and Laskov, 2012; Muñoz-González et al., 2017; Shafahi et al., 2018; Shen, Xiaolei Zhu, and Ma, 2019; W. R. Huang et al., 2020) we consider attackers with white-box and grey-box access.”
Property Inference from Poisoning
Mahloujifar, S., Ghosh, E., & Chase, M. (2022) · 2022 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp46214.2022.9833623 · Cited by 67 · see citing works
Secure and robust machine learning for healthcare: A survey
Qayyum, A., Qadir, J., Bilal, M., & Al-Fuqaha, A. (2021) · IEEE Reviews in Biomedical Engineering · doi:10.1109/rbme.2020.3013489 · Cited by 59 · see citing works
Pocket diagnosis: Secure federated learning against poisoning attack in the cloud
Ma, Z., Ma, J., Miao, Y., Liu, X., Choo, K.-K. R., & Deng, R. H. (2022) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2021.3090771 · Cited by 50 · see citing works
FENCE: Feasible Evasion Attacks on Neural Networks in Constrained Environments
Chernikova, A., & Oprea, A. (2022) · ACM Transactions on Privacy and Security · doi:10.1145/3544746 · Cited by 52 · see citing works
DeSMP: Differential Privacy-exploited Stealthy Model Poisoning Attacks in Federated Learning
Hossain, M. T., Islam, S., Badsha, S., & Shen, H. (2021) · 2021 17th International Conference on Mobility, Sensing and Networking (MSN) · doi:10.1109/msn53354.2021.00038 · Cited by 44 · see citing works
Evaluating model drift in machine learning algorithms
Nelson, K., Corbin, G., Anania, M., Kovacs, M., Tobias, J., & Blowers, M. (2015) · 2015 IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA) · doi:10.1109/cisda.2015.7208643 · Cited by 31 · see citing works
Model poisoning attacks against distributed machine learning systems
Tomsett, R., Chan, K. S., & Chakraborty, S. (2019) · Artificial Intelligence and Machine Learning for Multi-Domain Operations Applications · doi:10.1117/12.2520275 · Cited by 27 · see citing works
Robust federated learning with attack-adaptive aggregation
Wan, C. P. (2022) · doi:10.14711/thesis-991012994506603412 · Cited by 24 · see citing works
“(2018) suggested that the label flipping attack (Biggio et al., 2012), which changes the label of a certain class, can already be an effective attack if there are no defenses.”
CUDA: Convolution-Based Unlearnable Datasets
Sadasivan, V. S., Soltanolkotabi, M., & Feizi, S. (2023) · 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr52729.2023.00376 · Cited by 24 · see citing works
On the Detection of Shilling Attacks in Federated Collaborative Filtering
Jiang, Y., Zhou, Y., Wu, D., Li, C., & Wang, Y. (2020) · 2020 International Symposium on Reliable Distributed Systems (SRDS) · doi:10.1109/srds51746.2020.00026 · Cited by 22 · see citing works
Tangle Ledger for Decentralized Learning
Schmid, R., Pfitzner, B., Beilharz, J., Arnrich, B., & Polze, A. (2020) · 2020 IEEE International Parallel and Distributed Processing Symposium Workshops (IPDPSW) · doi:10.1109/ipdpsw50202.2020.00144 · Cited by 17 · see citing works
DDoD: Dual Denial of Decision Attacks on Human-AI Teams
Tag, B., van Berkel, N., Verma, S., Zhao, B. Z. H., Berkovsky, S., Kaafar, D., Kostakos, V., & Ohrimenko, O. (2023) · IEEE Pervasive Computing · doi:10.1109/mprv.2022.3218773 · Cited by 15 · see citing works
Hidden Trigger Backdoor Attacks
Saha, A., Subramanya, A., & Pirsiavash, H. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i07.6871 · Cited by 13 · see citing works
Universal Jailbreak Backdoors from Poisoned Human Feedback
Rando, J., & Tramèr, F. (2023) · arXiv · doi:10.48550/arxiv.2311.14455 · Cited by 10 · see citing works
Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents
de Witt, C. S., Krawiecka, K., Krawczuk, I., Hagag, B., Anderson, W. L., Belcak, P., Bucknall, B., Cai, X., Chopra, A., Cohen, D., et al. (2025) · arXiv · doi:10.48550/arxiv.2505.02077 · Cited by 2 · see citing works
“AI security , by contrast, has remained largely model-centric, focusing on single-agent attack surfaces - from jailbreak exploits and prompt injections (Zou et al., 2023) to data poisoning (Biggio et al., 2012) and adversarial samples (Szegedy et al., 2014).”
- Authors
- Biggio, B., Nelson, B., & Laskov, P.
- Affiliations
- University of Cagliari (IT)
- University of Tübingen (DE)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2012
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 1206.6389
- OpenAlex
- W2112507308
- Cited by
- 1,331
- References
- 0
- Citations by year
- 2026: 38 · 2025: 110 · 2024: 157 · 2023: 168 · 2022: 133 · 2021: 195 · 2020: 176 · 2019: 133 · 2018: 104 · 2017: 46 · 2016: 25 · 2015: 17 · 2014: 21 · 2013: 7
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- UNICA IRIS Institutional Research Information System (University of Cagliari) (submittedVersion)
- arXiv (Cornell University)
- Funders
- Regione Autonoma della Sardegna (CRP-18293, L.R. 7/2007, F.S.E. 2007/2013, L.R. 7, 7/2007)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- poisoning attacks, support vector machine, adversarial training data, gradient ascent, malicious data injection, decision function, kernel methods, adversarial learning, classifier robustness
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
