Poisoning Attacks against Support Vector Machines
Battista Biggio Department of Electrical and Electronic Engineering, University of Cagliari, Piazza d’Armi, 09123 Cagliari, Italy Blaine Nelson Pavel Laskov Wilhelm Schickard Institute for Computer Science, University of Tübingen, Sand 1, 72076 Tübingen, Germany
Abstract
We investigate a family of poisoning attacks against Support Vector Machines (SVM). Such attacks inject specially crafted training data that increases the SVM’s test error. Central to the motivation for these attacks is the fact that most learning algorithms assume that their training data comes from a natural or well-behaved distribution. However, this assumption does not generally hold in security-sensitive settings. As we demonstrate, an intelligent adversary can, to some extent, predict the change of the SVM’s decision function due to malicious input and use this ability to construct malicious data.
中文速览
支持向量机（SVM）被广泛用于垃圾邮件、入侵检测等安全场景，但攻击者可以通过向训练数据中注入精心构造的恶意样本（即"数据投毒"）来破坏模型性能。本文提出了一种针对SVM的投毒攻击方法：利用SVM最优解对训练数据平滑依赖的性质，推导出验证集损失对攻击点位置的梯度，再用梯度上升迭代找到使分类错误率最大化的恶意样本；关键创新在于，整个优化过程只依赖输入空间中核函数的梯度，因此对非线性核同样适用，攻击者无需进入无法直接访问的特征空间。在人工数据集和MNIST手写数字识别任务上的实验表明，该方法能可靠地找到非凸误差曲面上的局部最大值，用极少量恶意样本就能显著拉高SVM的测试错误率。这项工作揭示了核方法在对抗性训练数据面前的脆弱性，提示安全敏感场景下的机器学习系统在算法设计阶段就必须将抗投毒能力纳入考量。
原文 arXiv:1206.6389;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1206.6389v3