Source-linked AI summary
Poisoning Attacks against Support Vector Machines
Battista Biggio, Blaine Nelson, Pavel Laskov
TL;DR
Security-sensitive learning systems may face adversarial training data, but poisoning attacks had been studied only for simple anomaly-detection methods. This paper develops a gradient-ascent attack against SVMs using properties of the optimal solution and input-space kernelization. The attack substantially increases empirical classification error and supports further security analysis of SVMs against training-data attacks.
Problem
Poisoning attacks inject crafted training data, while prior studies had examined such attacks only for simple anomaly-detection methods.
Method
The method optimizes an injected labeled point by gradient ascent on validation loss, using SVM optimal-solution properties and kernelizable input-space gradients.
Results
A single attack point increased classification error from initial rates of 2–5% to 15–20% in exemplary runs.
Takeaways & Limitations
The attack demonstrates substantial empirical impact and motivates security analysis of SVMs against training-data attacks.
Takeaways & Limitations
The method assumes the attacker controls injected-point labels, which may fail when trusted sources assign labels.
Abstract
from arXiv · showhide
We investigate a family of poisoning attacks against Support Vector Machines (SVM). Such attacks inject specially crafted training data that increases the SVM's test error. Central to the motivation for these attacks is the fact that most learning algorithms assume that their training data comes from a natural or well-behaved distribution. However, this assumption does not generally hold in security-sensitive settings. As we demonstrate, an intelligent adversary can, to some extent, predict the change of the SVM's decision function due to malicious input and use this ability to construct malicious data. The proposed attack uses a gradient ascent strategy in which the gradient is computed based on properties of the SVM's optimal solution. This method can be kernelized and enables the attack to be constructed in the input space even for non-linear kernels. We experimentally demonstrate that our gradient ascent procedure reliably identifies good local maxima of the non-convex validation error surface, which significantly increases the classifier's test error.
1. Introduction
The paper frames poisoning as a security threat when adversaries can manipulate training data, and develops an SVM attack that predicts and optimizes its effect on the learned decision function.
- Security-sensitive learning data may be non-stationary and adversarial, allowing attackers to evade or mislead learning systems.
- Poisoning is a causative attack that injects specially crafted points into training data, exploiting practical data-collection channels such as malware repositories and honeypots.
- Prior poisoning studies considered only simple anomaly-detection methods, motivating analysis against Support Vector Machines.
- The proposed attack manipulates the SVM optimum by inserting points and uses gradients derived from how the optimal solution changes with data geometry.
- Because it depends on input-space dot-product gradients, the method can be kernelized and construct attacks in input space for nonlinear kernels.
2. Poisoning attack on SVM
The attack adds a labeled point and optimizes its location to increase validation hinge loss, using gradients that track smooth changes in the SVM optimum while support-vector structure remains fixed.
- Main derivation: The attacker chooses an attack point (x_c, y_c) whose addition to training data maximally decreases SVM classification accuracy.
- Main derivation: The attack maximizes hinge loss on a validation set after retraining the SVM with the injected point.
- Main derivation: The validation-loss objective is non-convex, so gradient ascent iteratively updates the attack point in a unit gradient direction with step size t.
- Main derivation: The gradient relies on smooth changes in the optimal SVM solution while the margin, error, and reserve-point sets retain their composition.
- Kernelization: Kernelization is enabled because the gradient depends on input-space dot-product gradients, with a small-step approximation extending the method to arbitrary kernels.
- Algorithm: Each update recomputes the optimal solution incrementally, and the procedure bounds attack-point size when the validation-error surface is unbounded.
3. Experiments
Experiments on Gaussian and MNIST data show that gradient ascent finds effective attack points and substantially increases SVM classification error. The attack also produces recognizable class-directed visual modifications, while effectiveness grows with the number of injected points.
- Artificial data: The Gaussian experiment traces attack-point movement and evaluates hinge loss and classification error across the input region for linear and RBF kernels.The attack begins from a randomly selected blue-class point with its label flipped, and the linear attack is constrained to x ∈[−4, 4]2.
- Artificial data: On Gaussian data, gradient ascent finds reasonably good local maxima of the non-convex error surface for both linear and RBF kernels.The linear-kernel attack reaches the bounded-region corner because its error surface is unbounded; the RBF attack finds a local hinge-loss maximum that also maximizes classification error in the examined region.
- MNIST: The MNIST attack blurs each initial digit prototype toward the attacking class, with digit-specific changes that mimic the target class.The bottom segment of the 7 straightens toward a 1, the 9 becomes rounder toward an 8, and added round noise makes the 4 resemble a 0.
- MNIST: On MNIST two-class tasks, a single attack point raises classification error from initial rates of 2–5% to 15–20%.The reported problems are 7 vs. 1, 9 vs. 8, and 4 vs. 0; random label flips alone produce the first-iteration errors, whereas the optimized attack achieves higher error rates.
- MNIST: Across multiple injected-point runs, attack effectiveness grows steadily with the percentage of attack points, although error variance remains high.These runs average results over randomly chosen training and validation sets containing 100 and 500 samples, respectively.
4. Conclusions and Future Work
The paper presents poisoning against SVMs as an initial step toward security analysis, while identifying practical and algorithmic directions for future work. Its experiments and discussion indicate substantial degradation from even non-optimal multi-point attacks, but deployment remains bounded by label-control and inverse-mapping constraints.
- The proposed gradient-ascent attack is described as a first step toward analyzing SVMs against training-data attacks.
- The attack achieves a surprisingly large impact on the SVM’s empirical classification accuracy.
- The method currently handles structural constraints by taking many tiny gradient steps, motivating more accurate and efficient step-size computation.
- Even non-optimal multi-point attack strategies significantly degrade SVM performance, while simultaneous optimization and subset selection remain open directions.
- A practical limitation is the assumption that the attacker controls injected-point labels, which may fail when labels come from trusted sources.
- Real-world inverse feature mapping remains open when attack data must be transformed into input-space features through complex, non-smooth operations and normalizations.