Reproduce “Poisoning Attacks against Support Vector Machines” on OpenResearch

About this paper

Battista Biggio, Blaine Nelson, Pavel Laskov

This research from the University of Cagliari and University of Tübingen establishes a gradient-based methodology for poisoning Support Vector Machines. A single crafted data point can increase classification error rates by five to ten times on datasets such as MNIST, demonstrating SVMs' vulnerability to input-space manipulations, even with non-linear kernels.

Key insights

• The SVM's optimal solution demonstrates a smooth dependence on training data, enabling the effective use of gradient-based optimization for crafting adversarial points.
• Optimizing for hinge loss on a validation set serves as an accurate and practical proxy for maximizing the true classification error of the SVM.
• The attack can semantically alter input data, causing malicious points to visually mimic features of a target class to induce misclassification, as shown with handwritten digits.

Summary by alphaXiv.