10210_what_distributions_are_robust_.pdf (661.2 kB)

What Distributions are Robust to Indiscriminate Poisoning Attacks for Linear Learners?

Download (661.2 kB)
conference contribution
posted on 2024-02-14, 08:51 authored by Fnu Suya, Xiao ZhangXiao Zhang, Yuan Tian, David Evans
We study indiscriminate poisoning for linear learners where an adversary injects a few crafted examples into the training data with the goal of forcing the induced model to incur higher test error. Inspired by the observation that linear learners on some datasets are able to resist the best known attacks even without any defenses, we further investigate whether datasets can be inherently robust to indiscriminate poisoning attacks for linear learners. For theoretical Gaussian distributions, we rigorously characterize the behavior of an optimal poisoning attack, defined as the poisoning strategy that attains the maximum risk of the induced model at a given poisoning budget. Our results prove that linear learners can indeed be robust to indiscriminate poisoning if the class-wise data distributions are well-separated with low variance and the size of the constraint set containing all permissible poisoning points is also small. These findings largely explain the drastic variation in empirical attack performance of the state-of-the-art poisoning attacks on linear learners across benchmark datasets, making an important initial step towards understanding the underlying reasons some learning tasks are vulnerable to data poisoning attacks.


Primary Research Area

  • Trustworthy Information Processing

Name of Conference

Conference on Neural Information Processing Systems (NeurIPS)


@conference{Suya:Zhang:Tian:Evans:2023, title = "What Distributions are Robust to Indiscriminate Poisoning Attacks for Linear Learners?", author = "Suya, Fnu" AND "Zhang, Xiao" AND "Tian, Yuan" AND "Evans, David", year = 2023, month = 12 }

Usage metrics


    No categories selected



    Ref. manager