State-of-the-art machine learning models are vulnerable to data poisoning attacks whose purpose is to undermine the integrity of the model. However, the current literature on data poisoning attacks is mainly focused on ad hoc techniques that are only applicable to specific machine learning models. Additionally, the existing data poisoning attacks in the literature are limited to either binary classifiers or to gradient-based algorithms. To address these limitations, first a novel model-free label-flipping attack based on the multi-modality of the data is introduced. In the proposed label-flipping attack the adversary targets the clusters of classes while constrained by a label-flipping budget. The proposed attack can increase the error up to two times for the same attack budget. Second, a novel defense technique based on the Synthetic Reduced Nearest Neighbor (SRNN) model is presented. The defense technique can detect and exclude flipped samples on the fly during the training procedure. Through extensive experimental analysis, I demonstrate that (i) the proposed attack technique can deteriorate the accuracy of several models drastically, and (ii) under the proposed attack, the proposed defense technique significantly outperforms other conventional machine learning models in recovering the accuracy of the targeted model.
Bio:
Pooya Tavallali is currently a Ph.D. student at the Department of Electrical Engineering and Computer Science, University of California, Merced. He received his B.Sc. and M.Sc. degrees in Electrical Engineering (Communication Systems) from Shiraz University in Iran, in 2013 and 2016, respectively. His research interests include machine learning, optimization algorithms, statistical signal and image processing, neural networks, and statistical pattern recognition. Pooya is doing research on a diverse set of problems including optimization of partition-wise machine learning models such as decision trees and prototype nearest neighbors, applications of new machine learning techniques in epidemiology, unsupervised learning, training under adversarial attack, and object detection. Pooya has published more than 10 papers in top venues during his PhD including NeurIPS, AAAI and ICIP.